510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79

Resubmissions

19-02-2024 20:13

240219-yzvvaacc51 4

19-02-2024 20:12

240219-yy1n5sch35 6

Analysis

max time kernel
60s
max time network
62s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
19-02-2024 20:12

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

VC_redist.x86.exe
Size

13.2MB
MD5

9882a328c8414274555845fa6b542d1e
SHA1

ab4a97610b127d68c45311deabfbcd8aa7066f4b
SHA256

510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79
SHA512

c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2
SSDEEP

196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

VC_redist.x86.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{46c3b171-c15c-4137-8e1d-67eeb2985b44} = "\"C:\\ProgramData\\Package Cache\\{46c3b171-c15c-4137-8e1d-67eeb2985b44}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

11 2252 msiexec.exe

flow	pid	process
11	2252	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 49 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 27 IoCs

Processes:

msiexec.exeUserOOBEBroker.exe

description	ioc	process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEC9CF65A80B3C2BD.TMP	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Installer\MSI9627.tmp	msiexec.exe
File created	C:\Windows\Installer\e578eea.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI91D1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1DAADFC22BACC413.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE65CDB606857DF90.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD2864BF77505A324.TMP	msiexec.exe
File created	C:\Windows\Installer\e578ed5.msi	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\~DFF0BF6946B16957C3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97AF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0092109D0C8FECA1.TMP	msiexec.exe
File created	C:\Windows\Installer\e578ed4.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF007FF11D42A86DDD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e578ed5.msi	msiexec.exe
File created	C:\Windows\Installer\e578ec3.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{286DC39B-5FB7-4AFF-9DD4-22DB47664CD7}	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File created	C:\Windows\Installer\SourceHash{9C19C103-7DB1-44D1-A039-2C076A633A38}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\~DF93E138FFDB963E56.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e578ec3.msi	msiexec.exe

Executes dropped EXE 2 IoCs

Processes:

VC_redist.x86.exeVC_redist.x86.exe

pid process

2876 VC_redist.x86.exe
4056 VC_redist.x86.exe
Loads dropped DLL 2 IoCs

Processes:

VC_redist.x86.exeVC_redist.x86.exe

pid process

2876 VC_redist.x86.exe
2616 VC_redist.x86.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2876	VC_redist.x86.exe
4056	VC_redist.x86.exe

pid	process
2876	VC_redist.x86.exe
2616	VC_redist.x86.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005f6aff241b0bee480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005f6aff240000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005f6aff24000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5f6aff24000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005f6aff2400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

LogonUI.exemsiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "238"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeVC_redist.x86.exeVC_redist.x86.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\301C91C91BD71D440A93C270A636A383	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\PackageCode = "253FEC3847DED1B40B7E69DC4FADC1D2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{9C19C103-7DB1-44D1-A039-2C076A633A38}v14.38.33135\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.38,bundle\Version = "14.38.33135.0"	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\301C91C91BD71D440A93C270A636A383	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{286DC39B-5FB7-4AFF-9DD4-22DB47664CD7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B93CD6827BF5FFA4D94D22BD7466C47D\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{46c3b171-c15c-4137-8e1d-67eeb2985b44}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\ProductName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.38.33135"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{9C19C103-7DB1-44D1-A039-2C076A633A38}v14.38.33135\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.38,bundle\ = "{46c3b171-c15c-4137-8e1d-67eeb2985b44}"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.38,bundle\Dependents\{46c3b171-c15c-4137-8e1d-67eeb2985b44}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\301C91C91BD71D440A93C270A636A383\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{46c3b171-c15c-4137-8e1d-67eeb2985b44}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.38,bundle\Dependents	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\301C91C91BD71D440A93C270A636A383\VC_Runtime_Additional	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\Version = "237404527"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\SourceList\PackageName = "vc_runtimeAdditional_x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B93CD6827BF5FFA4D94D22BD7466C47D\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B93CD6827BF5FFA4D94D22BD7466C47D\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\Version = "237404527"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\B93CD6827BF5FFA4D94D22BD7466C47D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Version = "14.38.33135"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B93CD6827BF5FFA4D94D22BD7466C47D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.38.33135"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Version = "14.38.33135"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B93CD6827BF5FFA4D94D22BD7466C47D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{286DC39B-5FB7-4AFF-9DD4-22DB47664CD7}v14.38.33135\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\301C91C91BD71D440A93C270A636A383\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.38.33135"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exe

pid process

2252 msiexec.exe
2252 msiexec.exe
2252 msiexec.exe
2252 msiexec.exe
2252 msiexec.exe
2252 msiexec.exe
2252 msiexec.exe
2252 msiexec.exe

pid	process
2252	msiexec.exe
2252	msiexec.exe
2252	msiexec.exe
2252	msiexec.exe
2252	msiexec.exe
2252	msiexec.exe
2252	msiexec.exe
2252	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeVC_redist.x86.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	4712	vssvc.exe
Token: SeRestorePrivilege	4712	vssvc.exe
Token: SeAuditPrivilege	4712	vssvc.exe
Token: SeShutdownPrivilege	4056	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	4056	VC_redist.x86.exe
Token: SeSecurityPrivilege	2252	msiexec.exe
Token: SeCreateTokenPrivilege	4056	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	4056	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	4056	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	4056	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	4056	VC_redist.x86.exe
Token: SeTcbPrivilege	4056	VC_redist.x86.exe
Token: SeSecurityPrivilege	4056	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	4056	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	4056	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	4056	VC_redist.x86.exe
Token: SeSystemtimePrivilege	4056	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	4056	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	4056	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	4056	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	4056	VC_redist.x86.exe
Token: SeBackupPrivilege	4056	VC_redist.x86.exe
Token: SeRestorePrivilege	4056	VC_redist.x86.exe
Token: SeShutdownPrivilege	4056	VC_redist.x86.exe
Token: SeDebugPrivilege	4056	VC_redist.x86.exe
Token: SeAuditPrivilege	4056	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	4056	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	4056	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	4056	VC_redist.x86.exe
Token: SeUndockPrivilege	4056	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	4056	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	4056	VC_redist.x86.exe
Token: SeManageVolumePrivilege	4056	VC_redist.x86.exe
Token: SeImpersonatePrivilege	4056	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	4056	VC_redist.x86.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe
Token: SeTakeOwnershipPrivilege	2252	msiexec.exe
Token: SeRestorePrivilege	2252	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

VC_redist.x86.exe

pid process

2876 VC_redist.x86.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

SystemSettingsAdminFlows.exeLogonUI.exe

pid process

2760 SystemSettingsAdminFlows.exe
1920 LogonUI.exe
1920 LogonUI.exe

pid	process
2876	VC_redist.x86.exe

pid	process
2760	SystemSettingsAdminFlows.exe
1920	LogonUI.exe
1920	LogonUI.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

VC_redist.x86.exeVC_redist.x86.exeVC_redist.x86.exeVC_redist.x86.exeVC_redist.x86.exe

description	pid	process	target process
PID 260 wrote to memory of 2876	260	VC_redist.x86.exe	VC_redist.x86.exe
PID 260 wrote to memory of 2876	260	VC_redist.x86.exe	VC_redist.x86.exe
PID 260 wrote to memory of 2876	260	VC_redist.x86.exe	VC_redist.x86.exe
PID 2876 wrote to memory of 4056	2876	VC_redist.x86.exe	VC_redist.x86.exe
PID 2876 wrote to memory of 4056	2876	VC_redist.x86.exe	VC_redist.x86.exe
PID 2876 wrote to memory of 4056	2876	VC_redist.x86.exe	VC_redist.x86.exe
PID 4056 wrote to memory of 8	4056	VC_redist.x86.exe	VC_redist.x86.exe
PID 4056 wrote to memory of 8	4056	VC_redist.x86.exe	VC_redist.x86.exe
PID 4056 wrote to memory of 8	4056	VC_redist.x86.exe	VC_redist.x86.exe
PID 8 wrote to memory of 2616	8	VC_redist.x86.exe	VC_redist.x86.exe
PID 8 wrote to memory of 2616	8	VC_redist.x86.exe	VC_redist.x86.exe
PID 8 wrote to memory of 2616	8	VC_redist.x86.exe	VC_redist.x86.exe
PID 2616 wrote to memory of 2588	2616	VC_redist.x86.exe	VC_redist.x86.exe
PID 2616 wrote to memory of 2588	2616	VC_redist.x86.exe	VC_redist.x86.exe
PID 2616 wrote to memory of 2588	2616	VC_redist.x86.exe	VC_redist.x86.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VC_redist.x86.exe
"C:\Users\Admin\AppData\Local\Temp\VC_redist.x86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:260

C:\Windows\Temp\{C16CF9DE-CBD4-47AC-B752-CA052BBB8EFC}\.cr\VC_redist.x86.exe
"C:\Windows\Temp\{C16CF9DE-CBD4-47AC-B752-CA052BBB8EFC}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\VC_redist.x86.exe" -burn.filehandle.attached=568 -burn.filehandle.self=564
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\Temp\{A4635A34-E9AB-41DC-A5B5-C27B9D217975}\.be\VC_redist.x86.exe
"C:\Windows\Temp\{A4635A34-E9AB-41DC-A5B5-C27B9D217975}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{2E478347-8C83-4731-BAEE-4ECEA137DB90} {F7955AB1-3404-4BDB-BEA8-B63D585B715F} 2876
3⤵
- Adds Run key to start application
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={46c3b171-c15c-4137-8e1d-67eeb2985b44} -burn.filehandle.self=984 -burn.embedded BurnPipe.{8ACF8D6A-C473-4A1D-8D66-AFD5F1865171} {22C23186-B537-45D3-BA26-CE9F110984F9} 4056
4⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={46c3b171-c15c-4137-8e1d-67eeb2985b44} -burn.filehandle.self=984 -burn.embedded BurnPipe.{8ACF8D6A-C473-4A1D-8D66-AFD5F1865171} {22C23186-B537-45D3-BA26-CE9F110984F9} 4056
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{04B5FACD-FD7A-474D-8E8D-DF3222D87787} {A5E153AF-45B1-411A-A7C8-7AF3EB4EA515} 2616
6⤵
- Modifies registry class
PID:2588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:644

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:988

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1816

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:2784

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:2220

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:2292

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" RenamePC
1⤵
- Suspicious use of SetWindowsHookEx
PID:2760

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1920

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e578ec8.rbs
Filesize
16KB

MD5
849f0cebd6c0e29abc0b3621d4427ffa

SHA1
88e3cc1c75be5160fcd4919c728f49fdfbbd947c

SHA256
0320151bb4910a305619876e3b59dfe9a003d56040fe210d946789b3890a398f

SHA512
44079874b69f543e38b58920f03b4ca2149a633948d2aabe8a69d3634be830d8a9688e700863183a5a53181838a0dd21468a41718b47164e635dd7f4c581534e

Download Submit
C:\Config.Msi\e578ecd.rbs
Filesize
18KB

MD5
e8e0525d1c55db1713de29a5386c815d

SHA1
18c04b2edc8ff6a9618ca80058df09ef1181d47d

SHA256
8ee336823eb12d36f6f124c3f4866ce450667732a9cee8165e6d3a91958fd927

SHA512
de1f606d751c9ce95f7dcd33462994c4bc5f278c1b6966acb3cf9a583b4d5a79c82cffd4bc13deaeda4d1f568483a55d5ab60de30a1dc5845f07b19955d3af56

Download Submit
C:\Config.Msi\e578eda.rbs
Filesize
20KB

MD5
1d1e377b4b97601c98251c9952a9c0e7

SHA1
1126c4dfb62c3e1fdbeff969b3c75bcb69b0a83c

SHA256
784924729e93a4d1e4a6a02d91cc5bd25dbff54e84154163d24a95700a04f9e8

SHA512
fe8bd11012a9898f22667fbd47a45860c709f86effe7d70bc5ac1944a2aaa4977ea442c81c4b0e30aa4a2d709905acda36f955a363c914e5dc18166e0727b689

Download Submit
C:\Config.Msi\e578ee9.rbs
Filesize
19KB

MD5
a369c0fbf51de2b7033cd6b28650115e

SHA1
fbfd98efbd7ff0f8e9e836a915cf68d8d8941094

SHA256
1abae6f9410328cd2b4a543d20d75fd9a2755de80af3fc592a5ff38cd19b1f13

SHA512
43b4821d86b0f62bbd8125430fe57d2e0f0dbc37d687ee84a505b053da0bd57c5be69eee911b27b45790d7d3f3eb1ad8bf33138567f737bcf3de50888f6ddba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-2-19.2012.2220.1.odl
Filesize
706B

MD5
f7fdaecee7f9f673ed5ca1aeeda37fc8

SHA1
ed1c53cd5f948545c6e4653afe8b825d5502a1bf

SHA256
03fc4941cba05f5e539add449e25deebaef9eb967024890663217765dfa34844

SHA512
c94753dfa468f6bf9f7df337722f806da2748f222e5a62b315bcfc2c35a87d0a694b2db116d7c920552f7fa3a63ca82207b68327c8670c9805e91a910044304a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-2-19.2012.2784.1.odl
Filesize
706B

MD5
fa0864bec89a19bcc22bd0737db53032

SHA1
53ccd2a0d7c46b91314c61e832c218dad559def3

SHA256
09548679825617784185abae53d2f1070078dcadd31efcf7710fd3b0354b0b88

SHA512
ece7e2af1a505cc6449898ea52220c4324734d2f316d4a0d7e676d46da7dda577247b1b6f223c67574c5da14902d000db99f4185c7feca4dbf05c4cb1384eeae

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240219201235_000_vcRuntimeMinimum_x86.log
Filesize
2KB

MD5
3be20ecb42c639bf464c7eefe8e66e79

SHA1
d9dba184414502673a77d9eec82ff0d8fa9180dd

SHA256
29b131d76e14184c66212d8cf4046124dc4bf9c158e3f70a8955b1f1ab1ceb1c

SHA512
79a6aedb407012154f465a6c4df95660b9995fab7c1c9ebaff4e16efc3669db334cf0027a10734463e80e657f7880f519408aca2ec85b3effe697f6201788977

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240219201235_001_vcRuntimeAdditional_x86.log
Filesize
4KB

MD5
262296d30149d5c27845a817926b075e

SHA1
dd7c21b4a28445c057b8d6537f8570a0da8954ef

SHA256
be587f3902a3e17a0a7315a79d5ddab7afb1cc378745d00349e8a3c0d6840ad1

SHA512
99fff134fb246b170d3e6746dfa3d1cc577579a7cd1a664a6ac7f0ebbe8a2cfd4085adfa11857c8d8c183a3db0f78c32963219286503d6151007f84ddeba1e0a

Download Submit
C:\Windows\Temp\{A4635A34-E9AB-41DC-A5B5-C27B9D217975}\.ba\logo.png
Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{A4635A34-E9AB-41DC-A5B5-C27B9D217975}\.ba\wixstdba.dll
Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{A4635A34-E9AB-41DC-A5B5-C27B9D217975}\cab54A5CABBE7274D8A22EB58060AAB7623
Filesize
814KB

MD5
a57efc0afffdf914cbc76bb882cad37e

SHA1
732dbef27c49c27d9f1c00eba177eabc21650fb8

SHA256
c384da7cc6ead2ce054a67fded26d7e4cff2f981a83c64de62e53864665e5f45

SHA512
ad2cfc0fd199fe2726fd18c0a5972185e8331fe49807ca6340212901dd61d30853e2c72015ee9bac0425e287ef488190a245676173194fafbf8f6fc7fbf9baba

Download Submit
C:\Windows\Temp\{A4635A34-E9AB-41DC-A5B5-C27B9D217975}\cabB3E1576D1FEFBB979E13B1A5379E0B16
Filesize
4.9MB

MD5
4a17e4da145fa1ea92a52266221ad628

SHA1
f6304de9d73609f6b9717d6a4d44efd7ab7ffe9e

SHA256
9544abbd46b39bec491cf63076fb109306e519f303df9cd583a28956172bf038

SHA512
de9a6a1391070a9470f78208ff74120cffd2a1e2580af4add87914ba6dd27e07b092e66caa847726e05eb5fae0c1252681de37f34b560d4d95f3b76f3599e16c

Download Submit
C:\Windows\Temp\{A4635A34-E9AB-41DC-A5B5-C27B9D217975}\vcRuntimeAdditional_x86
Filesize
180KB

MD5
a37983d3fca236d6ae2d22ab0fa9f1d4

SHA1
82f77032813aeddf321d681da4e1aa50786258dd

SHA256
a7f13351ce5b41fcf6c2ed95f223f5e2aab5411bf8499a772f69ad8ffb87f96b

SHA512
619467e6d4aa6bc8f1cc02daf52330e28c313d774a1d0b0bb96d40a2ed2dc3697cee738463faed040e1bca407c3471ae1bc8dd91472682b25c579caacdbf7374

Download Submit
C:\Windows\Temp\{A4635A34-E9AB-41DC-A5B5-C27B9D217975}\vcRuntimeMinimum_x86
Filesize
180KB

MD5
3ca6b74aefe34587f479055f5915e136

SHA1
61771e0a8ccabac8783a22f67adcbce612f11704

SHA256
a6f3a8e4e2162d8df176418e9a238becb645b2db31d8073bfc4f4cdb7fb1aa22

SHA512
3949cb3fdad3e8d5e9c649141a72783e0b403d3e835433d4d456654bcdad1290258f6d023ce127740f9c82459d337b9f8731c799efcf99775955d38cf3fef750

Download Submit
C:\Windows\Temp\{C16CF9DE-CBD4-47AC-B752-CA052BBB8EFC}\.cr\VC_redist.x86.exe
Filesize
634KB

MD5
7bd0b2d204d75012d3a9a9ce107c379e

SHA1
41edd6321965d48e11ecded3852eb32e3c13848d

SHA256
d4c6f5c74bbb45c4f33d9cb7ddce47226ea0a5ab90b8ff3f420b63a55c3f6dd2

SHA512
d85ac030ebb3ba4412e69b5693406fe87e46696ca2a926ef75b6f6438e16b0c7ed1342363098530cdceb4db8e50614f33f972f7995e4222313fcef036887d0f0

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads