Analysis
- max time kernel
261s - max time network
308s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
31/01/2024, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
doomday.msi
Resource
win7-20231215-en
windows7-x64
13 signatures
300 seconds
Behavioral task
behavioral2
Sample
doomday.msi
Resource
win10-20231215-en
windows10-1703-x64
11 signatures
300 seconds
Behavioral task
behavioral3
Sample
doomday.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral4
Sample
doomday.msi
Resource
win11-20231215-en
windows11-21h2-x64
12 signatures
300 seconds
General
- Target doomday.msi
- Size 3.7MB
- Sample240131-tkv5aagah2
- SHA256 ea673e0e6986e41a73c19dd2a9cfde3d2d4186ef52c23c1253dde2d54faca7b3
- MD5 426a59cd5e215e9f3696c1dcc8455d20
- SHA1 255d113da1dc32c3b341e643c01e9f5a13e060de
- SHA512 4b684a97aa6d3b08459b69fb610b6ad5458de56c056f79e91e164cd8914f58ed8734ea4493bbac42c18982a80ffea30d6ba4306ef722bafc49debd4b0f68540a
- SSDEEP 49152:TpUPbczduZ0Yx87nxODZGMFLnd+A1m4wcMO6XOf4BmCk2ZlZ:Tp1BB7nxOtFjfBwpOff4BmCk2Zl
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1524 apdproxy.exe 2512 Autoit3.exe - Loads dropped DLL 6 IoCs
pid Process 912 MsiExec.exe 1524 apdproxy.exe 1524 apdproxy.exe 1524 apdproxy.exe 1524 apdproxy.exe 912 MsiExec.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 1016 ICACLS.EXE 1844 ICACLS.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIEEB5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA6C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA7D.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\e57ecc1.msi msiexec.exe File opened for modification C:\Windows\Installer\e57ecc1.msi msiexec.exe File created C:\Windows\Installer\SourceHash{6D256197-E4CE-4F1D-A41D-04EEE888AB02} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006c2b12180e4adb550000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006c2b12180000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809006c2b1218000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6c2b1218000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006c2b121800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4608 msiexec.exe 4608 msiexec.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 2068 msiexec.exe Token: SeIncreaseQuotaPrivilege 2068 msiexec.exe Token: SeSecurityPrivilege 4608 msiexec.exe Token: SeCreateTokenPrivilege 2068 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2068 msiexec.exe Token: SeLockMemoryPrivilege 2068 msiexec.exe Token: SeIncreaseQuotaPrivilege 2068 msiexec.exe Token: SeMachineAccountPrivilege 2068 msiexec.exe Token: SeTcbPrivilege 2068 msiexec.exe Token: SeSecurityPrivilege 2068 msiexec.exe Token: SeTakeOwnershipPrivilege 2068 msiexec.exe Token: SeLoadDriverPrivilege 2068 msiexec.exe Token: SeSystemProfilePrivilege 2068 msiexec.exe Token: SeSystemtimePrivilege 2068 msiexec.exe Token: SeProfSingleProcessPrivilege 2068 msiexec.exe Token: SeIncBasePriorityPrivilege 2068 msiexec.exe Token: SeCreatePagefilePrivilege 2068 msiexec.exe Token: SeCreatePermanentPrivilege 2068 msiexec.exe Token: SeBackupPrivilege 2068 msiexec.exe Token: SeRestorePrivilege 2068 msiexec.exe Token: SeShutdownPrivilege 2068 msiexec.exe Token: SeDebugPrivilege 2068 msiexec.exe Token: SeAuditPrivilege 2068 msiexec.exe Token: SeSystemEnvironmentPrivilege 2068 msiexec.exe Token: SeChangeNotifyPrivilege 2068 msiexec.exe Token: SeRemoteShutdownPrivilege 2068 msiexec.exe Token: SeUndockPrivilege 2068 msiexec.exe Token: SeSyncAgentPrivilege 2068 msiexec.exe Token: SeEnableDelegationPrivilege 2068 msiexec.exe Token: SeManageVolumePrivilege 2068 msiexec.exe Token: SeImpersonatePrivilege 2068 msiexec.exe Token: SeCreateGlobalPrivilege 2068 msiexec.exe Token: SeBackupPrivilege 2504 vssvc.exe Token: SeRestorePrivilege 2504 vssvc.exe Token: SeAuditPrivilege 2504 vssvc.exe Token: SeBackupPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeBackupPrivilege 4736 srtasks.exe Token: SeRestorePrivilege 4736 srtasks.exe Token: SeSecurityPrivilege 4736 srtasks.exe Token: SeTakeOwnershipPrivilege 4736 srtasks.exe Token: SeBackupPrivilege 4736 srtasks.exe Token: SeRestorePrivilege 4736 srtasks.exe Token: SeSecurityPrivilege 4736 srtasks.exe Token: SeTakeOwnershipPrivilege 4736 srtasks.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2068 msiexec.exe 2068 msiexec.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4608 wrote to memory of 4736 4608 msiexec.exe 98 PID 4608 wrote to memory of 4736 4608 msiexec.exe 98 PID 4608 wrote to memory of 912 4608 msiexec.exe 100 PID 4608 wrote to memory of 912 4608 msiexec.exe 100 PID 4608 wrote to memory of 912 4608 msiexec.exe 100 PID 912 wrote to memory of 1016 912 MsiExec.exe 101 PID 912 wrote to memory of 1016 912 MsiExec.exe 101 PID 912 wrote to memory of 1016 912 MsiExec.exe 101 PID 912 wrote to memory of 2636 912 MsiExec.exe 103 PID 912 wrote to memory of 2636 912 MsiExec.exe 103 PID 912 wrote to memory of 2636 912 MsiExec.exe 103 PID 912 wrote to memory of 1524 912 MsiExec.exe 105 PID 912 wrote to memory of 1524 912 MsiExec.exe 105 PID 912 wrote to memory of 1524 912 MsiExec.exe 105 PID 1524 wrote to memory of 2512 1524 apdproxy.exe 106 PID 1524 wrote to memory of 2512 1524 apdproxy.exe 106 PID 1524 wrote to memory of 2512 1524 apdproxy.exe 106 PID 912 wrote to memory of 1844 912 MsiExec.exe 107 PID 912 wrote to memory of 1844 912 MsiExec.exe 107 PID 912 wrote to memory of 1844 912 MsiExec.exe 107 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\doomday.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2068
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 81B9A21E33ED3100451C1AD7894B4F5A2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:1016
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\files\apdproxy.exe"C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\files\apdproxy.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\temp\Autoit3.exe"c:\temp\Autoit3.exe" c:\temp\script.au34⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2512
-
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:1844
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\files.cab
- Size 3.4MB
- SHA256 b860f09732fad08ddb048b0322bc5df1a61fe7859dd91f6ca769a972bac4f5f3
- MD5 2bff42a75bcda5b313b7b91261c9d85f
- SHA1 de1be1be23a3c1d6b410c6af154d19e1e15da388
- SHA512 1056f0b1e68b4030d916cdff8fe2c1b20110fa05db6457aff6b10b93ff27c7f16eb8506469746fc19e67556ed21af094afdbaba5f1ee56f5c4c2c74a96e4bdaa
- SSDEEP 49152:ZczduZ0Yx87nxODZGMFLnd+A1m4wcMO6XOf4BmCk2ZlZU:2BB7nxOtFjfBwpOff4BmCk2Zlu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\files\MSVCP71.dll
- Size 488KB
- SHA256 df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
- MD5 561fa2abb31dfa8fab762145f81667c2
- SHA1 c8ccb04eedac821a13fae314a2435192860c72b8
- SHA512 7d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
- SSDEEP 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\files\MSVCR71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\files\apdboot.dll
- Size 931KB
- SHA256 51d197826bb62d23d4d926c914409ea8c66de149418cdd43137ddf1cafffe347
- MD5 884e21631c0b78aea630fbe540d84778
- SHA1 a9f4eea988debc35d0aa60efbdee6708c2cc1655
- SHA512 2ab6994e822f6174f10264c70d02857a8eb47ddc9f10b414f2e314d5f5d996bd50886a47f58eafffec6f8b823b6d14715320a9f6e332934801182d57e298b714
- SSDEEP 12288:8CwXI/iPKmldxkIR+BCm8LJJKx2jKuIHTMWiXZU:5wMmlPd1LJwx2jK9oZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\files\apdproxy.exe
- Size 62KB
- SHA256 a16b93c374e77f98889d7ad7f38b2282dbc5a40511541b9105b1dcf9216c3cf3
- MD5 fc9e59fe8bc4fe05382cff5c8fc59de1
- SHA1 69423bc900644a910936d2c5828348d188e5d750
- SHA512 1d34be70cd701b606873aaf6910ab7fa7a3c4a81e0398d9bdcf8e8aac3dd63ec888c478e45600bf7e34301bec231038e8dccb457e49db8b5ff1c0740b68d072c
- SSDEEP 768:oSGP0wWfldXbYnoHbzrzHKSi90hHVKIYl2PN+iTre/S/Mqnzh9SLiB+L8rhOFPC1:oSGPGSwPPH9Kq0qzXrElX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\files\sqlite3.dll
- Size 1.6MB
- SHA256 b6c0d1c8dfb907ce2d5bc7e493cfb1c5e1940f200475327dded1d3390c1d5c96
- MD5 13914f35fce12f03d0a3f3eda68b1b8e
- SHA1 5490e690e87d944bf5186d13e5f3a5a23d0c350f
- SHA512 ac06235fd132b36a80979f34aab4b382de3e33f0d91cdc8a94c9da09e7fbd65c13ae52dcf191671e46d9f390e62471a2c509fee81c666f4904e4a2e231e4d0ce
- SSDEEP 24576:sA+tZvFgx79B0s7OPkLZWoPxOz4J6BjC4y5oQAnTuXWfQwiN:sHFm3Gs7OPkUc6BjClynny5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\msiwrapper.ini
- Size 1KB
- SHA256 585dcb2805290c814af8763f8a685489e478544e06cb0e5c33ea73cd00e09e3f
- MD5 2f9c63fbc885d6fbd033a2d3d913053e
- SHA1 ce864dcbcc5c0623f8bb93a60a19005a8a971c2a
- SHA512 c26561d0d0f68e8f98b6423e0060eaa37193171b8345a037c359a780261c14a006d884d5b495d9f36760d5e250bafcaa6f840d70d1b1065f1561b752ceca7831
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\msiwrapper.ini
- Size 1KB
- SHA256 037e587950e16558b34163e9a492b8b405e5df342c4fed65559a377915304402
- MD5 b5e86bb16590cd8769b9c93265b311e0
- SHA1 dff62222662f3ae48364a11e9fc28dea304d74f8
- SHA512 a4f7d528f3c1cd0e2f839ca42a6875dd10ae16e70a8df412d1f3038d89528190e283ea6d1733cf8b6876f1fb3020ccafe815ebe6225e0a33d1acbba0542bfd71
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MW-3dfd69dd-8dcb-4534-b600-32c37c200003\msiwrapper.ini
- Size 1KB
- SHA256 26cee9c26c9fbc590259959ba2b0ff4e81e8017d1f8ce7702cd95fc5520dd34e
- MD5 1267946e537897fe848a5716cb0f631d
- SHA1 8b644fa56fce049fe037ded11721580e9c236b5f
- SHA512 8c68f4af838fdc709110b2985b2a0bc5ab5804fadfb7066bf2ee4540db008747695159ab57f02df2e5f3024e66aa8baf3eccd62921d46eef684d451360f95636
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSIEEB5.tmp
- Size 208KB
- SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
- MD5 d82b3fb861129c5d71f0cd2874f97216
- SHA1 f3fe341d79224126e950d2691d574d147102b18d
- SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
- SSDEEP 3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\temp\Autoit3.exe
- Size 872KB
- SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- MD5 c56b5f0201a3b3de53e561fe76912bfd
- SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.0MB
- SHA256 42d5a50aecc4c2046bd3c019c9c883e6e89eea35cde185c880adc3cde6fb7985
- MD5 adeea0b47ffb0e06135deb9eb7d9032d
- SHA1 666df0011f56c2c0d0b316e84a8dde675fa699ef
- SHA512 ad620e8eca54ebbec03760547e3b8717ae7a0c89c638f235e2ed60d009fd52cd15a6b801a78ba0ae88d93a16c1f826bced8a8a5e151434a84e96460c046876c8
- SSDEEP 24576:ijdmqn+NdoO/vvTLlCWOBlL75RZC2mNzNRg9kp7Qydqr+3u24zmEk/FsL:H
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{18122b6c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ea80b65b-e3fe-4849-bdf6-70873fdbd5a8}_OnDiskSnapshotProp
- Size 6KB
- SHA256 89163bc079fab618bf8e2f473f9585bba9314b7aa43bb38fbf519df49382e664
- MD5 00275551aacfda1b2724d9871dca6117
- SHA1 7c96f58e8d3b7d39e1c578f58338a72099604fb5
- SHA512 2adaafd2d157d0df86fcb64939b030947bd5c0a6283831b304553339f8bcd9fb2f31a5aa886b4cdb39142296991c4536758049982733b4f29e5d6c7e0f19b0da
- SSDEEP 96:FZ5MZ9tYFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQEJ:ziib++sVe
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\temp\script.au3
- Size 595KB
- SHA256 64e1563ceef99893a1fe4ba93cd38763a68f2db5537545a08061e83af9fe299b
- MD5 07b5686c91ff17a1d86271601f9904b0
- SHA1 99fd675e912909af895a917c950e5ecc37b67869
- SHA512 321e27bb1cb5c020b4979c6dce687fb734cf24a8a6e420850019d087e61ec902dbb97e7ed164c9b7fbd7f8996eaf6c4e0bb65775355e8a7075b239424dd780c6
- SSDEEP 12288:IuLJxe9FfjUh4y5AQa7SgpzS8WwrJwVKXDcV8HL7lOWaPi9Qnwi8:DJ6BjC4y5oQAnTuXWfQwi8
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\temp\test.txt
- Size 76B
- SHA256 99426e8b0d9b6366436d7db6883c98d6a8c2e5825b13a167a0c7495494182276
- MD5 4b1e3cb8c33b582a74656ec001aaaf7a
- SHA1 576cfd0d0538ca5ab90183139473895c3b8440ba
- SHA512 b7899e2236be8702f2852233f37cb98732e2f1ac97b909d0fdce216721d02337b4b3f5045464e2d13ac9c7e2320f56c574f7654aa348e96cba5932d1f7edba4f
- MD5 SHA1 SHA512