a8ab6a4b51c1f055d344543e105acca7d66191ea3f223eae1f44943f6e3a68da

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54c6f0654b93d2f105b66db4fa10b5ed.exe
Size

1.9MB
MD5

54c6f0654b93d2f105b66db4fa10b5ed
SHA1

9ff6655d6c17abda2de2d173d596f8264388c437
SHA256

a8ab6a4b51c1f055d344543e105acca7d66191ea3f223eae1f44943f6e3a68da
SHA512

3e4e87ca56161fcad78b07f4a1d84a8cd23d9b91558cfab14de39e47c8feb8e119b2b9f2f952e9f5436d895b52dc9a0b4b380fe0d369217c94a8091af9721dd8
SSDEEP

49152:3ZfKwJkIEj9rEEgebEksgZJcoDGYkSb+kWuAJ:4weI694EgenDz+V

Score

8^/10

evasion spyware stealer upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2588	netsh.exe

ACProtect 1.3x - 1.4x DLL software 7 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000016448-38.dat	acprotect
behavioral1/files/0x0006000000016287-39.dat	acprotect
behavioral1/memory/1904-52-0x0000000060220000-0x0000000060229000-memory.dmp	acprotect
behavioral1/memory/2288-46-0x0000000060220000-0x0000000060229000-memory.dmp	acprotect
behavioral1/files/0x00060000000167d5-43.dat	acprotect
behavioral1/files/0x00060000000165ae-42.dat	acprotect
behavioral1/files/0x000600000001650c-41.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
2620	msnmsgr.exe
2168	msnmsgr.exe
2288	FirePassword.exe
1904	FirePassword.exe

Loads dropped DLL 3 IoCs

pid	Process
2936	54c6f0654b93d2f105b66db4fa10b5ed.exe
2936	54c6f0654b93d2f105b66db4fa10b5ed.exe
2620	msnmsgr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-15-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral1/memory/2168-16-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral1/memory/2168-19-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral1/memory/2168-24-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral1/memory/2168-23-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral1/memory/2168-22-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral1/files/0x0006000000016448-38.dat	upx
behavioral1/files/0x0006000000016287-39.dat	upx
behavioral1/memory/2288-44-0x0000000060210000-0x000000006021A000-memory.dmp	upx
behavioral1/memory/2288-47-0x0000000060260000-0x00000000602BF000-memory.dmp	upx
behavioral1/memory/1904-54-0x0000000060260000-0x00000000602BF000-memory.dmp	upx
behavioral1/memory/1904-53-0x0000000060140000-0x000000006016D000-memory.dmp	upx
behavioral1/memory/1904-52-0x0000000060220000-0x0000000060229000-memory.dmp	upx
behavioral1/memory/1904-51-0x0000000060210000-0x000000006021A000-memory.dmp	upx
behavioral1/memory/1904-50-0x0000000060170000-0x00000000601D7000-memory.dmp	upx
behavioral1/memory/2288-46-0x0000000060220000-0x0000000060229000-memory.dmp	upx
behavioral1/memory/2288-45-0x0000000060140000-0x000000006016D000-memory.dmp	upx
behavioral1/files/0x00060000000167d5-43.dat	upx
behavioral1/files/0x00060000000165ae-42.dat	upx
behavioral1/files/0x000600000001650c-41.dat	upx
behavioral1/memory/2288-40-0x0000000060170000-0x00000000601D7000-memory.dmp	upx
behavioral1/memory/2168-94-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral1/memory/2168-480-0x0000000000400000-0x0000000000489000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2620 set thread context of 2168	2620	msnmsgr.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411174782"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E426461-B0D2-11EE-8EEA-EE2F313809B4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000ae0ad4272914d8e623f81b52c182826b37ca97394ac5e1151c0319c8bb2823b0000000000e80000000020000200000005f0e4f9266b21f4d5b09b3c517cb5cf35c24fd144e9b1c7fc61bc9abb522737290000000a2a833f492568e6f7d45409caee575669ea4d07bccd366b586175e98ed0aaf97bb6be468061fc79b4061b1665ae83ffe4ae1639e360faaa744a8eaa7d1118f34f5092b2dedf43d0ed90064ec4949789b80e2cb7db9569d3b5ed8b533ec0cbc5991f74c707c302e8d686939a34b226d833a6b5532cf5265dcbcd1506a40a3254dd7ceac116e2ff1d06b28f069825ed608400000005dd9a12e2b22ac9963db00bde802d38fdd7c09034a6b66f25d90c82c4287318280f9c7df1d9c8e1cad0b72961fa798ad66dc78c2f8efa87500ae2505398d7344	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000009d9ff597533bbef54a3f720c111fed0e447596b09b9e972993412676994457bd000000000e8000000002000020000000b0b129c14639df07730c3609b9994bc72387aca74d066a9b7928cb66bd1c3d9320000000ef2b78fb5de908e2347a160ea943eb7e76ad2a9a0dd48ff0693e1bb2004538da40000000f057684c83fa13e37dafa360a2c73db834290fa4f1b72273d673a9992241c98d5f018616c1fcf7c0298bf0ac2bd4f317ee9e59cf9dcc0d5d41c3e3d08b4ebfaf	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0abab72df44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2620	msnmsgr.exe
2168	msnmsgr.exe
2648	iexplore.exe
2648	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2620	2936	54c6f0654b93d2f105b66db4fa10b5ed.exe	28
PID 2936 wrote to memory of 2620	2936	54c6f0654b93d2f105b66db4fa10b5ed.exe	28
PID 2936 wrote to memory of 2620	2936	54c6f0654b93d2f105b66db4fa10b5ed.exe	28
PID 2936 wrote to memory of 2620	2936	54c6f0654b93d2f105b66db4fa10b5ed.exe	28
PID 2620 wrote to memory of 2168	2620	msnmsgr.exe	29
PID 2620 wrote to memory of 2168	2620	msnmsgr.exe	29
PID 2620 wrote to memory of 2168	2620	msnmsgr.exe	29
PID 2620 wrote to memory of 2168	2620	msnmsgr.exe	29
PID 2620 wrote to memory of 2168	2620	msnmsgr.exe	29
PID 2620 wrote to memory of 2168	2620	msnmsgr.exe	29
PID 2620 wrote to memory of 2168	2620	msnmsgr.exe	29
PID 2620 wrote to memory of 2168	2620	msnmsgr.exe	29
PID 2168 wrote to memory of 2572	2168	msnmsgr.exe	34
PID 2168 wrote to memory of 2572	2168	msnmsgr.exe	34
PID 2168 wrote to memory of 2572	2168	msnmsgr.exe	34
PID 2168 wrote to memory of 2572	2168	msnmsgr.exe	34
PID 2936 wrote to memory of 2648	2936	54c6f0654b93d2f105b66db4fa10b5ed.exe	33
PID 2936 wrote to memory of 2648	2936	54c6f0654b93d2f105b66db4fa10b5ed.exe	33
PID 2936 wrote to memory of 2648	2936	54c6f0654b93d2f105b66db4fa10b5ed.exe	33
PID 2936 wrote to memory of 2648	2936	54c6f0654b93d2f105b66db4fa10b5ed.exe	33
PID 2572 wrote to memory of 2588	2572	cmd.exe	31
PID 2572 wrote to memory of 2588	2572	cmd.exe	31
PID 2572 wrote to memory of 2588	2572	cmd.exe	31
PID 2572 wrote to memory of 2588	2572	cmd.exe	31
PID 2648 wrote to memory of 2700	2648	iexplore.exe	32
PID 2648 wrote to memory of 2700	2648	iexplore.exe	32
PID 2648 wrote to memory of 2700	2648	iexplore.exe	32
PID 2648 wrote to memory of 2700	2648	iexplore.exe	32
PID 2168 wrote to memory of 3004	2168	msnmsgr.exe	35
PID 2168 wrote to memory of 3004	2168	msnmsgr.exe	35
PID 2168 wrote to memory of 3004	2168	msnmsgr.exe	35
PID 2168 wrote to memory of 3004	2168	msnmsgr.exe	35
PID 3004 wrote to memory of 2288	3004	cmd.exe	37
PID 3004 wrote to memory of 2288	3004	cmd.exe	37
PID 3004 wrote to memory of 2288	3004	cmd.exe	37
PID 3004 wrote to memory of 2288	3004	cmd.exe	37
PID 2168 wrote to memory of 2316	2168	msnmsgr.exe	40
PID 2168 wrote to memory of 2316	2168	msnmsgr.exe	40
PID 2168 wrote to memory of 2316	2168	msnmsgr.exe	40
PID 2168 wrote to memory of 2316	2168	msnmsgr.exe	40
PID 2316 wrote to memory of 1904	2316	cmd.exe	38
PID 2316 wrote to memory of 1904	2316	cmd.exe	38
PID 2316 wrote to memory of 1904	2316	cmd.exe	38
PID 2316 wrote to memory of 1904	2316	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\54c6f0654b93d2f105b66db4fa10b5ed.exe
"C:\Users\Admin\AppData\Local\Temp\54c6f0654b93d2f105b66db4fa10b5ed.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\msnmsgr.exe
  C:\Users\Admin\AppData\Local\Temp\msnmsgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\msnmsgr.exe
    "C:\Users\Admin\AppData\Local\Temp\msnmsgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c netsh firewall set opmode disable
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2572
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\FirePassword.exe "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\FirePassword.exe
        
        C:\FirePassword.exe "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release"
        5⤵
        Executes dropped EXE
        
        PID:2288
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\FirePassword.exe "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.Admin"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2316
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7427.gif
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648

C:\Windows\SysWOW64\netsh.exe
netsh firewall set opmode disable
1⤵
- Modifies Windows Firewall
PID:2588

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700

C:\FirePassword.exe
C:\FirePassword.exe "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.Admin"
1⤵
- Executes dropped EXE
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FirePassword.exe

Filesize
80KB

MD5
b199ac8e35357580b48f7b33868e67a2

SHA1
f72aeaa3b66d8388bdf7116317b12084393624b6

SHA256
410bebeacf59ec783bff358437305cb4b982bcbc6c06a4a3389f3e8432d2751e

SHA512
ed50383a66f42df530b1c28d882f86bc27cdd42404250912e3a0fc72df46eabb19ac7a13e424fbd83ba82d2ddc508fee582182f1009059b6195acbe35f1831a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
377340387ea9a213ce4aabbae884dc98

SHA1
37937c55232b864d94ff75d6ba4407bda60018f4

SHA256
a3cd63ea92d3bdc5cc4790ec83a585bc4d54815642fccd14d3b61ea1848979f4

SHA512
0a1529e060c89ea834aa724b3f4c0939b319303d78c012880c5847a95e2abf20b2fa7a06dfc13ad5b9d76db0d6b666f67c8a87f045160e48fda4c2a0075f163d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e2ce31493d407364341c8724550f2e14

SHA1
397dffb1de5e6e94f2993ec4e6d19a6ba69aa84a

SHA256
0278d4fd12ec2e8ea1f4b028c92b850eb4b6ba03c5357f11b7ba1d70f859fe9f

SHA512
ff6b5bb4bfbae0b389d866200fa3478e577d51d854eb88a6bc13cff7bd2c756cb81f6dc29890a8b0617fbe20ba6dc972fcadae763f370d4e1244b92f35c8f0f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b5247233773e7bb61571890481b45c64

SHA1
5c98f68f2ed99156b5a6dc59168dc40a2980d228

SHA256
e6d3739e3f92901d7280db34d9d888ab10eb647ca34e26a9ee00ad6f648a6730

SHA512
8f98e8d28563233a660d0685e09cfa8eb9af9d59115637fb1ac73b2eb044fa8e0c4861a521b35aca40c50b944a3f004c159a30bf3abd08cc33824de9ed46bb7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fbd33054f58ba2ee3f42b7d963c985a1

SHA1
6501110e75b7347f71dd02db1142471ecf007dd1

SHA256
477ea3fff13a021f16d0ff44cfc33ece3661cb28fdd72ac02afaaa97783df929

SHA512
59f2f472bfefc355b43eaa49f922437f2901bc5b655d32187278f58532d35a9917d52b05cd3be5fdb40227edb02daa4ecba1204ae2c8b3ca70286778fa3681bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1e5690b022bee831260057d0eb586ee3

SHA1
a5cdff3a15fb8b08fa5e58c316c530fcdd345bbb

SHA256
8bdabe60eccf6e6d8781fa62854a83bc1dcb619e3ab630070b133cb96e54edce

SHA512
bf29e8e91fcc6e1e8a6fac35ef50faa58eba53bfda6415c32f421b1441abcba1b51cb405c2fa6d5e285db4494d7e3b639ed049ff4cc715695e2e94bc6f1ba2a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dd762acc6fb0e39a9c25aa08b14c1fa3

SHA1
0c5bd653520b19198b9b4111a507792087dcc6fa

SHA256
c8435156e9494b18f48f50bc82786e7d06b6173aa40e5310fd21524a63ffdad1

SHA512
85d5eae354974ce7c548ac6f883fec9c5706c45158541b7809b9a774ebd172f61850e5084c0c847c9f635e622fb3a938aa53ed1351acd17c2093a02e743a67a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4338b3f95da2a2a71023a4d0e6666e64

SHA1
4faffd526551ef9fc5d84d8872f98d578764c25c

SHA256
4195b574d1c4ba5f3ce35765d28c039e78919fb0238f22871379002d63a7006a

SHA512
d13c8fc9b57d915548cabaafc5054a202af81cedcc7ffc76abd631024b596a86b65a132a07a1881a8bc93f8c7272ac84a72a6e166c9404e2973639c084be24fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1ad5e7ed08da56e77a5a8319d34cec18

SHA1
a6457694bdf5a68c879da32f8147bdccbd68804b

SHA256
d4c0d62086354394248b609b490baa6876d34729fc2828e24e7cc1b5a2123f81

SHA512
ea2b3ceb767557b12c7a0fafba52e4ee9bfe015a355f36f17d90fe00a6d1d31aec5f9991ee3fb03d77553cf304626147a5bc052ffe38e8ac6045e3bfb9e5e454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0deebd9ec6d16df10d9b5fd34c4bd987

SHA1
3cdb5df4d7a76cb9ef78158eb1d5f51c0c8da9e2

SHA256
7e842baea80d0efe0c0fe2469a82dc68d4c0f1b69c0b2e25484f1000ea3ff766

SHA512
6712a05e79328d559e5c3f81e158c47f53eec42c6e75d5d2b3d8537517de3c19e4864190b3074414920d137fb0bcad8e8b60240015af402cd3d20a93ab58cf52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a937e02fbe7c54fe2b417507578453db

SHA1
7c141633234e0ed69a3b3faf5a9b9ec66ba1875a

SHA256
ff2f6566330d6c7d21a34085aa351d975185e6a194a608df8625c128506c6297

SHA512
5b977ef845fd776322ced462db7b490f7fab595ff3d263436fcc4a302da2afc78b9e04174848885ed94d19c41e768eb9e8baf71bd2640fc08acf8e91abcd2cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
73921affd3c819a67c80efba6e18faf9

SHA1
051c2ee19548480d40ea1e40c57b9eb962579f14

SHA256
4bcf8fd3c5452fef9c61caa9b0dd75e0e238c301211997cfccc483a1d2f1177a

SHA512
2570827bc025052b2537456d9ae3bfb787fa1441890c7014b7a9919634baecb790b6cbc890918ed4f3516c03e4a6a3c564ead577e2cba0240d891326df0beaa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5429f00fcb42ecdd3c972912091245ec

SHA1
f51d644a7b810b2f4d2fc290575eecf811c588c2

SHA256
52d498d2b0f4fef50282f9000a781b2c34a2889f5747091d514d1838f1d9c9cd

SHA512
8501c9b1e4a0bdfca659d4a583f889672140771531abf738b4ea6cb980c5dba48031e387c8b65d1612b14a42522b37e149093a79a69ed4d057d281dbfdfb3e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
eec02403025ba44484d73a666bffbb79

SHA1
f13e6661f54b5fb8aeb3f989e62549067ee1dde7

SHA256
cb26cf5939aebbd13ad3da7f32bd17393abfe77329389270a61424f6e441c440

SHA512
fd3edcad35bd874649f0b4fd61b64b197087f05dca9264d82b33ba0a942b3eb8ec367b12f5743d194df46e2366e2fb55f18bc0cf3ff9bde6d25a7197a7356a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7427.gif

Filesize
192KB

MD5
ab58ad50e0f848c633486e140216e2e7

SHA1
31d0f98c8a3f9fbada9bbffd00bafb3b3a0c80bb

SHA256
17d16d406fb9defeb1fb53fa499abc042fab17527b225132a3401ea22134a17e

SHA512
81d96f14fb4e61e322b9e465a3cc16b794c1a4d2efa53123166801a3c87a8f47d746c3f5a15022489ccaf5ab9fa629624a47700daa9bc0ad82f824ce5324f3fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar47A1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\nspr4.dll

Filesize
72KB

MD5
72414dfb0b112c664d2c8d1215674e09

SHA1
50a1e61309741e92fe3931d8eb606f8ada582c0a

SHA256
69e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71

SHA512
41428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9

Download Submit
C:\nss3.dll

Filesize
172KB

MD5
7ddbd64d87c94fd0b5914688093dd5c2

SHA1
d49d1f79efae8a5f58e6f713e43360117589efeb

SHA256
769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1

SHA512
60eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d

Download Submit
C:\plc4.dll

Filesize
8KB

MD5
c73ec58b42e66443fafc03f3a84dcef9

SHA1
5e91f467fe853da2c437f887162bccc6fd9d9dbe

SHA256
2dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7

SHA512
6318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf

Download Submit
C:\plds4.dll

Filesize
6KB

MD5
ee44d5d780521816c906568a8798ed2f

SHA1
2da1b06d5de378cbfc7f2614a0f280f59f2b1224

SHA256
50b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc

SHA512
634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8

Download Submit
C:\softokn3.dll

Filesize
155KB

MD5
e846285b19405b11c8f19c1ed0a57292

SHA1
2c20cf37394be48770cd6d396878a3ca70066fd0

SHA256
251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477

SHA512
b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7

Download Submit
\Users\Admin\AppData\Local\Temp\msnmsgr.exe

Filesize
478KB

MD5
2284021d2a9f3e2232cd2483de44f17b

SHA1
d5e4fdce8f67e282bffd8d2cf45e3f569a2d74fe

SHA256
9039c1d77eaf4aa31c7619ea5e08c0c085ee756f4e09b0810af73853c192574f

SHA512
cdcf3aeb5796043f34ec4e38f8eb7b94667317518ff3832a6f13084062a9b0ac423d23978611e34bc50899a1cdd5121ee7a09be4daa5a5a498d14079d2ef5bf0

Download Submit
memory/1904-52-0x0000000060220000-0x0000000060229000-memory.dmp

Filesize
36KB

Download
memory/1904-54-0x0000000060260000-0x00000000602BF000-memory.dmp

Filesize
380KB

Download
memory/1904-50-0x0000000060170000-0x00000000601D7000-memory.dmp

Filesize
412KB

Download
memory/1904-53-0x0000000060140000-0x000000006016D000-memory.dmp

Filesize
180KB

Download
memory/1904-51-0x0000000060210000-0x000000006021A000-memory.dmp

Filesize
40KB

Download
memory/2168-23-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2168-24-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2168-15-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2168-13-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2168-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2168-94-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2168-22-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2168-16-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2168-480-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2168-19-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2288-40-0x0000000060170000-0x00000000601D7000-memory.dmp

Filesize
412KB

Download
memory/2288-45-0x0000000060140000-0x000000006016D000-memory.dmp

Filesize
180KB

Download
memory/2288-477-0x0000000060260000-0x00000000602BF000-memory.dmp

Filesize
380KB

Download
memory/2288-44-0x0000000060210000-0x000000006021A000-memory.dmp

Filesize
40KB

Download
memory/2288-47-0x0000000060260000-0x00000000602BF000-memory.dmp

Filesize
380KB

Download
memory/2288-46-0x0000000060220000-0x0000000060229000-memory.dmp

Filesize
36KB

Download
memory/2936-28-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads