ece6f1cc55af17d8555fd7ebccfdfb17dff2d3817ce348902b593e8d43ec435b

Analysis

max time kernel
12s
max time network
17s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windowsdesktop-runtime-6.0.26-win-x64.exe
Size

54.9MB
MD5

fc7c51112cc29b1cb72d82fab00aba93
SHA1

3e6bf16d6f171b0dcc3c630a1bd9371eeb22aa30
SHA256

ece6f1cc55af17d8555fd7ebccfdfb17dff2d3817ce348902b593e8d43ec435b
SHA512

7dd45e746fb0b82c13b91559ac25a39b66b9c94c22e5f9bd91b1dceaff96922b1da2fed152ec36e15f2c7a38e0180508f81807930928c5d0aea225f117a108c4
SSDEEP

1572864:4z1pd8HD1vXqG7nYaXrNF3wZFvxIlYRKrSR5E/:4z1pdKDZXDLnxAxT2w5E/

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{b2476903-b8da-4dcc-903f-378730bb4c48} = "\"C:\\ProgramData\\Package Cache\\{b2476903-b8da-4dcc-903f-378730bb4c48}\\windowsdesktop-runtime-6.0.26-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.26-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.26 (x64).swidtag	windowsdesktop-runtime-6.0.26-win-x64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	windowsdesktop-runtime-6.0.26-win-x64.exe

Executes dropped EXE 2 IoCs

pid	Process
2752	windowsdesktop-runtime-6.0.26-win-x64.exe
2468	windowsdesktop-runtime-6.0.26-win-x64.exe

Loads dropped DLL 3 IoCs

pid	Process
2548	windowsdesktop-runtime-6.0.26-win-x64.exe
2752	windowsdesktop-runtime-6.0.26-win-x64.exe
2752	windowsdesktop-runtime-6.0.26-win-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{b2476903-b8da-4dcc-903f-378730bb4c48}	windowsdesktop-runtime-6.0.26-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b2476903-b8da-4dcc-903f-378730bb4c48}\ = "{b2476903-b8da-4dcc-903f-378730bb4c48}"	windowsdesktop-runtime-6.0.26-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b2476903-b8da-4dcc-903f-378730bb4c48}\Version = "6.0.26.33205"	windowsdesktop-runtime-6.0.26-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b2476903-b8da-4dcc-903f-378730bb4c48}\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.26 (x64)"	windowsdesktop-runtime-6.0.26-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b2476903-b8da-4dcc-903f-378730bb4c48}\Dependents\{b2476903-b8da-4dcc-903f-378730bb4c48}	windowsdesktop-runtime-6.0.26-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b2476903-b8da-4dcc-903f-378730bb4c48}\Dependents	windowsdesktop-runtime-6.0.26-win-x64.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeRestorePrivilege	816	msiexec.exe
Token: SeTakeOwnershipPrivilege	816	msiexec.exe
Token: SeSecurityPrivilege	816	msiexec.exe
Token: SeCreateTokenPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeLockMemoryPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeMachineAccountPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeTcbPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeSecurityPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeTakeOwnershipPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeLoadDriverPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeSystemProfilePrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeSystemtimePrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeProfSingleProcessPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeIncBasePriorityPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeCreatePagefilePrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeCreatePermanentPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeBackupPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeRestorePrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeShutdownPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeDebugPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeAuditPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeChangeNotifyPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeRemoteShutdownPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeUndockPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeSyncAgentPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeEnableDelegationPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeManageVolumePrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeImpersonatePrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe
Token: SeCreateGlobalPrivilege	2468	windowsdesktop-runtime-6.0.26-win-x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	windowsdesktop-runtime-6.0.26-win-x64.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2752	2548	windowsdesktop-runtime-6.0.26-win-x64.exe	28
PID 2548 wrote to memory of 2752	2548	windowsdesktop-runtime-6.0.26-win-x64.exe	28
PID 2548 wrote to memory of 2752	2548	windowsdesktop-runtime-6.0.26-win-x64.exe	28
PID 2548 wrote to memory of 2752	2548	windowsdesktop-runtime-6.0.26-win-x64.exe	28
PID 2548 wrote to memory of 2752	2548	windowsdesktop-runtime-6.0.26-win-x64.exe	28
PID 2548 wrote to memory of 2752	2548	windowsdesktop-runtime-6.0.26-win-x64.exe	28
PID 2548 wrote to memory of 2752	2548	windowsdesktop-runtime-6.0.26-win-x64.exe	28
PID 2752 wrote to memory of 2468	2752	windowsdesktop-runtime-6.0.26-win-x64.exe	29
PID 2752 wrote to memory of 2468	2752	windowsdesktop-runtime-6.0.26-win-x64.exe	29
PID 2752 wrote to memory of 2468	2752	windowsdesktop-runtime-6.0.26-win-x64.exe	29
PID 2752 wrote to memory of 2468	2752	windowsdesktop-runtime-6.0.26-win-x64.exe	29
PID 2752 wrote to memory of 2468	2752	windowsdesktop-runtime-6.0.26-win-x64.exe	29
PID 2752 wrote to memory of 2468	2752	windowsdesktop-runtime-6.0.26-win-x64.exe	29
PID 2752 wrote to memory of 2468	2752	windowsdesktop-runtime-6.0.26-win-x64.exe	29

C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.26-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.26-win-x64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\Temp\{FC2D215F-74E2-46AB-9C76-9EAD3924D84A}\.cr\windowsdesktop-runtime-6.0.26-win-x64.exe
  "C:\Windows\Temp\{FC2D215F-74E2-46AB-9C76-9EAD3924D84A}\.cr\windowsdesktop-runtime-6.0.26-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.26-win-x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\Temp\{9024956F-3508-407D-B14C-D46B3F5C8A18}\.be\windowsdesktop-runtime-6.0.26-win-x64.exe
    "C:\Windows\Temp\{9024956F-3508-407D-B14C-D46B3F5C8A18}\.be\windowsdesktop-runtime-6.0.26-win-x64.exe" -q -burn.elevated BurnPipe.{EFDA3F2F-D5F0-4310-8A16-088B4FDF7487} {21166C8C-F20B-484F-B040-14B8C1F9EAED} 2752
    3⤵
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2468

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 31525303F1D0B6ADB2DF4D00716DB1C1
  2⤵
  PID:2504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 860E897FDD46ADAAD012159151B63CE4
  2⤵
  PID:540
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1CA05124D459E96357DBF35FBBD466D9
  2⤵
  PID:3040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C3C9A8015E8624CF3DE95AF529869F4E
  2⤵
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76395c.rbs

Filesize
55KB

MD5
9a6665ac3a3344d4e2cfa0e2f44cc3df

SHA1
8598bce1993a7a8f9f0ebe3c56d8f5842d16454d

SHA256
dfd541fd592d8a9b0dae40e40c70375b568249dd727a097105d3462cffc5db64

SHA512
0fce063a4751486986e2b094ae713d9d81d9d7d2c2a775f2f1feaac05de8f8f0b1b000396f75d735ae2287a23d91e3d8b4335a98397d02c3fa5bbe186c6067b1

Download Submit
C:\Config.Msi\f763962.rbs

Filesize
8KB

MD5
04932806c554e2731828247e6b0c936c

SHA1
458752ad82ddd2a5f68114110dc3fa07abd30ab2

SHA256
a982144e0b33fe6a73276f93839aad321fd396112a3cc190ca9c2e0758318e33

SHA512
274d04648783132892f48b5b6c22df47490da8cb9b43a8373dcb973541ae6cee504efe29159824a9425d04851e6bbfedd04991174fef84acddb8feb36314566d

Download Submit
C:\Config.Msi\f763968.rbs

Filesize
9KB

MD5
c04e48ffd22d7db6ff04fb2d383549e5

SHA1
e461ea2682f8fbbc3dc13cc08bbc8571a512fb82

SHA256
e24c4c6c44d9ae59c0bb2b4c8c9ec30971c25e0d45b62abe24ab407413ef144c

SHA512
084b47934b5ba5cbfb31dab12d94f0db5bd7a13fcbc0959145fa16eb22cb90b71a4909af387187abcdcb7cf847ebe5427e55ea096e0dea2edd928a4dd82e8169

Download Submit
C:\Config.Msi\f76396e.rbs

Filesize
87KB

MD5
712a69d391f82873e0e97670a23caebc

SHA1
c793f91aa197db96534db6d0a6d565970d9405ab

SHA256
df8e17c24cd735e47b83f666136e8d9f29e3eeb1584f29bd7138544888429fdb

SHA512
aa54c575b0bdba0f0405fada2cbe3519b8547b3b3b10c3379f3ec9b5186f8f47959da135e40ea1ba7e0f18bd25a0bacacdc46f2c1eeb74f4fec49a06486b52cd

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9ef87f959f0c4f7da3bdbcb7fd1bb6a

SHA1
78b899ad4136fecbbd654395787f6ba1f3124694

SHA256
37e24dc283760c00f313a4ef102eabf5f30d5ae741d6f8d7dfc67e66cdd5a64e

SHA512
fd38c610a545fc17d20e610e36fafb670b05ec7e423bc1283f6795fb7086daa4deaf08bb1b1e72580e8a614b800496e9c09dab51443642eec56f495d5a062907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4ff3a6ad0e76a39375a9c3d32bccab4

SHA1
ddd6d85a28d8370b566332e528b44bffbd750fb4

SHA256
e20e7e837116c2b81ca4d2022460d69ebb1e1699f43c4a97d7572ce838e1ec93

SHA512
4d0285dc875f754e3a53fdbf5ab781399d2f1939b9e561dd81d90fa1f2c47d0a8243b2ea4b7e99b6d5ce1576dbdd262b50253f822a34eb116647f3f4e4827499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de152c4f3b0b439852b25c7a9d042de

SHA1
082efa5b40a73b06d6c545c00e0225f2c6eacb2c

SHA256
78fdfd542638d64de7fcd162fdbcc4a175ac1be3240f4e9d7f8306ee1e5a3304

SHA512
c7a0f1636e5df1f7cb136ee5dbfcef83d19964d7b633cdd5b6016f52ad3772b4982ae02b1621439b6732ca5eb25ccd67e04128a4be9c698eaf319ceafdaa921c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9d64e747ed7c14f004378413b558eaea

SHA1
5b02e12388fc74e9ad8086c49246e09ace3dcf1a

SHA256
b6101a2d264bf3adb6f0f1d206df572f21a302025935ad5563e1a2bed9f62ac7

SHA512
f6e5870e3ede38d5e5476bc2976a149af69e59e3f42b35d8cc896bf955fe23924ec54523e72f20dda3fd6f8a29bccdeebce5c7d4711d408d5c8fe40e951e3839

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.26_(x64)_20240114174229_000_dotnet_runtime_6.0.26_win_x64.msi.log

Filesize
2KB

MD5
7dc6affc692c3099793f5e955cdb5327

SHA1
a59360b5681a9b3cc68268fb2843a2df7bc0e5a4

SHA256
d7cc593de4be848231c497ebe3f7d3bc9462fff57377532864f27f6bad54163f

SHA512
f02727c86baef977170aed4a9632e704df3f70ad90a8bdfe58a03caf71ea7a8605e90b6255d87ede6f8761ea90f2fd9b339fb2a8191c7d0d1819f1cc7b4c3127

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.26_(x64)_20240114174229_001_dotnet_hostfxr_6.0.26_win_x64.msi.log

Filesize
2KB

MD5
f4c0cca303e02fd84c90de159be54c80

SHA1
bb7c01696df45025eb85899be1c9b714d6c1e4f0

SHA256
78b37822b80342abd7c547aa2a91916010be79dbf50265ac79418c2e5098aabc

SHA512
4380a009d46f62824042df60a341120cd05078baf2273fc8f8e227b0676434308a9b4ebf91f61cc64d44afd35ef4aaf662de4c0f77168e7708ffeb55e8eb3dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.26_(x64)_20240114174229_002_dotnet_host_6.0.26_win_x64.msi.log

Filesize
2KB

MD5
f66eb307c48f714fd0ff408ed0a1e35a

SHA1
77f64099a12236a051eea1bf7ea60df01a80e585

SHA256
fe0ca954c247f57692beb9e81e16b9029e28a707cd8905890f6deeb5631dbe1d

SHA512
14a9895c7729ff3b814fa27c063254072d30182ada618895024bf5cd47fd42b31a551f19bb4068b9e8d7696e66c637af6c7bfd5a78c42841f96643e7a42d02ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.26_(x64)_20240114174229_003_windowsdesktop_runtime_6.0.26_win_x64.msi.log

Filesize
2KB

MD5
a50e4c204d8653dd3171b5aacc6167cd

SHA1
a4946afeb52dde1ccdc4a147ffe836fd24d6a9c4

SHA256
dee451da53ccfc6bd8a4ac1c1c1e3e7270eeaba299d29428de1155b760c68e81

SHA512
f5db937d96c2cfe5d2bd95ef6ba52c5cd224d50c81b8d764762c7aa7fee3a1a514af1240ba06cd7c5eea2cccfbbbaa3ab5d024bb2423884b13fa620cc9861cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CF6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Windows\Installer\f76395d.msi

Filesize
921KB

MD5
3aa09e364c82b8908ca32baa64cac8e0

SHA1
1c85586cd476b7dc7f3b5b837235807a66f4556a

SHA256
bd081876a87b7c76ecbc0fb0632582ed523d1ff64bfb5be5bd089b0029ac3d7b

SHA512
9b19d1169ecd53184a4b92c992337824d279f38f787ec0f117cf53bf1bafec9de4647b0101774d4624f4a89a2daef5d4d92f768b1906beffd67b03b26538300f

Download Submit
C:\Windows\Installer\f76395e.msi

Filesize
489KB

MD5
a95fc103360b68c40cbd12576c1c7c56

SHA1
deab5b75a7d7456bb297a1a0c4573610b98907bd

SHA256
052fb0599472091206bf615c71b6e2a7722009993bbd8c4021e4459c15769c85

SHA512
3e164dc76381d8e2bec2558f260be5d62d961dff49f4957c7f9e9fe2483f8b2bda5a74f56b9a996c5349e6bf42971000bbe281ea8e107b30f770a55281adf154

Download Submit
C:\Windows\Installer\f76396f.msi

Filesize
583KB

MD5
e959644f3be47c59c7ddb94ddcb60ad4

SHA1
84328b28467b5c242ba07b2311e997176b2e2f6d

SHA256
82d44a373f3b3f3213df3612e4fed9f921e5964c0ca78bb4955059b95d01103a

SHA512
30b9c649273cdf417e97940e4545c8e8ef6f5834126114a698fb76551199208460de205133b8ae8b4377c12202da27b89c7ef9fe709db4f7721d658ec5d17856

Download Submit
C:\Windows\Temp\{9024956F-3508-407D-B14C-D46B3F5C8A18}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{9024956F-3508-407D-B14C-D46B3F5C8A18}\dotnet_host_6.0.26_win_x64.msi

Filesize
736KB

MD5
2975110113299f19f0d32be131b7b2f4

SHA1
ce6d9b72878e510b38cc5d0064fda7eb08d93d90

SHA256
d09987771e1a930bfa35c0db1e0ac70c76a7eb8e59247437ea326ee29002c4d0

SHA512
b6de60e3fc5332704a6d7b8c17357aeb5bdf3028895cbcfb4bd66d10fbc47ad70d5eff9e533ee6275baee461f9bddc6c0ada4f76e84e5366d48353d7de314506

Download Submit
C:\Windows\Temp\{9024956F-3508-407D-B14C-D46B3F5C8A18}\dotnet_hostfxr_6.0.26_win_x64.msi

Filesize
804KB

MD5
51ada9b6c77551b7a3ea5832acc92aa2

SHA1
b25835b87d89e2a49dd9ff44d6809c6d50abad19

SHA256
7de32d48fc2f2c65eccff56f0150f800ea3df87c2bd6f42d703d74e1c5fb0aaa

SHA512
5ea9b87735d0450b5493c8683214f6054d5fb8e77ed7a82d75bea39bdee59b3bb5a67512131b7db5e9c78cbabc8ff1b1d2fe6d0971b7b36a85fd8b4ade88c53f

Download Submit
C:\Windows\Temp\{9024956F-3508-407D-B14C-D46B3F5C8A18}\dotnet_runtime_6.0.26_win_x64.msi

Filesize
3.3MB

MD5
79f7f449a5dc3c18d563e8b48f9ffb52

SHA1
939b00d76ac3d8178c0a584ecc13e35e8b3e7e6f

SHA256
395fa5fbe1b37c94ffe93324f5e86d84aa0c702ddb837b42356e1b43705d293e

SHA512
957df783ccdd32fdb596b608424ff0fe197ede2437387fc9c0563b252fb261e51752503639417a1211b709aa80d5eabdfd6f440659bd257f6db66cb2f24f7c63

Download Submit
C:\Windows\Temp\{9024956F-3508-407D-B14C-D46B3F5C8A18}\windowsdesktop_runtime_6.0.26_win_x64.msi

Filesize
3.9MB

MD5
de99927ce59882a79af0059c4b9b4df4

SHA1
240b2247a3be23afd95530ef580dcbbe6817ace2

SHA256
b00abb3b18b0ba4ffa04cca401a100e411ab0523a65906e9cc399af1a337d720

SHA512
ed26392e12d89738c3850c720918ee82d66b76e7952d59ff9a3403405315420faa13c420557a66208f4166d68a6ddc93d4074319642e35ac8ef642da705223a5

Download Submit
C:\Windows\Temp\{FC2D215F-74E2-46AB-9C76-9EAD3924D84A}\.cr\windowsdesktop-runtime-6.0.26-win-x64.exe

Filesize
384KB

MD5
c4075f2f161959824bff9f739add59f8

SHA1
f2da32838b92829ca699a3a0263cbc18df36d21d

SHA256
5be89c3b03ba2612cbe1dd32ccf39cffa84db2bfeaac0bf1959e664350b751e9

SHA512
6a570757b72f176527f7a8ef610ffc0e93c905ab09264114e327aa9e9d866155764bf5ecb6bfa7cbf6ea4bd4ddbc6ae61b7a780d85da6726632c2a371a2118c8

Download Submit
C:\Windows\Temp\{FC2D215F-74E2-46AB-9C76-9EAD3924D84A}\.cr\windowsdesktop-runtime-6.0.26-win-x64.exe

Filesize
559KB

MD5
dc73030f0f7da7d372a72f757c296c78

SHA1
900472a0a5d0ae72685baab8a6e5f1a73456f5d4

SHA256
53457f7ded68874c25d3d1dd2e468308bc9c86a177fc9535e253277ff8d33b3e

SHA512
9b90804a7f52a0b056635c75c5ac69290170c1362bd42f14f179bb509f6ade62d945a8ebea485663e65a5227eb698da67e66cc23c7da815ed859c61816321389

Download Submit
\Program Files\dotnet\dotnet.exe

Filesize
134KB

MD5
202ba3faeb62985736e0ef73673acd9f

SHA1
3fdbcdf5243c12c123592f73ec65f994191fbdfd

SHA256
76a02c39c5b3aace62365f1ab893acfb4451cd82eb04bfb5755d888fe70ceb75

SHA512
24fa302618189214700af9e65253f223b37ba8451eeed7fa00ac8e2a57692eb80617cf77f1a72f6b722f94eaee7259a66076ce953b284ae42e001e1e6dae0ee6

Download Submit
\Windows\Installer\MSI419F.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI461F.tmp

Filesize
105KB

MD5
647e5976cb9359b4b6b03e1276cadd69

SHA1
9ef75701805c0d309979eea9b312547022ecbd03

SHA256
6eb2550400b4e3f4fac7fc50b6dafcd9ef6f0333f2d4dd59175066ed79c815bf

SHA512
6586c385594dfff9e0d084f12dbe4ddc457a94fbefe5e94b444202e4634e43781a76d4ec78cbda3c4b45f1169693176579f7440b0dd89cc083f1ace04c7b84b8

Download Submit
\Windows\Temp\{9024956F-3508-407D-B14C-D46B3F5C8A18}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
\Windows\Temp\{FC2D215F-74E2-46AB-9C76-9EAD3924D84A}\.cr\windowsdesktop-runtime-6.0.26-win-x64.exe

Filesize
610KB

MD5
5bbbb2ba4b75d5e5a9d7652c8751d381

SHA1
738739ded497bbccd5fb2d591cf44da8da875cb9

SHA256
7bb5639fcf35a5c8bac2867fbe6670aa3511367a06e8b094cff7aa13debd4d2f

SHA512
119c69e611ca329439c08695420062fcb8dde03f05c9bc0438da924ca38f99eee9530a0a8ab9cafe760e76ef1654077d019ef9aa13adbc4cf2df60c537b1f4e1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads