dcrat | d9e82b2bbf5ef1628749c4703f5d38d74b83994cdee1712f5429af889f7c1bfb

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6399303ceaa23310986ca0f5f6444df.exe
Size 246KB
Sample240205-lycabsdag5
SHA256 d9e82b2bbf5ef1628749c4703f5d38d74b83994cdee1712f5429af889f7c1bfb
MD5 e6399303ceaa23310986ca0f5f6444df
SHA1 129b77939bbf5f50cb2f5f4248dd9f4416c15143
SHA512 8d963c6c20df166b5e1326b7c8ee30f1cbb1073500a21fb080e594be9462e733d2795c54affd9be558a5e37489b81ba9fcd910320ba96d6443aef594784ba8ae
SSDEEP 3072:VD5vK2O4jqKgfZ0njX1CvEuN9qQjH5nKfMdptyD6P0s4iNc:Vlv9O0jXhurjZKfMQ1s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat glupteba smokeloader pub1 backdoor bootkit discovery dropper evasion infostealer loader persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2022

http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
http://sjyey.com/tmp/index.php
http://babonwo.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/memory/5116-200-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1368	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
3452	Process not Found

Executes dropped EXE 19 IoCs

pid	Process
1688	A112.exe
3936	C99B.exe
648	D796.exe
180	D796.exe
1260	DE9C.exe
2920	DE9C.tmp
4844	vbsmartcardviewer.exe
4052	vbsmartcardviewer.exe
1764	WerFault.exe
5116	288c47bbc1871b439df19ff4df68f076.exe
5108	InstallSetup4.exe
912	explorer.exe
1228	BroomSetup.exe
1404	13C8.exe
4980	nso1B36.tmp
4568	288c47bbc1871b439df19ff4df68f076.exe
1792	vueqjgslwynd.exe
2024	csrss.exe
1324	vueqjgslwynd.exe

Loads dropped DLL 10 IoCs

pid	Process
1088	regsvr32.exe
180	D796.exe
2920	DE9C.tmp
2920	DE9C.tmp
2920	DE9C.tmp
5108	InstallSetup4.exe
5108	InstallSetup4.exe
4980	nso1B36.tmp
4980	nso1B36.tmp
5108	InstallSetup4.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/180-46-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/180-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/180-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/180-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/180-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/files/0x0003000000000719-792.dat	upx
behavioral2/files/0x0003000000000719-791.dat	upx
behavioral2/files/0x0003000000000719-795.dat	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	D796.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	A112.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	vueqjgslwynd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	explorer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 180	648	D796.exe	96
PID 1792 set thread context of 2504	1792	vueqjgslwynd.exe	148
PID 1792 set thread context of 2964	1792	vueqjgslwynd.exe	238

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	288c47bbc1871b439df19ff4df68f076.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	288c47bbc1871b439df19ff4df68f076.exe
File created	C:\Windows\rss\csrss.exe	288c47bbc1871b439df19ff4df68f076.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3420	sc.exe
3888	sc.exe
3024	sc.exe
4320	sc.exe
1248	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 32 IoCs

pid	pid_target	Process	procid_target
1968	3936	WerFault.exe	94
4824	5116	WerFault.exe	105
404	4980	WerFault.exe	112
3196	5008	WerFault.exe	182
564	5008	WerFault.exe	182
4904	5008	WerFault.exe	182
1084	5008	WerFault.exe	182
1984	5008	WerFault.exe	182
4396	5008	WerFault.exe	182
2428	5008	WerFault.exe	182
2924	5008	WerFault.exe	182
2944	5008	WerFault.exe	182
556	5008	WerFault.exe	182
2512	4960	WerFault.exe	203
4068	4960	WerFault.exe	203
4968	4960	WerFault.exe	203
468	4960	WerFault.exe	203
2632	4960	WerFault.exe	203
1264	4960	WerFault.exe	203
4012	4960	WerFault.exe	203
944	4960	WerFault.exe	203
4476	4960	WerFault.exe	203
1212	4960	WerFault.exe	203
4820	4960	WerFault.exe	203
2400	4960	WerFault.exe	203
3416	4960	WerFault.exe	203
3564	4960	WerFault.exe	203
2948	4960	WerFault.exe	203
1984	4960	WerFault.exe	203
2600	4960	WerFault.exe	203
1764	4960	WerFault.exe	203
4940	1084	WerFault.exe	236

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e6399303ceaa23310986ca0f5f6444df.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e6399303ceaa23310986ca0f5f6444df.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e6399303ceaa23310986ca0f5f6444df.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	13C8.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	13C8.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	13C8.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nso1B36.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nso1B36.tmp

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4500	schtasks.exe
2012	schtasks.exe
3096	schtasks.exe
3488	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WerFault.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WerFault.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3124	e6399303ceaa23310986ca0f5f6444df.exe
3124	e6399303ceaa23310986ca0f5f6444df.exe
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found
3452	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3124	e6399303ceaa23310986ca0f5f6444df.exe
1404	13C8.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeDebugPrivilege	5116	288c47bbc1871b439df19ff4df68f076.exe
Token: SeImpersonatePrivilege	5116	288c47bbc1871b439df19ff4df68f076.exe
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	504	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeLockMemoryPrivilege	2964	WerFault.exe
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeDebugPrivilege	3432	rundll32.exe
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeShutdownPrivilege	3452	Process not Found
Token: SeCreatePagefilePrivilege	3452	Process not Found
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2920	DE9C.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1228	BroomSetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1688	3452	Process not Found	90
PID 3452 wrote to memory of 1688	3452	Process not Found	90
PID 3452 wrote to memory of 1688	3452	Process not Found	90
PID 3452 wrote to memory of 1244	3452	Process not Found	92
PID 3452 wrote to memory of 1244	3452	Process not Found	92
PID 1244 wrote to memory of 1088	1244	regsvr32.exe	91
PID 1244 wrote to memory of 1088	1244	regsvr32.exe	91
PID 1244 wrote to memory of 1088	1244	regsvr32.exe	91
PID 3452 wrote to memory of 3936	3452	Process not Found	94
PID 3452 wrote to memory of 3936	3452	Process not Found	94
PID 3452 wrote to memory of 3936	3452	Process not Found	94
PID 3452 wrote to memory of 648	3452	Process not Found	95
PID 3452 wrote to memory of 648	3452	Process not Found	95
PID 3452 wrote to memory of 648	3452	Process not Found	95
PID 648 wrote to memory of 180	648	D796.exe	96
PID 648 wrote to memory of 180	648	D796.exe	96
PID 648 wrote to memory of 180	648	D796.exe	96
PID 648 wrote to memory of 180	648	D796.exe	96
PID 648 wrote to memory of 180	648	D796.exe	96
PID 648 wrote to memory of 180	648	D796.exe	96
PID 648 wrote to memory of 180	648	D796.exe	96
PID 648 wrote to memory of 180	648	D796.exe	96
PID 3452 wrote to memory of 1260	3452	Process not Found	97
PID 3452 wrote to memory of 1260	3452	Process not Found	97
PID 3452 wrote to memory of 1260	3452	Process not Found	97
PID 1260 wrote to memory of 2920	1260	DE9C.exe	98
PID 1260 wrote to memory of 2920	1260	DE9C.exe	98
PID 1260 wrote to memory of 2920	1260	DE9C.exe	98
PID 2920 wrote to memory of 4844	2920	DE9C.tmp	99
PID 2920 wrote to memory of 4844	2920	DE9C.tmp	99
PID 2920 wrote to memory of 4844	2920	DE9C.tmp	99
PID 2920 wrote to memory of 4052	2920	DE9C.tmp	100
PID 2920 wrote to memory of 4052	2920	DE9C.tmp	100
PID 2920 wrote to memory of 4052	2920	DE9C.tmp	100
PID 3452 wrote to memory of 1764	3452	Process not Found	241
PID 3452 wrote to memory of 1764	3452	Process not Found	241
PID 3452 wrote to memory of 1764	3452	Process not Found	241
PID 1764 wrote to memory of 5116	1764	WerFault.exe	105
PID 1764 wrote to memory of 5116	1764	WerFault.exe	105
PID 1764 wrote to memory of 5116	1764	WerFault.exe	105
PID 1764 wrote to memory of 5108	1764	WerFault.exe	106
PID 1764 wrote to memory of 5108	1764	WerFault.exe	106
PID 1764 wrote to memory of 5108	1764	WerFault.exe	106
PID 1764 wrote to memory of 912	1764	WerFault.exe	170
PID 1764 wrote to memory of 912	1764	WerFault.exe	170
PID 5108 wrote to memory of 1228	5108	InstallSetup4.exe	108
PID 5108 wrote to memory of 1228	5108	InstallSetup4.exe	108
PID 5108 wrote to memory of 1228	5108	InstallSetup4.exe	108
PID 3452 wrote to memory of 1404	3452	Process not Found	109
PID 3452 wrote to memory of 1404	3452	Process not Found	109
PID 3452 wrote to memory of 1404	3452	Process not Found	109
PID 1228 wrote to memory of 4376	1228	BroomSetup.exe	110
PID 1228 wrote to memory of 4376	1228	BroomSetup.exe	110
PID 1228 wrote to memory of 4376	1228	BroomSetup.exe	110
PID 5108 wrote to memory of 4980	5108	InstallSetup4.exe	112
PID 5108 wrote to memory of 4980	5108	InstallSetup4.exe	112
PID 5108 wrote to memory of 4980	5108	InstallSetup4.exe	112
PID 4376 wrote to memory of 1128	4376	cmd.exe	113
PID 4376 wrote to memory of 1128	4376	cmd.exe	113
PID 4376 wrote to memory of 1128	4376	cmd.exe	113
PID 4376 wrote to memory of 4500	4376	cmd.exe	114
PID 4376 wrote to memory of 4500	4376	cmd.exe	114
PID 4376 wrote to memory of 4500	4376	cmd.exe	114
PID 5116 wrote to memory of 3644	5116	288c47bbc1871b439df19ff4df68f076.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e6399303ceaa23310986ca0f5f6444df.exe
"C:\Users\Admin\AppData\Local\Temp\e6399303ceaa23310986ca0f5f6444df.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3124

C:\Users\Admin\AppData\Local\Temp\A112.exe
C:\Users\Admin\AppData\Local\Temp\A112.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1688

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\AB25.dll
1⤵
- Loads dropped DLL
PID:1088

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AB25.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\C99B.exe
C:\Users\Admin\AppData\Local\Temp\C99B.exe
1⤵
- Executes dropped EXE
PID:3936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 1012
  2⤵
  - Program crash
  PID:1968

C:\Users\Admin\AppData\Local\Temp\D796.exe
C:\Users\Admin\AppData\Local\Temp\D796.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648
- C:\Users\Admin\AppData\Local\Temp\D796.exe
  C:\Users\Admin\AppData\Local\Temp\D796.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  PID:180

C:\Users\Admin\AppData\Local\Temp\DE9C.exe
C:\Users\Admin\AppData\Local\Temp\DE9C.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\is-QKD6N.tmp\DE9C.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QKD6N.tmp\DE9C.tmp" /SL5="$170042,7414031,54272,C:\Users\Admin\AppData\Local\Temp\DE9C.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
    "C:\Users\Admin\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4844
- - C:\Users\Admin\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
    "C:\Users\Admin\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe" -s
    3⤵
    - Executes dropped EXE
    PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3936 -ip 3936
1⤵
PID:4184

C:\Users\Admin\AppData\Local\Temp\33C.exe
C:\Users\Admin\AppData\Local\Temp\33C.exe
1⤵
PID:1764
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 780
    3⤵
    - Program crash
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:4568
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:3852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:3100
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:2076
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      PID:2024
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:3432
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
        6⤵
        
        PID:1264
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:948
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:2992
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:2012
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        
        PID:1716
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:3096
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        
        PID:4932
- C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4376
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:1128
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:4500
- - C:\Users\Admin\AppData\Local\Temp\nso1B36.tmp
    C:\Users\Admin\AppData\Local\Temp\nso1B36.tmp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:4980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 2252
      4⤵
      Program crash
      PID:404
- C:\Users\Admin\AppData\Local\Temp\FourthX.exe
  "C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
  2⤵
  PID:912
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:504
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "UTIXDCVF"
    3⤵
    - Launches sc.exe
    PID:3024
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "UTIXDCVF"
    3⤵
    - Launches sc.exe
    PID:4320
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1248
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2212

C:\Users\Admin\AppData\Local\Temp\13C8.exe
C:\Users\Admin\AppData\Local\Temp\13C8.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5116 -ip 5116
1⤵
PID:3960

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:1368

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:4604

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:1792
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:2964
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- - C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
    "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe"
    3⤵
    - Executes dropped EXE
    PID:1324
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4928
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:3396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:4212
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4980 -ip 4980
1⤵
PID:4028

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:216

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
1⤵
PID:4476
- C:\Windows\SysWOW64\sc.exe
  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
  2⤵
  - Launches sc.exe
  PID:3888

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2088

C:\Users\Admin\AppData\Local\Temp\E438.exe
C:\Users\Admin\AppData\Local\Temp\E438.exe
1⤵
PID:5008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 584
  2⤵
  - Program crash
  PID:3196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 664
  2⤵
  - Program crash
  PID:564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 744
  2⤵
  - Program crash
  PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 848
  2⤵
  - Program crash
  PID:1084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 876
  2⤵
  - Program crash
  PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 876
  2⤵
  - Program crash
  PID:4396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 1108
  2⤵
  - Program crash
  PID:2428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 1108
  2⤵
  - Program crash
  PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 1212
  2⤵
  - Program crash
  PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 1304
  2⤵
  - Program crash
  PID:556
- C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 252
    3⤵
    - Program crash
    PID:2512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 760
    3⤵
    - Program crash
    PID:4068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 936
    3⤵
    - Program crash
    PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 944
    3⤵
    - Program crash
    PID:468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 760
    3⤵
    - Program crash
    PID:2632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 936
    3⤵
    - Program crash
    PID:1264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1020
    3⤵
    - Program crash
    PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 924
    3⤵
    - Program crash
    PID:944
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:3488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 688
    3⤵
    - Program crash
    PID:4476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 800
    3⤵
    - Program crash
    PID:1212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 920
    3⤵
    - Program crash
    PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 684
    3⤵
    - Program crash
    PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1204
    3⤵
    - Program crash
    PID:3416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1236
    3⤵
    - Program crash
    PID:3564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1380
    3⤵
    - Program crash
    PID:2948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1252
    3⤵
    - Program crash
    PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1552
    3⤵
    - Program crash
    PID:2600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1684
    3⤵
    - Executes dropped EXE
    - Program crash
    - Suspicious use of WriteProcessMemory
    PID:1764
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    PID:2736
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      PID:4044
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    PID:3888
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5008 -ip 5008
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5008 -ip 5008
1⤵
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5008 -ip 5008
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5008 -ip 5008
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5008 -ip 5008
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5008 -ip 5008
1⤵
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5008 -ip 5008
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5008 -ip 5008
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5008 -ip 5008
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5008 -ip 5008
1⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4960 -ip 4960
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4960 -ip 4960
1⤵
PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4960 -ip 4960
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4960 -ip 4960
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4960 -ip 4960
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4960 -ip 4960
1⤵
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4960 -ip 4960
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4960 -ip 4960
1⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4960 -ip 4960
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4960 -ip 4960
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4960 -ip 4960
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4960 -ip 4960
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4960 -ip 4960
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4960 -ip 4960
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4960 -ip 4960
1⤵
PID:500

C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
1⤵
PID:1084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 436
  2⤵
  - Program crash
  PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4960 -ip 4960
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4960 -ip 4960
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4960 -ip 4960
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1084 -ip 1084
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ObjectSerialization65.exe

Path C:\ProgramData\ObjectSerialization65\ObjectSerialization65.exe
Size 128KB
SHA256 8279a465f6b0e60da213b2505dac9c45379e8de788eb1da495ad45c67733f770
MD5 d5f903b4e25862717e19161bc703167c
SHA1 04faf1c4c2c352e904943aa7e27dfe0c90601f4d
SHA512 b0ed73817667dd72fb3cb779ae490c15371cd2c068242c1be1469292c4554e76fb647f01960fcc298d1f3192e6e943265f2cec01d9205bd607c83cc354300a59
SSDEEP 1536:P4uKFWPqiH2HLVLCMwGRTAILf3RqWQJ+Fm5ko2hsHS29Hv7E9ZlvKFWPqiH2HLV6:PyMpH2x0GPLfdQkkkk1UkMpH2x0GPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 97KB
SHA256 45746b5c2a2c50cdae75c11effcaacbdee3be2d23b9a9f25c7e3f5f10f1048f6
MD5 bdefdbe74e8512e79711be4df5ed61f5
SHA1 5a24542ce261730d7680b4664990b791b7ed9d34
SHA512 2c8566f06e2f23079a791e05d2c4aa05ddd2a21d049e57bb46f4dd51530ffa8f36cdd34e6ec5218bebc5a916ee1508a5bc6476b7a531154167135a789899f77a
SSDEEP 1536:LuB48tCHiONDnVjq5Ux4yAoxdruPgaQ/Y9BZE2G7gttR6G:LuWBi+DnlSyAob6PgaQ/YGc9X
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 95KB
SHA256 e055776fce9e8a81e22d53486b70b2d63666eadff29caedffe5df97ec66165f3
MD5 95bf5ef7fe66a7c5ed1785919c12bed7
SHA1 64999e0bfdd2b2757136702d23efc1a2b911b379
SHA512 c2527a7a063fbfa6022471a91d6b65e079988e168bb92249c38098433f3c2b8a0dceee4cc27878f01cd3f76f623a97cab739bf844c94e8db359f4c9ebe55a038
SSDEEP 1536:LuB48tCHiONDnVjq5Ux4yAoxdruPgaQ/Y9BZE2G7gttR+:LuWBi+DnlSyAob6PgaQ/YGc9+
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 233KB
SHA256 97c3df106376acc479923c77ed5b07ef670aa1168704178ab5e6c215f4d862de
MD5 0a197a8ed355e164af78cad037c76e67
SHA1 6b5e7a0a44a6eb1ffbcfa6603bc430cb0c5151d9
SHA512 b4d4a34c3d0d743fad0d55a578c118cdc20acfa694f93c96d79f6514f36caee9e66dca8708d7d61af59214417f4b911f48bc4f9432a83d755a6717a3c1e5a241
SSDEEP 6144:fiDKomgtwJBH/1aXl1SyTF+HsWnKGxJHWqIB+Xi5feNIvxEmnFjP7rcCMLQc7YBW:fEKomgtwf1WlgyTkHsWnKGxJHxIB+XiU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vueqjgslwynd.exe

Path C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
Size 122KB
SHA256 766c048551754c16342329094bd9cc24f0983384bdebb0c21fea2aa220c23200
MD5 e955e609d459705c244682e5d0d8dd54
SHA1 cd70c0a7963e88eda3202efb7b73a73aec202da7
SHA512 2a05b51eeb8322c9c08693fcf55be13bd4e291ecca239e5c501e7b82cb49de6017f3fdac404a0cd9329f7520431c217fb3428ba078f8df328fc72071c8431637
SSDEEP 3072:PRQFRiNIGc3+EVSDDly1itCodnIW4EGTnDZgJwpLM:ixdjVo5KiLZIW7GTnKc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

vueqjgslwynd.exe

Path C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
Size 72KB
SHA256 8ccf5c26298fa30d249ace2e8dc7206a012919389a981f19ae731a40ffb205e7
MD5 aac431558a209b0ac7b21df560aa4a3c
SHA1 de44d5bb1f87c19f54637d170e5d5d6424b52dd9
SHA512 e75c9e0a88efa7bdf444543705c5fb36f4b3dc62a25c9322cfa2499e968bba8723d83c7b4a2c1d14e99008a481dee525732d94731098d0fb83c5059b21d0d526
SSDEEP 1536:o9aHiKQFR3SbNqlGcuk+GL8wS6KrnliH1itC7whdKaVX:PRQFRiNIGc3+EVSDDly1itCodz
MD5 SHA1 SHA512 SSDEEP

Submit Download

13C8.exe

Path C:\Users\Admin\AppData\Local\Temp\13C8.exe
Size 1KB
SHA256 cd3c387c0e7d6a520c7dd9203b32ed457ac1d8e873efbc12d284aba950031f39
MD5 56eb4b687a3a8c1c4c64b5087672bbef
SHA1 5c50408f9d5671cb9f2649acdd2c6c6f6854e206
SHA512 09c5ed49bc79ec0227c01b3ffed49059d97a8302f92db65192df61221e9480b395eeb9d3cf895f54a4f1b5f95d6178011a79f07374c630ec6b3488c4e91a6a87
MD5 SHA1 SHA512

Submit Download

13C8.exe

Path C:\Users\Admin\AppData\Local\Temp\13C8.exe
Size 64KB
SHA256 f119b197b128691658bb17cf355ec310c24be666cf7c35170923bff4a48b3b30
MD5 0a16ec30ecb5513fe2670052f30b53cf
SHA1 1bc6c1cbd55d0e16515976f66e24ee214ef78877
SHA512 161379ec3540dbf8f63e4c392c3a6be4bc02c636972f36f0638a447d2b523647452c463934a70337fef71473942ed5ea412101fc18c3449888e7be0b554e5a87
SSDEEP 1536:2O6buno82dYL1fuQEqLRlM98wvH40/PqaF2+IR+W5D:2HwbL5fLgCxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 145KB
SHA256 d49cc8664c750470987e4af0190c3463a43c845762601dda58ebe20376c7b7bb
MD5 3d7b97f012a8e1786479e89f91b0b6f0
SHA1 fe54f5f7046e4364b5436dc608f7a85cac62d7cb
SHA512 1472a31377a962787a7a7d49c51e7ce89a842cb85f33eee5027b4603c53127f3f073272ca85e638bd80999abf5a72765a95df183368d91b5d8029d75228f5ea9
SSDEEP 3072:zxMBuLFrul3FqE3Yan6/9lJKZZBQoldInqfAzk5/cf3lT:OBuL01qE3YanazKZcolQqfAzu/c/lT
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 97KB
SHA256 fb1b0e532dd3f7d2fe177c6ee18824a58ba414835c34afa99cb748178649427d
MD5 0d06698fc82077b0b65bef6477152dea
SHA1 a7b22e75a71f2a878ddb8e1eb0713d80a1d338cd
SHA512 c45115c35dfcb22c6a5aa1bad55a6fe05453ed9562a01b5a9689cb47f669514553e4d44e5297899889d82e6dd85aa574eb1786df9208d02bb40a226718a98b04
SSDEEP 1536:WqxmuaDzlNLoLqSrdqy0sanG2bM0FPfsQ+Ns98YWIYwEkEi6EuVVPlZ/qusrof0z:zxMBuLFrul3FqE3Yan6/9lJKZZx
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 64KB
SHA256 5a9961e3aabb2e3d9deae01b6c59e4f1e71c39f31ace24b16f03bd3d3f845d44
MD5 9a765672cd84029902f6a88a1a43e7e0
SHA1 888e321acd0ec723c16e2d0eadadb059c875afe2
SHA512 1462134e714d2523d72e676c9025cf8ebe11bcab6fdee6e6f9ddb398664d24930d1d30bf65d69c510e223f55d0017844b9f98ca9ef543db3049db5c464c12432
SSDEEP 1536:WqxmuaDzlNLoLqSrdqy0sanG2bM0FPfsQ+Ns98YWIYE:zxMBuLFrul3FqE3YE
MD5 SHA1 SHA512 SSDEEP

Submit Download

33C.exe

Path C:\Users\Admin\AppData\Local\Temp\33C.exe
Size 93KB
SHA256 143dcafb817ca4f7ee662f85f3dc96300b483967b774c0d2bef27e585b7dbc97
MD5 bf97312717c37363b59657a5e9009562
SHA1 009fe1e7a8a7dfb5ea8f809fa31a6418cd985ae9
SHA512 4b9e627545f5d8c43ec4eeb383e22cf4b7951b6e560fedba5143e3126aa20529f532ada70254298a0572f674bf8e8d659b7ef75573311ed58fbfffa05236985d
SSDEEP 1536:+blp6xmZ/dDRIqhoCdamVbc63aQWjgD9u8rMOj43eCwi7jy9tciThGXTGk8Dztz9:+v+mZFDwCdawcifWCg8rMOj4uX31GDSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

33C.exe

Path C:\Users\Admin\AppData\Local\Temp\33C.exe
Size 92KB
SHA256 868b824309afbfcec2af4a1262724fd272ad09ec3df7fec42257c0986c0dd84e
MD5 59b1916817cafd111b1964430d95b9e6
SHA1 e703c8d5c3df430dd538933fc2ff5eb5912df2f6
SHA512 9592a658167e7105857b8e92917d9eb51c059a27795707e1e190f20651181d5fd212897f96c0b6dc350763c0a62f681c3d4b4d68e92382b7a08ae76a3f3c5733
SSDEEP 1536:+blp6xmZ/dDRIqhoCdamVbc63aQWjgD9u8rMOj43eCwi7jy9tciThGXTGk8DztzR:+v+mZFDwCdawcifWCg8rMOj4uX31GDSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Size 55KB
SHA256 de195442e2f9af51ba57ad84af77f89e41e6498388bd4a606279c640ea33721c
MD5 7115373ad1c0c9eb3f3336b4d488d1ab
SHA1 58b9ad3afd9721109ec74600c86fb89a4c215d44
SHA512 0ee38f390e345e9fb79b40ca077f8aa1bc787e04afd1aedd8a0efc7ae3993a83a294496dcae11a96df36fb32e3d6c418046a031ed130a0394afd37bfd0815621
SSDEEP 1536:c9XyPetbF9pnlKjBREftL8lNQsTJofjMoIUZZEqQ:c9iPQTBkjBREFL8lWsTCfjMoIUjEqQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Size 71KB
SHA256 addbf7fbca444fb2295b3d0d1dd8066e2c06b56c7f8d81bb97b6430e7aac290f
MD5 34183accd8723d36b9fc0739389bdc45
SHA1 90fc77910e9f3561fe639ab76369851df3d301ce
SHA512 c388ef61f13af1728661b6c448600e74ece28d7faf9e58b6d9e2293db446f67f80e3b5658b078741588102fc3ba45809c9e499da7e3eae426636d9192a0e3ef6
SSDEEP 1536:UNJVztt7T/7cfVLdPtYuFfQKVAbAvaf6ov5Grb5NJVztt7T/u:UNqtuuBy4N6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utsysc.exe

Path C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
Size 173KB
SHA256 3ca1e00eef3c6eebdbf971d0a9a65355ab7acdc71799e0c10134984232ea3f1e
MD5 0e3c6f4a7d4666068c104267c192db4a
SHA1 f7d3c21b3a727f82a10d8d18cddd994671ed991b
SHA512 5854d3ea962d3ed70ecc6fa487e31758924ad6ebde33453565cb686df8e62a4699003aa4750a35ec4dd28f87d586ab44b91978da2042df01081aa9a984497828
SSDEEP 3072:K1WeLNhvk6+iCwn5eTnQqqpAPdE9c41ifzGJobpEOCoeJYle:KkeLNheifnonQ2dmeGJ+zrUYle
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utsysc.exe

Path C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
Size 103KB
SHA256 7d0b5bb2277c6505d8532c303d51fde0ff10f1b0e3a930e756717db6b4f1f1c2
MD5 6a3e6003d3a58dc6ef2fc6168b7faf54
SHA1 fb5a8ead9343c67fc9201028555dc3c671923735
SHA512 1a4b981041731c0c782fe653578ddf7be42aa56884b50dda979e947009d5c205f6c0cf72312cd2bb7d17a06b34da80287e25367954feb97972852e26d0cf28c2
SSDEEP 1536:K1kwr3+0tsAHLNh5IXik1WXvrSRPqa7T2qFW5kTUZ55GHvLUB0jfP04D4C:K1WeLNhvk6+iCwn5eTnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utsysc.exe

Path C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
Size 176KB
SHA256 431e0f5476eeabd0ba9e06ea34b9893a507a4762c0e03f184f7aa65859d0e82c
MD5 17861713b1c1eb363bc867dead1b3c18
SHA1 3a0f278eeadda36801706e8e234e6bf865ff3def
SHA512 57be569aad32fc7cebf8842514446708b141d89407a181ebaf90f9979dd3bdae31eb25beef6eea4336561520f3834bfe793bbd1248d57fc1a13cf6fbe277cbe3
SSDEEP 3072:K1WeLNhvk6+iCwn5eTnQqqpAPdE9c41ifzGJobpEOCoeJYl4:KkeLNheifnonQ2dmeGJ+zrUYl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

803511929133

Path C:\Users\Admin\AppData\Local\Temp\803511929133
Size 83KB
SHA256 88e36aae0f45ced1915332939a7c9e798b63738ea133c6136e41a8ad393e7e0d
MD5 b3654fd73ac38adf1c3d70d8d48fabf6
SHA1 f502457523b8158e3888d0a44118e17c3a78129f
SHA512 fc3bc91aaf6e71f439396c8996ead11a9d38a1e0931dab1b4b6731ce32a91819ba69809b5d7816119582f7c0234dd3f67288a71b01867ec4ee4f8be4b0089e60
SSDEEP 1536:sXjFaMZOn4dauuuuuuuuuuu9X9zxqJIh3YZsYuWOmhuF1++a++/++hPpe7XSCYsV:ea3nFuuuuuuuuuuu9qc8uWOmhI++a++i
MD5 SHA1 SHA512 SSDEEP

Submit Download

A112.exe

Path C:\Users\Admin\AppData\Local\Temp\A112.exe
Size 421KB
SHA256 e40c8e14e8cb8a0667026a35e6e281c7a8a02bdf7bc39b53cfe0605e29372888
MD5 1996a23c7c764a77ccacf5808fec23b0
SHA1 5a7141b167056bf8f01c067ebe12ed4ccc608dc7
SHA512 430c8b43c2cbb937d2528fa79c754be1a1b80c95c45c49dba323e3fe6097a7505fc437ddafab54b21d00fba9300b5fa36555535a6fa2eb656b5aa45ccf942e23
SSDEEP 6144:4phcsngKdHpPXECq6Xz4G/rmnHXekVB9YNeeA23YMd7pMFW54AXIEB93KWZMxEHL:4pasngwHpP5qa4G4eIWsyHd0XKBBXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

AB25.dll

Path C:\Users\Admin\AppData\Local\Temp\AB25.dll
Size 760KB
SHA256 b0278015360398541a8d4a76033b2e8417ef6b61f60c2a05ca2c762da695cd05
MD5 cbdcf1fb8eb8b275bf1af33bc83b8166
SHA1 3016c8f9f7e93d183f4d557f5a7bc201649103c5
SHA512 f574965318a4af42c87de240ff86ea8dbf109511feb8f753def3eb20edfbc8848db9f7dfa4c21a8d287732de297e7cae1df3621e78f1fdc578905f7daa074359
SSDEEP 12288:lKMuC5RMchO+KqvSAE3GoJTNJGfdH2Nvj4s7OsZ799EW9c99lab+h6pT4:l0CBAasGoJRJGfdH2aoPx9OTabn0
MD5 SHA1 SHA512 SSDEEP

Submit Download

AB25.dll

Path C:\Users\Admin\AppData\Local\Temp\AB25.dll
Size 924KB
SHA256 214cdd6e1a27707d80583e78a1b119dbe832b77178398c23dd8de6e60d2b90ea
MD5 2851ef8c291cd19f3d59fb11d7356436
SHA1 388d4393023ac84bc2c5df2b3a73bc42178d6fad
SHA512 ca03e110d7c8afb0252b967cbf2c344b3e6cc9f7667750bf4d027b0beac56b9207652eda972f2bdb645cf9206b2f3607459789d221e34b91686b34f16f13b2c8
SSDEEP 24576:l0CBAasGoJRJGfdH2aoPx9OTabnRnfAJa:GCBzZaRJG1rK9YqRnfl
MD5 SHA1 SHA512 SSDEEP

Submit Download

AB25.dll

Path C:\Users\Admin\AppData\Local\Temp\AB25.dll
Size 101KB
SHA256 f286ab490559b85fc729e0b583e797aab800e6942a467996d4f3f2cd9db6e81e
MD5 d5b2028f88b6104ce0081bf74b94b9a6
SHA1 6a22de14291ce36ff34b0e23a1b37371cf75c85d
SHA512 a862738ffa547a580c0598ef471c00e7e2e8e4ef0dd9844f1a6a5813de292f1f770d821304286aecf7f18553565f5aa0ad1a2139f62f5bf0471fbe3d340c5b16
SSDEEP 3072:3KylN31ZGDg1y3M9FRNPdIF4uY4zdjlo0+N4:lHqO7PGF2sCN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

BroomSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
Size 50KB
SHA256 748022147bee300050b7b370e616255005acf1c04af2005ae126af35d6223133
MD5 cf7f3d3097b8a29909134672772ee41d
SHA1 4dbacb55703ff3bff4ac1e95502e92472ac6cb30
SHA512 a7bf7cb6f101e22b67316280cbae2ece46f29ff3ba1ac40fd1c3466028eaf0ccd46749e40808488b62ed327d4a1be39791183cd21b09c35e4ff06e56b1e6a821
SSDEEP 768:ChYkQAcW4LeyR1AWqCIhqAXLu68HsWgJNYhvxvBgC9YjJ3+:CekszR3ehqAKHPgJNYR39YjJ3+
MD5 SHA1 SHA512 SSDEEP

Submit Download

C99B.exe

Path C:\Users\Admin\AppData\Local\Temp\C99B.exe
Size 5.6MB
SHA256 0bcf297f2808010cd7bd4180329c1f994daab75dd6ff543a5360adb5eb5bb753
MD5 e88e0fe2bb602d639e5658c42f34af2f
SHA1 0f5183b2a40169755eade4ff45354e8fcc3cf74a
SHA512 660167d07268cde0b34d749e4e4c278494cfed3fbf68484ac5a0434e36f3a27ef95d31593976fafcbc138dde5b9b7f56879ac77bae1f73eb3391a9162f5ce15c
SSDEEP 98304:o4Z22tk7CUxDobkYG6sk/ixzpx5ItNoP/JKawK5Ms5bZxpMo:o4ZFUKbY69KJ57nJhwK5Vh5n
MD5 SHA1 SHA512 SSDEEP

Submit Download

D796.exe

Path C:\Users\Admin\AppData\Local\Temp\D796.exe
Size 843KB
SHA256 ba4b5aa77c253575fdb822fb6c45ecdcb7a87a2565a47114a85612ed4c86a14b
MD5 a2570557ce5c7d9fabd38b7035270e46
SHA1 fd6d1f48d46df534df4239b9df5004f898a64767
SHA512 997e7e585ee2e05ba155f44943b7e8b641124caee16f0d452d1819ea6b2aa6bd4d069068d5d67484068ee91969627db7ea1d5ee801270c35dd28725b6ce35163
SSDEEP 12288:K2SBNSHKxFUGiriD8w4wu+Tl9YYuU6/vHnbc257ua5lJEp7s/QhMQwfdFQOgKsnU:vSRirG8w5u+TLHuLo+glnwHHg/PxCf
MD5 SHA1 SHA512 SSDEEP

Submit Download

D796.exe

Path C:\Users\Admin\AppData\Local\Temp\D796.exe
Size 828KB
SHA256 cf9bd2bdf828fbb58ab57e6487b290892909d092e835d8af8db0cf01f07381fd
MD5 a733d4c4ca6b0528f5fd0c6003538ffa
SHA1 db74dcd860f44a8b4e02f8ebd153c6b4099031cf
SHA512 4867c3aa560208b8bd4e6120d749507e62572aa0c224f282f6bd191f0a063596d3e5f559c69f1f91679ec9dd25c456e38b81d1f0d39cfb2709b4c7d4654af094
SSDEEP 12288:K2SBNSHKxFUGiriD8w4wu+Tl9YYuU6/vHnbc257ua5lJEp7s/QhMQwfdFQOgKsnH:vSRirG8w5u+TLHuLo+glnwHHg/PxCQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

D796.exe

Path C:\Users\Admin\AppData\Local\Temp\D796.exe
Size 89KB
SHA256 401316b5f4d3d7c6c27dea987289aade42d6c24382adf1cf25fad88ccca7f555
MD5 855e51c109ebca7ee1e3827e1244660e
SHA1 8a4b1107e96f5dbaaae0429adbb09011d48917f1
SHA512 b7f9b21619ad4ac05b3b6c6e0f20c5de2894b9936e118d79d3262b668571f91ab955614bcf29d740672d88f4f5b31b5bc07f40dd328c3951c3dac022738f5b57
SSDEEP 1536:KKGgSXNbsmgzEHkUnZU+m0c5D9bwnYAA27tW1+bwT:KKGgSXxYUShz9Y7ZE1z
MD5 SHA1 SHA512 SSDEEP

Submit Download

DE9C.exe

Path C:\Users\Admin\AppData\Local\Temp\DE9C.exe
Size 168KB
SHA256 e9aaf892c3cb45c74249d73795357ab9dd9a1c2b1dca99dda01bcef65eb31b1c
MD5 983a55b5af5e03032daedc0cd0ed18a4
SHA1 71b51db36fc9511e8fdee4e30af36439ff37d8e7
SHA512 49f110a5da9c7f732b1024fdf32c90b2d5ad725a8ed3ded994b502d4cc84632dd3907537ec9ba1c7e82b664747504ffff27a67e29a6eb532084fd2e34e8fe326
SSDEEP 3072:9LPT1kGv8oMdsVBEmM0Z1v25y0G2qnbKbrUjY/TGJ68QDjqGMaxfL4VqmJhWUu:9/nv8o9zc0xrbIrMY/TGUjjEWzm3WUu
MD5 SHA1 SHA512 SSDEEP

Submit Download

DE9C.exe

Path C:\Users\Admin\AppData\Local\Temp\DE9C.exe
Size 44KB
SHA256 049599e99951322f29c129135d471c23b27f6eb517b0f4baa0ab685083531a1b
MD5 f4c5116a79684b1ba3f983058e58d250
SHA1 d3b680e0e4a27babcbf142f499ebd72eed74cefc
SHA512 bd66cecefc8822c2a7ce5d95b35e0cb291d2a2dc1e870027f8b632e1077f52f6c02874d0df39bc358cebe415b302be90067fe8dab6b414463d8c615f9a79d439
SSDEEP 768:kh3qitxsLKP7GpnQ0Znwuziz9lhbYHJ+Ry5B1NnyuN3G838gfOoO2n:U3qRLK2Q0BmWERGpN8ghn
MD5 SHA1 SHA512 SSDEEP

Submit Download

E438.exe

Path C:\Users\Admin\AppData\Local\Temp\E438.exe
Size 24KB
SHA256 90a2d297d433ace85b326f6835efb8e3453fd7dd70778b534b05d828bd96b162
MD5 f015761bd4c7b579331cadd552809b25
SHA1 908d7a91f188a12f427f932f7d30f4a05951392c
SHA512 f87225ce7f7e798ac296f3a8c7bf8ff9a72141a5b5e7dcdbef3fbc3fc4e1e43c946d1a2c44067be8f7dfe9839fac92f9f1c7bbb5bbe6f22215b2fe5538871999
SSDEEP 768:KQ+bCuoR9YsCR3W/zwHNsB1qo8VHL2u9R:K1kwr3+0tsAHLb
MD5 SHA1 SHA512 SSDEEP

Submit Download

E438.exe

Path C:\Users\Admin\AppData\Local\Temp\E438.exe
Size 87KB
SHA256 68b99ec7cf35813e0b61955fc836b55f4213b59cc1f1ab199458dcf4869f7e51
MD5 25e3c80b8e245e909219718908949054
SHA1 e4622cba4e031d3c96a2eed7a66a8707d03194db
SHA512 f06d7fcdd2affe316a282bb0c59b86195a04409fece925a81d23586db13d1f1d7bea7134f3f40dbafe1899112891517169b3f668fa605853895199dc15a5ae55
SSDEEP 1536:K1kwr3+0tsAHLNh5IXik1WXvrSRPqa7T2qFW5kTUZ55GHvLUT:K1WeLNhvk6+iCwn5e4
MD5 SHA1 SHA512 SSDEEP

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 144KB
SHA256 4764bf81638f04d52f957a61f8339c4627c01a3207add8ac5e89b657e32a1d92
MD5 8e26e59d7fd997f82050e910aacf5b4c
SHA1 711f57357a45cfdfcfa0076ac480ca37fc4e29dc
SHA512 ed490af6b143d924294c43fca22422793c2e35be2c719fbffdea4153d2718b9904f5e7ab99596a238b416ec86f3dc3a36bf4593a0c2d104b84683c0f274fbeb5
SSDEEP 3072:PRQFRiNIGc3+EVSDDly1itCodnIW4EGTnDZgJwpLmS:ixdjVo5KiLZIW7GTnKciS
MD5 SHA1 SHA512 SSDEEP

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 1KB
SHA256 bca92d61f9fe5527fc26e255bbd27a5b54cd7f983d5168daa4c19fbccdb57eb8
MD5 5b5eff124ad3d7da492aa36dfee68fe6
SHA1 8736befb56410c00798dbcb0913ead451fb369e7
SHA512 3f47fe019324e3a3c8480b4503a64a67559ead7dab4264e31edceac19022b6606a04f568efbaf1a56a44efec9ca46a3513762f05e7b08f126f61115873abfdf7
MD5 SHA1 SHA512

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 31KB
SHA256 593558e5a438d5e0900cd64f2a40c62c3d997c19eebeb6fda6d22d85a22519ab
MD5 37b6ee7915aa45e51af178b76af58781
SHA1 0bb1cbf7c76455948133e7ea017de5e7adeb5d33
SHA512 750cbcf4023738796bb8152e93bd45b900489e5cc89ec364c496e884fa9540115449bf45be828ebcbbc7162face08db8d90dd9c0759f0694edb200a5c8ef30a4
SSDEEP 768:o9aHipMLP1GF0mph3JsJCXMNqnMuRYcu30+VaJQJO8IVAZ:o9aHiKQFR3SbNqlGcuk+GL89
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
Size 85KB
SHA256 0c5c9417e446eea312d5ed2158fb9263dcec404399cf64db7c0ebbfee87b705c
MD5 c9ddf61934154f53bacd5d123c92e0e7
SHA1 48edd06cdeb4328e8ccffd3126812ae925080835
SHA512 677a69c1440652082158a556112e2d7fdcba95e162dec15b19c443ff9a50859a1f2dd131a2a0db0f1491c7a059ce869121b81f1191fcabbdc0e85e0dfb8c8ee9
SSDEEP 1536:IferrLkSRoe8C4UZsys0Dh1duufX7cY+qU+wwa4CANjQFFpS:Ifi3k+oWDBDh1duu7clwa4CKOFpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
Size 107KB
SHA256 d1723bd17dd861112833046fae6bf33c12e944ceb806a089b1f400944046159e
MD5 cc6ccf9aaa3c95a1da810ed0193ee3f3
SHA1 e172cac8aa8ff0cea165d779e9cb3d1544c96dd3
SHA512 0fe132df4f1a80a8a18b7c6c1a820f5bb25dcab71d87cc9c065defcb896c1446f216e550a87127c7ec34caf72457f6ff0d7581189cc40730af8453d5bbd33f27
SSDEEP 3072:Ifi3k+oWDBDh1duu7clwa4CKOFp1rFbWG9CIn:IfL+oq97clx/p1rJWon
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
Size 5KB
SHA256 fafe00232317da7e3429fe769130a5a2131264cd3528ac1fc5e238eba672f28d
MD5 f1a31f4397c3e2b356446c6f0ce65f7e
SHA1 66ef93879d258419b456c5ad0e168a68367edcba
SHA512 e73530c60e09b84ea0a76a8ac231a6278868b425355a068737230170b427cffc8f513d94d7d9bec1c65882c9ba934e5725d44155c5b0fe6477e7a8e826deb2f3
SSDEEP 96:dVxhjn3Rw50UG4ZvU2bf7aguDlaIMuhYHj4P34TtOzAv:/xhjn+SNQvU2bfpuhYHQ34ROK
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_jcdjsv5t.ty2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jcdjsv5t.ty2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 239KB
SHA256 aabe1dad37a67b9e41f0fdc55d082f211fd4391e7f3d491844cd6c4894e74e60
MD5 938840b3825a4b4323be10238994d40e
SHA1 f65038b907e136b4a84f01b578bef4e14502f89e
SHA512 169febb002472fb8c9e20cc0a82b81162dd6ba6765039a3feb58bd2d22db77981f2cecbf451695bc4f0a711b5e70645d5217a5ac7e47b458e20ae360be300efa
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydf:SA3IlIA6e29vngqS8wMmuooh8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 203KB
SHA256 2cddca9e36692b534181dda66932a7e342c0afa9c50942d4551acc26295e424e
MD5 e499508aa121aaa6d68e49f233e16553
SHA1 6483307a42593a5244ef8f31424929a362edbc62
SHA512 3f564bc9d408c1b3283d20db43e1aa8eda09b5ca991108a97487586cbf2dd63fe3438ba11a4bf0fdc403d4338c3e61ce0bc537c398842070ea0e7b2d47a6c9f4
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMusc:SA3IlIA6e29vngqS8wMmuA
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GILS9.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GILS9.tmp\_isetup\_isdecmp.dll
Size 19KB
SHA256 71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
MD5 3adaa386b671c2df3bae5b39dc093008
SHA1 067cf95fbdb922d81db58432c46930f86d23dded
SHA512 bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
SSDEEP 384:ED4NeA1PrXPBdHCNPJEQkWybd0oBSRnAZ806OSDrgtOFXqYUPYNQLJ/k+9tPEBer:64NHPfHCs6GNOpiM+RFjFyzcN23A
MD5 SHA1 SHA512 SSDEEP

Submit Download

DE9C.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QKD6N.tmp\DE9C.tmp
Size 135KB
SHA256 301b924a75b2283f80589338e30945a4da045cc8ec432eb5f95ea57271a9c88a
MD5 8d327b8066b75cc1898c6fa9abb45fba
SHA1 97619e5d7756369a4cf191955136c00eff5c3197
SHA512 2ca87c2c19c4fd79e3763ea0eaaf2fcd074e5fd5ee70ba7077c1fe158de228c34a9ef1fa4b06767a5a720b13283054cc2dc6a0b6fc617dbebcf5a486ac321f00
SSDEEP 3072:/16C7hfpkAN15mnI0P5B088Cer1YeOcL5uaLwMOozHpAHXV:0ghNEPGCeBOcL1LNh1AHl
MD5 SHA1 SHA512 SSDEEP

Submit Download

DE9C.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QKD6N.tmp\DE9C.tmp
Size 88KB
SHA256 b0787ec429f68ac0525a2eb21a14b42c1c57e1f932ddc59f02c8819d54140f13
MD5 439fdcbba3002c1cd8cd48756f5b6de7
SHA1 4f44ebcaefb4408bfaf68607099216bf349ab8a6
SHA512 5e44edeb2ac6cbe1026b87852f339d09b981798064d6364a3c4a5e1428d27b192dee339e12c0b167f1a5833dd2115a60eea7ab2d6b237755064a633bd89bc22b
SSDEEP 1536:FMqdKLCd62JQs2WvnyykAN3F5B4B5I0Pn5T9hG88CerAc9YeOiXlLkkuUaQxR:/16C7hfpkAN15mnI0P5B088Cer1YeOcV
MD5 SHA1 SHA512 SSDEEP

Submit Download

nso1B36.tmp

Path C:\Users\Admin\AppData\Local\Temp\nso1B36.tmp
Size 9KB
SHA256 294f147fc0ee6af32636a2021558c8655afa91142a60390d441fd275a884670f
MD5 dc9222c9c5269af4c82597ba1a34c40b
SHA1 9e110517d86094abdc12be0872470d17fa455833
SHA512 60074c5e15592dc7803a287a7a4ec75c7c8f906d6e9863f4aae49288832a8ff3d3ac3d9f17cc88f72aa1e882f44df8b86a851c399a3e16312d5d45eea115193b
SSDEEP 192:sj+V1EQXuIX/+GrCrM6HAIPTYunQ7aZK7xcE2:W2EIuIv+OaMwAIPNts7xcE2
MD5 SHA1 SHA512 SSDEEP

Submit Download

nso1B36.tmp

Path C:\Users\Admin\AppData\Local\Temp\nso1B36.tmp
Size 42KB
SHA256 a8a56e178acc463656db388f09c8aff185b1461b53869c26f645e7e58c9c93dc
MD5 3b73b9fb7d3a07a8cecbeb3e0ce2f270
SHA1 e3eed630a6892c8a21d8997a779c160e99801dec
SHA512 f47083be4b5f734309863ae63b9d0154e8b0adfef6495d643b3b3a0761b6831e9277ca5ad9881c0bc060976e1553420436b0d5cec8da3863d53ada161e3cbb4d
SSDEEP 768:W2EIuIWOaMoFHEokBweXpkXA+mJLnOrbWKswXngA17IUwf0ZNi53dBfrR5Ka:W1uqPrApUdKLOri9wXgiQf0ZNivxR5Ka
MD5 SHA1 SHA512 SSDEEP

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz1096.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
MD5 SHA1 SHA512 SSDEEP

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz1096.tmp\INetC.dll
Size 1KB
SHA256 711ce1b5b08d30470c7cb844d2dd9345ffb6c2add9392f56a86e8c515ba89ed0
MD5 c7ae096c02849c7eeb07623b18de8a59
SHA1 9f57c75aa9f96121413a793d356d876a09f564ca
SHA512 2a070a13ed45b3cc289f8174eb313d244daf10c1ae36c837f305b450bf2f1b839850eed70f672bb94c75117fe232341b01a868824e42d4d01ddd754fa9b5670c
MD5 SHA1 SHA512

Submit Download

vbsmartcardviewer.exe

Path C:\Users\Admin\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
Size 171KB
SHA256 b75a1a001b810e3f2d6fcd9b6ddd764e0772bf04d9cdcf2465d42dbaac587f97
MD5 306a9451755cf52ec6e6c6118e272cb5
SHA1 63e1dcadc2e6a07aa3230308e8bc072dc6364043
SHA512 66c3a0453aa35a6bec540677f1cef4e7a9fff017078ebc61b9ecb2d02dad45987e115197fdf6783bfeebfe0cb625b6edb7d2db90fecbc7aea095321459e391bf
SSDEEP 3072:PyMpH2x0GPLfdQkkkk1UkMpH2x0GPDfJjvbzEazS:PyYGPDdzkfSkYGPDVNS
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbsmartcardviewer.exe

Path C:\Users\Admin\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
Size 256KB
SHA256 c16f8ff0806f385a5bddb358e5596f985c7a21de2b6b7a743eae0d73e8dbea20
MD5 37c71332d9f987712bb883551defe9ba
SHA1 5af211bde05a6caf9f1f43aec78e07b2c106a829
SHA512 8c5d1d8cb9e749c07aa2f81e50a8d592931e0753565903b72f679acd24cab5ab864cd424f296d7f13cc92e1e37fb661f4039dc2603bc7755533c5d836d8e06cd
SSDEEP 6144:PyYGPDdzkfSkYGPDVNDFJ4ebYGPf6gWJA:ubdzkBJhFJpXjX
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbsmartcardviewer.exe

Path C:\Users\Admin\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
Size 163KB
SHA256 b58e83362e2cec41b268fd69035c7b9a372e7d4c2a7794107847ae15566148a4
MD5 892cc8cdf4c5649900bf035097f4f80a
SHA1 836e51b7f9623458387d4f4290a83ba7d66daa97
SHA512 1f60b97f67648261e3d184ea1688d147e6b133ae85278f7cf20e3ef9f28fc56e6f42f6c6d0dc51aaca914341ad359887468adbeafbfd6cb0802266ca3fb9ef90
SSDEEP 3072:PyMpH2x0GPLfdQkkkk1UkMpH2x0GPDfJjvbzl:PyYGPDdzkfSkYGPDVd
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll
Size 260KB
SHA256 be2f34b1f439eecd7ae25c75030b456145e63760d7894a15bd17b7bcab06bf1a
MD5 60df5553833b7b368ad1a699ae5abd93
SHA1 0bdcc3182b448467acd4a4337842fb5712ecb9b0
SHA512 ef3d6dc34e8b747d8840d5fba5412ff2f295148a98626056ab4dd82753cdd755778aaaa6e18e4d0381e715a93e178dfa4b06aa378cc0ea53ea6e6ab12ca532c9
SSDEEP 6144:Vkjmc6FS/bk70V/RNkgPKULuqXwXG6Sgn22Ia:Oqc6C8Y/RCgCULu4g22Ia
MD5 SHA1 SHA512 SSDEEP

Submit Download

Task.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Task.bat
Size 128B
SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
MD5 11bb3db51f701d4e42d3287f71a6a43e
SHA1 63a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA512 907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
MD5 SHA1 SHA512

Submit Download

cugwgtt

Path C:\Users\Admin\AppData\Roaming\cugwgtt
Size 58KB
SHA256 3cebf87cd2dbb3172d7d4497efe46ad89da2b3c6db37aefb54ee2deba77de9b5
MD5 ff74abf35ba49c7736686b73dfd1d6fe
SHA1 205bed7837278f1ea17377a444c91f1404d678c1
SHA512 2c300efdffca6cf86e340f0e6a573e80bf6dcb646d96c43d149933d781546beb012b82e3e7d874e0dad4f3978b854e2f9dba54054f2c8abdea42a0d76e68bc7b
SSDEEP 1536:2O6buno82dYL1fuQEqLRlM98wvH40/PqaF2+Iv:2HwbL5fLgCz
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download