Analysis
- max time kernel
1188s - max time network
1199s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
08/02/2024, 02:08
Static task
static1
Behavioral task
behavioral1
Sample
independert.msi
Resource
win10-20231215-en
windows10-1703-x64
13 signatures
1200 seconds
Behavioral task
behavioral2
Sample
independert.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
1200 seconds
General
- Target independert.msi
- Size 4.0MB
- Sample240208-ck246aca76
- SHA256 846f339f39e82f358fe5d0985afde119563754c9a8030dc237eac1a963a8bbf4
- MD5 484bea10f5d2a0c4bdfa342e133033c6
- SHA1 6860971d489198df13c64a295999ba3cc7c9c654
- SHA512 ce74de9217edd30ad96e00dea9ac8783284c26f93e7271f45e406880b46dbdcf8d71feafa26881d069b8b20b62e66e4a0fc3ccd428512fa45af319663720f20e
- SSDEEP 49152:bpUPCczdSZ4Yx87nxODZGMFLnd8q67DZQlXvAoxS1mvXpiIg7W:bpSBx7nxOtFjOq67DcO1mh
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect DarkGate stealer 2 IoCs
resource yara_rule behavioral2/memory/3304-110-0x00000000065E0000-0x000000000692E000-memory.dmp family_darkgate_v6 behavioral2/memory/3304-116-0x00000000065E0000-0x000000000692E000-memory.dmp family_darkgate_v6 - Modifies file permissions 1 TTPs 2 IoCs
pid Process 2296 ICACLS.EXE 3716 ICACLS.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{4475B07E-B24B-45AB-9BE0-ED99A7F14744} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\e592c27.msi msiexec.exe File opened for modification C:\Windows\Installer\e592c27.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2E98.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Installer\MSI4AEB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B0B.tmp msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 3860 apdproxy.exe 3304 Autoit3.exe - Loads dropped DLL 6 IoCs
pid Process 4960 MsiExec.exe 3860 apdproxy.exe 3860 apdproxy.exe 3860 apdproxy.exe 3860 apdproxy.exe 4960 MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003462af5746133e160000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003462af570000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003462af57000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3462af57000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003462af5700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4184 msiexec.exe 4184 msiexec.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 4496 msiexec.exe Token: SeIncreaseQuotaPrivilege 4496 msiexec.exe Token: SeSecurityPrivilege 4184 msiexec.exe Token: SeCreateTokenPrivilege 4496 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4496 msiexec.exe Token: SeLockMemoryPrivilege 4496 msiexec.exe Token: SeIncreaseQuotaPrivilege 4496 msiexec.exe Token: SeMachineAccountPrivilege 4496 msiexec.exe Token: SeTcbPrivilege 4496 msiexec.exe Token: SeSecurityPrivilege 4496 msiexec.exe Token: SeTakeOwnershipPrivilege 4496 msiexec.exe Token: SeLoadDriverPrivilege 4496 msiexec.exe Token: SeSystemProfilePrivilege 4496 msiexec.exe Token: SeSystemtimePrivilege 4496 msiexec.exe Token: SeProfSingleProcessPrivilege 4496 msiexec.exe Token: SeIncBasePriorityPrivilege 4496 msiexec.exe Token: SeCreatePagefilePrivilege 4496 msiexec.exe Token: SeCreatePermanentPrivilege 4496 msiexec.exe Token: SeBackupPrivilege 4496 msiexec.exe Token: SeRestorePrivilege 4496 msiexec.exe Token: SeShutdownPrivilege 4496 msiexec.exe Token: SeDebugPrivilege 4496 msiexec.exe Token: SeAuditPrivilege 4496 msiexec.exe Token: SeSystemEnvironmentPrivilege 4496 msiexec.exe Token: SeChangeNotifyPrivilege 4496 msiexec.exe Token: SeRemoteShutdownPrivilege 4496 msiexec.exe Token: SeUndockPrivilege 4496 msiexec.exe Token: SeSyncAgentPrivilege 4496 msiexec.exe Token: SeEnableDelegationPrivilege 4496 msiexec.exe Token: SeManageVolumePrivilege 4496 msiexec.exe Token: SeImpersonatePrivilege 4496 msiexec.exe Token: SeCreateGlobalPrivilege 4496 msiexec.exe Token: SeBackupPrivilege 3452 vssvc.exe Token: SeRestorePrivilege 3452 vssvc.exe Token: SeAuditPrivilege 3452 vssvc.exe Token: SeBackupPrivilege 4184 msiexec.exe Token: SeRestorePrivilege 4184 msiexec.exe Token: SeRestorePrivilege 4184 msiexec.exe Token: SeTakeOwnershipPrivilege 4184 msiexec.exe Token: SeRestorePrivilege 4184 msiexec.exe Token: SeTakeOwnershipPrivilege 4184 msiexec.exe Token: SeRestorePrivilege 4184 msiexec.exe Token: SeTakeOwnershipPrivilege 4184 msiexec.exe Token: SeRestorePrivilege 4184 msiexec.exe Token: SeTakeOwnershipPrivilege 4184 msiexec.exe Token: SeBackupPrivilege 4420 srtasks.exe Token: SeRestorePrivilege 4420 srtasks.exe Token: SeSecurityPrivilege 4420 srtasks.exe Token: SeTakeOwnershipPrivilege 4420 srtasks.exe Token: SeBackupPrivilege 4420 srtasks.exe Token: SeRestorePrivilege 4420 srtasks.exe Token: SeSecurityPrivilege 4420 srtasks.exe Token: SeTakeOwnershipPrivilege 4420 srtasks.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4496 msiexec.exe 4496 msiexec.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4184 wrote to memory of 4420 4184 msiexec.exe 96 PID 4184 wrote to memory of 4420 4184 msiexec.exe 96 PID 4184 wrote to memory of 4960 4184 msiexec.exe 98 PID 4184 wrote to memory of 4960 4184 msiexec.exe 98 PID 4184 wrote to memory of 4960 4184 msiexec.exe 98 PID 4960 wrote to memory of 2296 4960 MsiExec.exe 99 PID 4960 wrote to memory of 2296 4960 MsiExec.exe 99 PID 4960 wrote to memory of 2296 4960 MsiExec.exe 99 PID 4960 wrote to memory of 1448 4960 MsiExec.exe 101 PID 4960 wrote to memory of 1448 4960 MsiExec.exe 101 PID 4960 wrote to memory of 1448 4960 MsiExec.exe 101 PID 4960 wrote to memory of 3860 4960 MsiExec.exe 103 PID 4960 wrote to memory of 3860 4960 MsiExec.exe 103 PID 4960 wrote to memory of 3860 4960 MsiExec.exe 103 PID 3860 wrote to memory of 3304 3860 apdproxy.exe 104 PID 3860 wrote to memory of 3304 3860 apdproxy.exe 104 PID 3860 wrote to memory of 3304 3860 apdproxy.exe 104 PID 4960 wrote to memory of 3716 4960 MsiExec.exe 106 PID 4960 wrote to memory of 3716 4960 MsiExec.exe 106 PID 4960 wrote to memory of 3716 4960 MsiExec.exe 106 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\independert.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4496
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 093C9A968381DD48854ABA39DF6802282⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:2296
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:1448
-
-
C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\apdproxy.exe"C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\apdproxy.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\temp\Autoit3.exe"c:\temp\Autoit3.exe" c:\temp\script.au34⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3304
-
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:3716
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files.cab
- Size 3.7MB
- SHA256 e0a36182df70d6af3289ea7c430874b8281db531c767beab5131f6726f5635a2
- MD5 b5a1995210150c6e9d362e967d83b590
- SHA1 f4642b8b5e125863cea56196b584cefa5861aebd
- SHA512 94ad3c4e539ef8cb50dfb81e4c1ca6ffeb3da18718c40a77b0c160354b7994896b54edc8ec94a552395d7fd529d95bc16e4e5baedd8c91a8fdb8777c85e00901
- SSDEEP 49152:4czdSZ4Yx87nxODZGMFLnd8q67DZQlXvAoxS1mvXpiIg7Wx:JBx7nxOtFjOq67DcO1mhz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\MSVCP71.dll
- Size 488KB
- SHA256 df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
- MD5 561fa2abb31dfa8fab762145f81667c2
- SHA1 c8ccb04eedac821a13fae314a2435192860c72b8
- SHA512 7d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
- SSDEEP 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\MSVCR71.dll
- Size 256KB
- SHA256 69db7cf715da48da66b11172eea92997a4ed10005a9d15de21d47fac8895c0cc
- MD5 4aab2590f065c890a2fcb2e539545621
- SHA1 cd278d30451446fa948178dfe1b7d562651a35a6
- SHA512 5b0568a3ad136230ec05204a81525b06b3d234b28322decc1a2d675847cff7ec64658f32c1accd41f9ca47bd391068d285e35aecaff2ae29b6515d8017de1187
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxN:Ooz83OtIEzW+/m/AyF7N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\apdboot.dll
- Size 256KB
- SHA256 3559a2dfca34d1eb29796f1aae16a406ebc2034c251a901490eaa2ca4cc3c953
- MD5 68894a522dcbd7e11fda3e56cecb1131
- SHA1 a55cb6b810814250878864082d2959d2b1f2eda2
- SHA512 cf8e259d36140f63eff45c30eb2c3a4b303933b365cde4048cbda205c8509cc97e5996688d17fee98f69f9b73291937a3d4a5f14e16ff86444f4d10157913ae5
- SSDEEP 3072:LpUcQxkwZFP/I/rJ340x79joO49zAZ+eE+rJx15cHedfxExHR4b9JiJdJeJaA:9UclwH3I/rl7qOAzAMeEYn1bfuhA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\apdboot.dll
- Size 931KB
- SHA256 e1f5396d6c9e0d82c45fb48c723460709706398078546bca83e123ca9eb4036f
- MD5 7514fa4d5d1162f631ed5fea0884c0f4
- SHA1 a39e56a89b546b1ad55e531e62240586b9489234
- SHA512 5822def0a35098f80cd570f79a848b639681d21eae4c79479e562907c58c42a218ba786df7ab328532dee1e8f6bc3a7da5c1529f17b93d759df328603ec02b32
- SSDEEP 12288:eCwXI/iPKmldxkIR+BCm8LJJKx2jKuIHTMxiXZU:DwMmlPd1LJwx2jK9ZZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\apdproxy.exe
- Size 62KB
- SHA256 a16b93c374e77f98889d7ad7f38b2282dbc5a40511541b9105b1dcf9216c3cf3
- MD5 fc9e59fe8bc4fe05382cff5c8fc59de1
- SHA1 69423bc900644a910936d2c5828348d188e5d750
- SHA512 1d34be70cd701b606873aaf6910ab7fa7a3c4a81e0398d9bdcf8e8aac3dd63ec888c478e45600bf7e34301bec231038e8dccb457e49db8b5ff1c0740b68d072c
- SSDEEP 768:oSGP0wWfldXbYnoHbzrzHKSi90hHVKIYl2PN+iTre/S/Mqnzh9SLiB+L8rhOFPC1:oSGPGSwPPH9Kq0qzXrElX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\msvcp71.dll
- Size 317KB
- SHA256 f7252a8dac60279a6bc214d17c326c8aa7292e4da98de59d133036c3b1f68d72
- MD5 ceab1ccbe89db316be9f4b476534a1fd
- SHA1 8ac0de087bcdb7a6af5fceedec5d91ab2c5fe226
- SHA512 0cbd277feb9a34386098b83717d2712be11f8a19210bad6a2be9dde7b0b3ccdcd422c03eeaba4dd6b5b56506a69a140901fe7d1bc539be2ac6f1f2b63ca08aa3
- SSDEEP 6144:2g7Re4gBl6ZxYPVwUYH9DnxONhNoq7kuXIdKbD:fJzxYPVsBnxO/R7krG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\msvcr71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\msvcr71.dll
- Size 14KB
- SHA256 e299bff65512174da07de95515e5e3dc53868511484d3abe3f4f9eb6a43c1425
- MD5 55b325966718cdc2453545fbc7776151
- SHA1 c204c320788a7a04e3b5f058b08361733b05a48e
- SHA512 1fb5baa85a4bb862da601b9af3a69ba4e6c1efcef843ce4b7af4b864b61da886339bdbf67143e1889b23f6927a963c88fef4d23212c04bc2e84673869c32e1d7
- SSDEEP 384:cuzbPBN3Of6TNVEIHLQh6vrCa96GdIDcIx:cuzbPBJO8NPrjGaM9x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\files\sqlite3.dll
- Size 1.6MB
- SHA256 ef6324f89ee491906dc9d177b78527585b8764a80554be51bb8a3d9873b0a119
- MD5 35d5a969682f0b969679c750f03fc652
- SHA1 bcb91829d0412c7f2621a23763fd9b1aaccd8e68
- SHA512 f53b6a191f64f477ba0ae01d5bea083be8ec88de45d8d04e6be7f18be7c2dcb45446d2e29270052d7950031aada31dce835075a987dfa470635eb44b9b16704b
- SSDEEP 24576:w4nkbEPt+dQdQDmq6lUM+v9GRgKeGMlQcs5R4SQQ8RlNthFpjnG1ZTW/mVPNf:gbXHDmxlsvwe4Mclv+pc5Nf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\msiwrapper.ini
- Size 1KB
- SHA256 98fc65eb0778baf7d27e5e87d034799a7fc24042df9f690a8f0a799ef22a50c9
- MD5 3ea2c46bb40912c0457d82a2c002fffd
- SHA1 7f22e962e1fe5d1efacec801b76915cc488c1550
- SHA512 c0281cec66a9184ff32cad59b4ca20e2d4462203b4a73810102ce79afc2f9111eaddf5d50b3c7ce105a4c760e0edcdf277443e64dad0d2cc2b0bd52456d32054
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MW-73c3e399-1205-4ce6-8e51-af9bb11fb20c\msiwrapper.ini
- Size 1KB
- SHA256 393aad0bfbdc9d239db2a64179b5659dc43266173680da7aebea02af408e499e
- MD5 0d4b4096f73b5c7645d1de1a990c8e67
- SHA1 1f63315986232dec3ba54f3c8d64eb98d24d7b8c
- SHA512 e36fc3ec321461a653069cada3270d0444fe5ff7f2b60d03130db49d34d210e3ed6c9169efd2fe1abbe728a511dd043d47988421536dda89a2de6bc969dbd0ba
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI2E98.tmp
- Size 208KB
- SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
- MD5 d82b3fb861129c5d71f0cd2874f97216
- SHA1 f3fe341d79224126e950d2691d574d147102b18d
- SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
- SSDEEP 3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI2E98.tmp
- Size 45KB
- SHA256 a47e0ad3d43d9bb34483cf4b0891eca9d1abea137678ecbd97f266aa120ce566
- MD5 036ddf6ceae759b238bb486717aeadfe
- SHA1 c971e8d83f6af11369e76aca6e71637262c3442d
- SHA512 9e34b09ffa4ce374766ac30edd1d2936a058a091c1ccd5fbdd869dce81e203b30d3b69f9683f3fec5f648f6ce2546db2f5d6ca1570401dce4a29b3ad18d49982
- SSDEEP 768:VgX2RL4lp07tOJroy4M2quZNcmJ8tzo9U0+hAQ+51PUbgGzdTdQtCg557d0lZtY2:3sp07tOGmmJ8t09USzUsGZTd6d0jtY2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\temp\Autoit3.exe
- Size 872KB
- SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- MD5 c56b5f0201a3b3de53e561fe76912bfd
- SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.0MB
- SHA256 8b3b0a0814ac8fd9978d6a86a428625e8a039f3c13a388889afafae0c6131cb4
- MD5 5531c1313b2c432641e1658123814ab6
- SHA1 78e7a28fe2d9b0374980002836e3cec71cae9963
- SHA512 cf62621b1b879b15dfce0996b210bff0d568c166217dc02a62cf0ebe43688364b3e508ef827a7abc3961cc1fc5236ae4c948fecaed7d6d6527a8faa5675efe2c
- SSDEEP 24576:Ejdmqn+JdoO/vvTLkDWuAFbboB4TW39TsxQt0YqAjt67PmeGoD3l1PUcK:Z
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{57af6234-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{49c66387-a8cf-4840-9df2-475f9c30b5a2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 932e74c747a5470068a56395b3db842aac87af99124d001f4f4c6c7778d93fa2
- MD5 5926a62e49417cc7f2078c1c5fd07187
- SHA1 16f153bec8ea1de15d6fe63922bae0f6b8fc86ce
- SHA512 6b18162bddcf0b6b5efbb996ff52f5cb51c95d561478d1b3214ecf89b791e5a089fdbc74b60d7e7643a6bd2fc4fcc11bb198370bf8a048c44a704d80015d92dc
- SSDEEP 96:FB1N5MZcvKYFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQEJ:b1NiSvb++sVe
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\temp\script.au3
- Size 910KB
- SHA256 c83870e8f4884f6653ad7fe43d43e9ab8d6c8b3c295d10f1f1921acd8f1e42a8
- MD5 5ae10e98b7f01a0433b18c66dd7ff7d3
- SHA1 7043ab94fcd76c9a7afb91e2adae691358796eb5
- SHA512 4c337d91ca76844dbebd186df0a165efea46a0234b8472f7b4fcc9c844917eb7a8449fc3e3e9006e8f5ad3e1df716d19f7dd212cfdf44268caaa3ea72f53aeb8
- SSDEEP 24576:X8RlNthFpjnG1ZTW/mVPN203IB2JRBQ/+g:X+pc5N20g
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\temp\test.txt
- Size 76B
- SHA256 f8b5bfd9bff557bcd6326949ad261e74edc463350a276fb080a250f76284de45
- MD5 af2e30edcb89c0b9ca2bc4ccc519e5b0
- SHA1 c93d528cd43890fef9841708a825b02133a07734
- SHA512 4279afcf1f76d411b766e51ee207b8cb5dc5914c409359387b74ed0fc1f26db134592fdd4030b650e05d7fd7f7d5ffb4c0d5f3e67b548c224fa910b880db35d8
- MD5 SHA1 SHA512