Analysis
-
max time kernel
489s -
max time network
577s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
08-02-2024 01:32
General
-
Target
The-MALWARE-Repo-master.zip
-
Size
199.9MB
-
MD5
cdf4e0a856fc08e09a62ffdf933cae54
-
SHA1
4f148768a5083e524bf9a28cb967f936565550c4
-
SHA256
2d9bb4e3fddfe5dc51c54cba74a1eb594c7be9d34774524d972350edd85e6499
-
SHA512
35a7c6f3ec10eba8eb46759cbff7ff5568191e53e0d78227000b9bc9ed014920024f7b18a96ae2ae6ed4b72aaa804fcf4b5128a088723c2966023f6c3a60d1a5
-
SSDEEP
6291456:9vTD0Y5thtdnP0If6fx++o7OTlNmP8nQhkXfW:1D0Y5thtdnPVo4+wOTlg4TPW
Malware Config
Extracted
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\_R_E_A_D___T_H_I_S___SKIVERP_.txt
cerber
http://xpcx6erilkjced3j.onion/3129-A647-E9B4-0098-B41D
http://xpcx6erilkjced3j.1n5mod.top/3129-A647-E9B4-0098-B41D
http://xpcx6erilkjced3j.19kdeh.top/3129-A647-E9B4-0098-B41D
http://xpcx6erilkjced3j.1mpsnr.top/3129-A647-E9B4-0098-B41D
http://xpcx6erilkjced3j.18ey8e.top/3129-A647-E9B4-0098-B41D
http://xpcx6erilkjced3j.17gcun.top/3129-A647-E9B4-0098-B41D
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
CryptoLocker
Ransomware family with multiple variants.
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (62) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Contacts a large (1092) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 7 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 4 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 45 IoCs
-
Modifies registry class 64 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 35 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master.zip1⤵
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x4011⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\The Worst Of All!!!!!!\BonziBUDDY!!!!!!.txt1⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\butterflyondesktop.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\butterflyondesktop.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PRFGT.tmp\butterflyondesktop.tmp"C:\Users\Admin\AppData\Local\Temp\is-PRFGT.tmp\butterflyondesktop.tmp" /SL5="$4024C,2719719,54272,C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\butterflyondesktop.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://freedesktopsoft.com/butterflyondesktoplike.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:636 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5519758,0x7fef5519768,0x7fef55197782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1112 --field-trial-handle=1396,i,4222851619887026976,5699335345987466836,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 --field-trial-handle=1396,i,4222851619887026976,5699335345987466836,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1396,i,4222851619887026976,5699335345987466836,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2228 --field-trial-handle=1396,i,4222851619887026976,5699335345987466836,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2220 --field-trial-handle=1396,i,4222851619887026976,5699335345987466836,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1412 --field-trial-handle=1396,i,4222851619887026976,5699335345987466836,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3232 --field-trial-handle=1396,i,4222851619887026976,5699335345987466836,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3904 --field-trial-handle=1396,i,4222851619887026976,5699335345987466836,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 8642⤵
- Program crash
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\HeadTail.vbs"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Netres.a.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Netres.a.exe"1⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Mantas.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Mantas.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"1⤵
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Melissa.doc"1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"1⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Cerber5.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Cerber5.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___T1JU9UJ_.hta"2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\Admin.vbs" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___ZZIGK_.txt2⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___ZZIGK_.txt3⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\System32\Admin.vbs"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "C" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "C"3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000000C83⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\7ev3n.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\7ev3n.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 9162⤵
- Program crash
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\RedoInvoke.tmp1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\InfinityCrypt.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\InfinityCrypt.exe"1⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\NoMoreRansom.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\NoMoreRansom.exe"1⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding1⤵
-
C:\Windows\system32\SndVol.exeSndVol.exe -f 46007460 315361⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\NoMoreRansom.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\NoMoreRansom.exe"1⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\NoMoreRansom.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\NoMoreRansom.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Indicator Removal
2File Deletion
2Impair Defenses
1Disable or Modify System Firewall
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\AutoRun.infFilesize
221B
MD5b19d9e86c31676f66ab19fba9b64902c
SHA1e2fde88eed61423b1d5dd2d5c2a233cad58a3a8e
SHA2567af2084303d196ade349296ea5246f6d39e77667de243e5b67258f09a77b2192
SHA512c1182be00cde50e1dd030d14bef9f0ecd797157046936e54fe38ce9a1ff6bb65e2dc7eae31f097163110ebbef4b6f6bdef2701d32e1012f1cd070e0f2221eda6
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.id-AF5E065C.[coronavirus@qq.com].ncovFilesize
192KB
MD5ef2e0d18474b2151ef5876b1e89c2f1d
SHA1aef9802fcf76c67d695bc77322bae5400d3bbe82
SHA2563381de4ca9f3a477f25989dfc8b744e7916046b7aa369f61a9a2f7dc0963ec9e
SHA512e81185705a3bd73645bf2b190bbf3aee060c1c72f98fa39665f254a755b0a5723ce8296422874eb50c7b5e8d6bcd90175b0ba28061221039172a3f50e8902cc8
-
C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exeFilesize
3.0MB
MD581aab57e0ef37ddff02d0106ced6b91e
SHA16e3895b350ef1545902bd23e7162dfce4c64e029
SHA256a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717
-
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEWDAT.DLL.id-AF5E065C.[coronavirus@qq.com].ncov.8AA64E31B9728EC45611937923B3103590456B452D2BA8EA3EB5AD77D10833F8Filesize
3.7MB
MD5c09ffd9fbc22c3e3baf709af2a579767
SHA170f1add9b0da18d821104d92bdb25b5c15e37a8f
SHA2568db9d503b86bda72a8432fbfc6766091c20b73c9bfb41a160d370f6b878145b1
SHA512c179d08d79b9cd4f8677277b67cb1d30f2f16a6ca8dd7a9f429e8d4f3b318a19b2c520ff23994630bd224c7746c7bf8f9e57343fe3d2874033f3d863bda656e8
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.htmlFilesize
34KB
MD59d2d240d9002d52077634121bfb88cfc
SHA16885af902ed2346f0db772c18056e6cef5e6ac1c
SHA25617c31a411da90b0ed7a9e694b17ec70b5501e3622b077e051a008a1c94d9eb61
SHA5123a5ed01d5347b24da14701edf5be5212fdaab2668691e4a23e9107ce6a0c228eb443ea30abd67c73a04b1b99f7f2329f2736d8dc9d02ffb48da7157da4b2c211
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\27346e31-fd9d-43a8-9cac-bea33b9e9ff8.tmpFilesize
114KB
MD54f9133239db10abd4c83d2d068bb3d26
SHA1320df96d96b575e59040f849378ca446fc273db2
SHA256071331586eabf1abc510d0b23c5ed773ed2b86ffa4456d9e689903c18fba6571
SHA512d69055b2d892aa9c7dd7c665c50362572ab441d5f724ef0f0738059eb8bba019205be3213048b5a2427a49997e6d522b4ccd1e379e7e851d9fca8956445f0be5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmpFilesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DATFilesize
106KB
MD54529eaec52f07bb8ae82565fcca6230b
SHA18128fa1f711d470b23771e667f8e0186f3f7de23
SHA2564693bc2843dabc0ff24acebe71c1c677d7575200bdbd25d724fbeeafb172aa4b
SHA512fdb22b76f159a3bbdaaf293f50118f8b598bd0ea4798ddb79c0378f4c612a4ffeb45c69997e0c452a21b35f6ebe3415e448693e7e92d31b5b3608765049b3b39
-
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DATFilesize
240KB
MD5b4bf81e502dd772381438a3993a4987d
SHA1b6362b16b7e6f5bc632c79d40d81d367f8d1c92d
SHA2561be897aba378687b7876f837639f6fc60b096b7c108165669912b656fec7a318
SHA51292d52e49a1163540206e1896b9745fb3ad492e02b872792c97b0a2dbfd3ad210bd981e896a0243e50865d3acd6a86203317be711a03b0b5d12fe58230e397558
-
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DATFilesize
240KB
MD567c4f226e5b0db68c64bb75cfc824490
SHA1cbe3756fb90c1f7d3422f4df8425b4b3604a195b
SHA256fef94a164af0f71f779ec1ac664ae949d4c4e1534eb2f782ad985e24796210af
SHA512ee8136fd79092675850538fee01fa043006b699f96f6282784b7695efe90c28e8283f3d6686ed45fa3ec1e41f27831b3044ddafd29f664aff82167945830027a
-
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DATFilesize
240KB
MD536c7d30a69365da8e6beeb1e5fd11714
SHA1aa4801a3fe7faa4a47aa7df1482da4c33bbf4515
SHA25619e00c79d802d3b82be3a2a2b05b9342d60ddc5fb6619d6495f944d7110072ee
SHA512875d159516c5ad884248298c18ff7a720d4765e3b7eeb30a23eabb5d1c1bb3a938a8772b0a720ed09088f05b31fbc7abf65ceb7c4d37f1b30a97720ca2589080
-
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DATFilesize
240KB
MD570923c80c3c2eec76fd48973fb53a27c
SHA118c8ef6634b1b5443906b906216c1512a92cb567
SHA256a415691e66bf8101e2f0b3b411981ff3bb2cb91c019edc93a288b4d5709bca40
SHA512192483280475cc10dbde1a0320f710a6ea3cd1e877b994182b64b829c2b9b4de3113abee54c1a9ea81a688ff812f6d332fed9554694d818958fc23d59f585db0
-
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.infFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.infFilesize
1KB
MD548dd6cae43ce26b992c35799fcd76898
SHA18e600544df0250da7d634599ce6ee50da11c0355
SHA2567bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a
SHA512c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\favicon[1].icoFilesize
3B
MD58a80554c91d9fca8acb82f023de02f11
SHA15f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\butterflyondesktoplike[1].htmlFilesize
33KB
MD519ab53aeadc05925465191c1b96c7b18
SHA1911f28f5665e86acae4eadb9f52a17a4a6e440e4
SHA25611298af4b15745fcb8488ac530e002479eb0008cb51863592db9bb2419442a96
SHA512f92554816f57221416c33d714bea5aaa8c806ad3ae61ae0e39db6f8a63298a2601875c5af9b95a6706432b18946ecd5153f28161a6f8df5bacedc6c179d976ad
-
C:\Users\Admin\AppData\Local\Temp\CabDCAA.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarA9F7.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exeFilesize
338KB
MD504fb36199787f2e3e2135611a38321eb
SHA165559245709fe98052eb284577f1fd61c01ad20d
SHA256d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
SHA512533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\_R_E_A_D___T_H_I_S___JSDOLHFW_.htaFilesize
109KB
MD537120e89f556eb86b74be40e0e4971a9
SHA1a1930ee717909cd6d9d437ebec4449918393e7e9
SHA25628633084a0306b585e05341971bfa1f929d4001d5700ae25e5f637ad8593db50
SHA5123cd22445ee06dfdbfc0e27c3714f8572559de4a5f34ea31f1e1eb4745c5cb713db0d7ff99bd51f6eee233f4099cef1c0d9439cda975b55bd807793f8a4fbdf91
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\_R_E_A_D___T_H_I_S___JSDOLHFW_.htaFilesize
75KB
MD5d7f3164ba9cead5e3fe40dba2ec528e6
SHA154916e05a50752da1f3671c960cc759be2580452
SHA2561e236128fd81f82c9ecfa6160eeb6d53955a69a2d206f17be175128d5a587cd2
SHA512007965ff2ae2e68c2f0751cb647a6667b0f5dc6ec12901be7d143c827bc6afa69ef0ab0ae0eff279ebe6aae17315182ebb440ff8a919c7176c747fb62324eb36
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\_R_E_A_D___T_H_I_S___SKIVERP_.txtFilesize
1KB
MD55617966aadc7561ac5ca95c8b825e51b
SHA1bce4fdac3f675575a74b66a8a3a188f63bb37f4d
SHA256f89133bc2ab97239e98c0f77ad436c424a020124441ebe453999b207c7952ae3
SHA512db4cb32ed0c506a3b6c27f01d3139d921e583b2a1992258f9f2df5465322d7d86443d10bc8cafba05d513beaac87226d5521545c3743d70b94227f3440e35200
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\_R_E_A_D___T_H_I_S___OZQ3KO9I_.txt.8AA64E31B9728EC45611937923B3103590456B452D2BA8EA3EB5AD77D10833F8Filesize
1KB
MD5a3653485f9e5829ea0a247ca25fb9e03
SHA132eaed6c7e9b2b0e7d1f59244e586f96741e9f89
SHA256bdbef8dce1022f0990cfd4b5656ca0d3d992c107e8afd4e71137bd31a1904e5e
SHA5121380559453e868ea91d83b5c02e45d53b7c5f6be570bfd27ca24a75fadde3a06a2a4cd4164d15e7e2430474305b08ae3cd7ff1b533f93eaaab83f3d2eab238b0
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\_R_E_A_D___T_H_I_S___QCWV_.hta.8AA64E31B9728EC45611937923B3103590456B452D2BA8EA3EB5AD77D10833F8Filesize
109KB
MD5bdce936a963d0eee2abeb7b1b33b4f9c
SHA1b3f7530b327f4dec5b09c34c1ff4d18111597b7b
SHA256d20969a5cbe8a999a7abde8e6835d940a97acbfd509e225034400cb76b7959ee
SHA512881842faf83fffbbca7604298d869aaf44a1d191566a8ca5fac6b0a0d8b3db5e32d41612f4de19da2ca216cd2987789551f539701119e272014f91d7b1a985bf
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Bolbi.vbsFilesize
79KB
MD58b580dcb64fcfde1846f1cd2ba9a0369
SHA18346288dc6e1353e00bb2eae6cb4837bc1524d83
SHA256d7056457b41fbaece410847fc441aa7e918127995b0078ea2b639d4eeeab468b
SHA5121c863f71c9b093df3358f69ce42685773ff82c4eab9a9327e20a7c362e4073a9b5c6cebdc75946e4f1f351796e2db050038642f572959db2cdf497deaacb5b83
-
C:\Users\Admin\Documents\install.exeFilesize
40KB
MD553f25f98742c5114eec23c6487af624c
SHA1671af46401450d6ed9c0904402391640a1bddcc2
SHA2567b5dec6a48ee2114c3056f4ccb6935f3e7418ef0b0bc4a58931f2c80fc94d705
SHA512f460775308b34552c930c3f256cef1069b28421673d71e3fa2712b0467485861a98285925ae49f1adea1faf59265b964c873c12a3bb5de216122ac20084e1048
-
C:\Users\Admin\Documents\sweet.jpgFilesize
23KB
MD558b1840b979ae31f23aa8eb3594d5c17
SHA16b28b8e047cee70c7fa42715c552ea13a5671bbb
SHA256b2bb460aa299c6064e7fc947bff314e0f915c6ee6f8f700007129e3b6a314f47
SHA51213548e5900bddc6797d573fcca24cec1f1eefa0662e9d07c4055a3899460f4e135e1c76197b57a49b452e61e201cb86d1960f3e8b00828a2d0031dc9aa78666a
-
C:\Windows\System32\Admin.vbsFilesize
33KB
MD5072064be230008bd05409acb795968b9
SHA11e72bc8b90313fd2ed302b9019f343f57b65035c
SHA2565fb52bea225ec8039eca4a8b782eea9518b2e9c60c860d0903ae60fc51e5b24f
SHA512af4d869f61517e2706001cb6b5ed65ebec700c81c574a37326083d61269d10377b675349c64839087673eec78f689a12ac5619ea8eb6f64ff54164cbc4af1eab
-
C:\v1.logFilesize
657B
MD5d916e41cdc040c6f05ff6e9eec97f36b
SHA11abbcb4ac6ba32fb9d34a863e6557c29cbb59a8c
SHA256a1df6247df3c927f318248f8e4458d4f1ad1807d583ace31adb0ffc6e94daa6a
SHA5120bb4766dff4c9f8da0aa7062ad07e54f750926bdf1bd5294eada1907cc1f0faab74c929242c90bf76ed0f8d8f5ff32cb23ae39db52464f682e0d2f33cbeb9fdb
-
C:\v1.logFilesize
841B
MD51e0479c3ea56999e77ccef163fce008d
SHA123bff3a853282009c4043d7f20f559811829c562
SHA2561bc9386a1a053e564905b3235a4dbe83459ed49116e1edde75c2be1c1dd5b0b5
SHA51263372063b57fb0e3fe10c8099358b5e86f0ffe7ea3e72819344f28731a860e57941228b4ef7eed943d76b5f04629ad0e8d8b32e8d7aed9010c00d67671f06c12
-
C:\v1.logFilesize
1KB
MD5c7d373daac3914b8c5fe7ba49614acab
SHA138d735867a2ef9134c3dc67ef266ba1907120bca
SHA25652979c7195fb17853256a8e8e619849f892f30a6b5e294e73925690fb4f164cc
SHA51268c1e1e787b85ab1eb7d65bc11a88a92f4530fa13595f85fd2579ce70e7a0f13fabc0e7d91ae552ca7a51192045f3d3761bc08a705ffa4bc66b4f0601da8e53b
-
C:\v1.logFilesize
151B
MD51000c2f29825d76617036b51fc607ae1
SHA17d108464d745d04a9aaf8239efaf425346d313aa
SHA2561efe8f45ac5847bef2230a333d853d80be8a6526c9fa3bb5e5ce7eff402dc994
SHA512df14e935e85693e2406b7b53b512a463a35d496b9854549642e7e826f9a334d63ba5c706accdadb25d868a66e4739e44fc83d62cb6abee7135796381a0653fe5
-
C:\v1.logFilesize
395B
MD5d139cc009dc7ce3b8a81474e25e3c469
SHA1814765c85255af179a88826ef7122b7c2ad5244d
SHA2569c2f52ff1df3bbb51a2559bc9e38e8cb402bfccbf51619b521b32b28ef2b29e3
SHA5123cd6bbb35081f8f10e7da6bf4872c362e3bcf1117440578ed2d9b48515e7641af7d327326a7b9c2baaab1175006c1a2d6310224e490b695605e703446dfddb14
-
\??\f:\0m1a2n3t4a7s8.jpgFilesize
24KB
MD54fae33b312fd2dcf71986e573d95fc6e
SHA17fd49352a7fd6387a7d311b95f60c85e6e73b793
SHA2560fcefca2eda80b3e30cf35c73125292309ca931db74a194cff2d0fa0b075eb3f
SHA512a553b856a1a35df7990b0cdc66bd832df8ca638ab229e4dfb26c2c13cdcdae4d09713709eaf21b5ad66b61260476e8373eabb6b0b8bec6fd84b77959f7dfb834
-
\??\f:\admin.vbsFilesize
33KB
MD5e76c9807696c037f615403e35e92f733
SHA10f60aa65d290bf59f721a416b852fb4fa1724135
SHA25664bd9056010371a93f9ada4208ff6fe80fe93a93c823c612c10edbb4b17a9696
SHA5125bbc4f0eff303e308d1f821a3da82903b26e0ec11657f0f7928fcea7f34c4b8481344ca18940c5869cbbfc4edf2021a167472a443bac338a5a91269193a71590
-
\??\pipe\crashpad_1320_YSEDKKIWMDIZMBFHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Program Files (x86)\Butterfly on Desktop\unins000.exeFilesize
701KB
MD56883b57c1a2eafa8456a0f8c0b1f1201
SHA16c2e40cd9dce3376f28aee8c2ffd14112d98ff76
SHA2569be228ead14353c5b2f22575091f491ccfc23622030d205f095ffea0b2f79afe
SHA512e1c4fb3810dfb39439c9f402f74c2f88178cdc28c65134d42215870671403d530bd08cbe03662b18c19f29915f3644935fa8fe32ae60dbd83cee87e769d15f0b
-
\Users\Admin\AppData\Local\Temp\is-5I7JS.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-PRFGT.tmp\butterflyondesktop.tmpFilesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
memory/320-17-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/320-8-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/320-98-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/320-88-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/320-79-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/444-16986-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/444-1636-0x00000000001D0000-0x0000000000201000-memory.dmpFilesize
196KB
-
memory/444-1637-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/704-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/704-2-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/704-99-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/704-16-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1120-1297-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1164-6422-0x000000000ACA0000-0x000000000ACD4000-memory.dmpFilesize
208KB
-
memory/1164-1634-0x0000000000400000-0x000000000056F000-memory.dmpFilesize
1.4MB
-
memory/1356-270-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1356-257-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1588-1289-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1596-364-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1596-1128-0x0000000051000000-0x0000000051064000-memory.dmpFilesize
400KB
-
memory/1756-239-0x0000000000210000-0x0000000000282000-memory.dmpFilesize
456KB
-
memory/1756-240-0x0000000073740000-0x0000000073E2E000-memory.dmpFilesize
6.9MB
-
memory/1756-241-0x0000000000550000-0x0000000000590000-memory.dmpFilesize
256KB
-
memory/1756-242-0x0000000000670000-0x000000000067A000-memory.dmpFilesize
40KB
-
memory/1756-243-0x0000000073740000-0x0000000073E2E000-memory.dmpFilesize
6.9MB
-
memory/1888-1293-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1940-267-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1940-255-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1956-273-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2084-272-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2084-258-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2144-245-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2144-232-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2144-94-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2144-1144-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2144-230-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2144-260-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2144-248-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2144-246-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2144-231-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2144-244-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2144-233-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2144-275-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2144-238-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2216-263-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2216-251-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2336-1295-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2372-1296-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2428-254-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2428-266-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2484-256-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2484-268-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2572-1290-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2584-271-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2592-247-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2592-259-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2656-1299-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2672-265-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2672-253-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/2732-264-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2732-252-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2748-262-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2748-250-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2764-1594-0x000000007161D000-0x0000000071628000-memory.dmpFilesize
44KB
-
memory/2764-1481-0x0000000069AC1000-0x0000000069AC2000-memory.dmpFilesize
4KB
-
memory/2764-1394-0x000000007161D000-0x0000000071628000-memory.dmpFilesize
44KB
-
memory/2784-1294-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2784-1338-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2840-261-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2840-249-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2928-269-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/3008-1586-0x0000000000480000-0x0000000000580000-memory.dmpFilesize
1024KB
-
memory/3008-1352-0x000000007161D000-0x0000000071628000-memory.dmpFilesize
44KB
-
memory/3008-1370-0x0000000000480000-0x0000000000580000-memory.dmpFilesize
1024KB
-
memory/3008-1350-0x000000002FB81000-0x000000002FB82000-memory.dmpFilesize
4KB
-
memory/3008-1573-0x000000007161D000-0x0000000071628000-memory.dmpFilesize
44KB
-
memory/3012-1292-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3040-376-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3040-1043-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3556-26745-0x0000000000400000-0x00000000005DE000-memory.dmpFilesize
1.9MB
-
memory/5416-26739-0x0000000001EA0000-0x0000000001F6E000-memory.dmpFilesize
824KB
-
memory/5416-26740-0x0000000000400000-0x00000000005DE000-memory.dmpFilesize
1.9MB
-
memory/7244-11166-0x00000000011F0000-0x000000000122C000-memory.dmpFilesize
240KB
-
memory/7244-26726-0x0000000004D25000-0x0000000004D5D000-memory.dmpFilesize
224KB
-
memory/7244-26727-0x0000000068780000-0x0000000068E6E000-memory.dmpFilesize
6.9MB
