zgrat | cdb8b8b1134a657a1fef24640d2e11005cf81c370380cff8634b2a7da776cea4

Analysis

max time kernel
131s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8953bbaa868dd7f66a3a7e73da80585.exe
Size 61KB
Sample240222-1c14wsff95
SHA256 cdb8b8b1134a657a1fef24640d2e11005cf81c370380cff8634b2a7da776cea4
MD5 a8953bbaa868dd7f66a3a7e73da80585
SHA1 775fb754dcc83e0ae397862d5d84060e40859d69
SHA512 24c8f584413170e96af5235ee867410c40e609ec288f12e6fa80632e7893d30a1a21878ac37f5e79775e20e58276c6d0f06e3127626c2b6edd3f15503a81d142
SSDEEP 768:rlK8yVL66zg/23bhSyk2gPN2e9cF7ojZ4RQrxY2nNKXCTs1gL8:rlKhJ69/dyk32eW6SQi2NKz1U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 7 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023121-9.dat	family_zgrat_v1
behavioral2/files/0x0007000000023121-14.dat	family_zgrat_v1
behavioral2/files/0x0007000000023121-22.dat	family_zgrat_v1
behavioral2/files/0x0007000000023125-158.dat	family_zgrat_v1
behavioral2/files/0x0007000000023125-157.dat	family_zgrat_v1
behavioral2/memory/4428-159-0x0000000000EB0000-0x0000000001248000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0007000000023153-246.dat	family_zgrat_v1

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	468	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	468	schtasks.exe	96

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	a8953bbaa868dd7f66a3a7e73da80585.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	WindowsMD5Checker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	agentreviewIntoRefdhcp.exe

Executes dropped EXE 4 IoCs

pid	Process
1788	WindowsMD5Checker.exe
3112	SandelloChecker.exe
4428	agentreviewIntoRefdhcp.exe
1552	System.exe

Loads dropped DLL 16 IoCs

pid	Process
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Telegramm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsMD5Checker.exe"	a8953bbaa868dd7f66a3a7e73da80585.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SandelloChecker.exe
File opened (read-only)	\??\V:	SandelloChecker.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	SandelloChecker.exe
File opened (read-only)	\??\S:	SandelloChecker.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	SandelloChecker.exe
File opened (read-only)	\??\I:	SandelloChecker.exe
File opened (read-only)	\??\K:	SandelloChecker.exe
File opened (read-only)	\??\R:	SandelloChecker.exe
File opened (read-only)	\??\U:	SandelloChecker.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	SandelloChecker.exe
File opened (read-only)	\??\O:	SandelloChecker.exe
File opened (read-only)	\??\Q:	SandelloChecker.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	SandelloChecker.exe
File opened (read-only)	\??\L:	SandelloChecker.exe
File opened (read-only)	\??\Z:	SandelloChecker.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	SandelloChecker.exe
File opened (read-only)	\??\N:	SandelloChecker.exe
File opened (read-only)	\??\P:	SandelloChecker.exe
File opened (read-only)	\??\Y:	SandelloChecker.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	SandelloChecker.exe
File opened (read-only)	\??\W:	SandelloChecker.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	SandelloChecker.exe
File opened (read-only)	\??\X:	SandelloChecker.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe	agentreviewIntoRefdhcp.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe	agentreviewIntoRefdhcp.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\088424020bedd6	agentreviewIntoRefdhcp.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\services.exe	agentreviewIntoRefdhcp.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\c5b4cb5e9653cc	agentreviewIntoRefdhcp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CbsTemp\System.exe	agentreviewIntoRefdhcp.exe
File created	C:\Windows\CbsTemp\27d1bcfc3c54e0	agentreviewIntoRefdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4000	schtasks.exe
3276	schtasks.exe
3668	schtasks.exe
2480	schtasks.exe
3804	schtasks.exe
400	schtasks.exe
2440	schtasks.exe
2336	schtasks.exe
1684	schtasks.exe
3636	schtasks.exe
904	schtasks.exe
4736	schtasks.exe
4288	schtasks.exe
3848	schtasks.exe
2948	schtasks.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\Colors	SandelloChecker.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000_Classes\Local Settings	WindowsMD5Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000_Classes\Local Settings	agentreviewIntoRefdhcp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3252	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe
4428	agentreviewIntoRefdhcp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2280	a8953bbaa868dd7f66a3a7e73da80585.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3112	SandelloChecker.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3368	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	87
PID 2280 wrote to memory of 3368	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	87
PID 2280 wrote to memory of 3368	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	87
PID 2280 wrote to memory of 4364	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	88
PID 2280 wrote to memory of 4364	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	88
PID 2280 wrote to memory of 4364	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	88
PID 2280 wrote to memory of 1788	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	89
PID 2280 wrote to memory of 1788	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	89
PID 2280 wrote to memory of 1788	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	89
PID 2280 wrote to memory of 3112	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	90
PID 2280 wrote to memory of 3112	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	90
PID 2280 wrote to memory of 3112	2280	a8953bbaa868dd7f66a3a7e73da80585.exe	90
PID 1788 wrote to memory of 3184	1788	WindowsMD5Checker.exe	91
PID 1788 wrote to memory of 3184	1788	WindowsMD5Checker.exe	91
PID 1788 wrote to memory of 3184	1788	WindowsMD5Checker.exe	91
PID 3820 wrote to memory of 1572	3820	msiexec.exe	94
PID 3820 wrote to memory of 1572	3820	msiexec.exe	94
PID 3820 wrote to memory of 1572	3820	msiexec.exe	94
PID 3184 wrote to memory of 2168	3184	WScript.exe	97
PID 3184 wrote to memory of 2168	3184	WScript.exe	97
PID 3184 wrote to memory of 2168	3184	WScript.exe	97
PID 2168 wrote to memory of 4428	2168	cmd.exe	99
PID 2168 wrote to memory of 4428	2168	cmd.exe	99
PID 4428 wrote to memory of 4796	4428	agentreviewIntoRefdhcp.exe	116
PID 4428 wrote to memory of 4796	4428	agentreviewIntoRefdhcp.exe	116
PID 4796 wrote to memory of 3132	4796	cmd.exe	118
PID 4796 wrote to memory of 3132	4796	cmd.exe	118
PID 4796 wrote to memory of 3252	4796	cmd.exe	119
PID 4796 wrote to memory of 3252	4796	cmd.exe	119
PID 4796 wrote to memory of 1552	4796	cmd.exe	121
PID 4796 wrote to memory of 1552	4796	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a8953bbaa868dd7f66a3a7e73da80585.exe
"C:\Users\Admin\AppData\Local\Temp\a8953bbaa868dd7f66a3a7e73da80585.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MpCmdRun.exe -AddExclusion -FileName C:\Users\Admin\AppData\Local\Temp\\WindowsMD5Checker.exe
  2⤵
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MpCmdRun.exe -AddExclusion -FileName C:\Users\Admin\AppData\Local\Temp\\SandelloChecker.exe
  2⤵
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\WindowsMD5Checker.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsMD5Checker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\MsWebSession\aISwmBA1tz2Li9c6LCYbI0c56v7tmGzpAA7ZdNSGvv0YyEqFbmxvfE9xX.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\MsWebSession\28GBsRQl2u5EqD0HGx7YGeYZyO2za9W9ftVvHiRGielbEoVm.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\MsWebSession\agentreviewIntoRefdhcp.exe
        
        "C:\MsWebSession/agentreviewIntoRefdhcp.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4428
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HCyNVv4gv8.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3132
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:3252
        
        C:\Windows\CbsTemp\System.exe
        
        "C:\Windows\CbsTemp\System.exe"
        7⤵
        Executes dropped EXE
        
        PID:1552
- C:\Users\Admin\AppData\Local\Temp\SandelloChecker.exe
  "C:\Users\Admin\AppData\Local\Temp\SandelloChecker.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies Control Panel
  - Suspicious use of FindShellTrayWindow
  PID:3112

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B74971BD1C669B2AE48A9376CA4E86DC C
  2⤵
  - Loads dropped DLL
  PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\MsWebSession\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\MsWebSession\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\MsWebSession\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\CbsTemp\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\CbsTemp\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

28GBsRQl2u5EqD0HGx7YGeYZyO2za9W9ftVvHiRGielbEoVm.bat

Path C:\MsWebSession\28GBsRQl2u5EqD0HGx7YGeYZyO2za9W9ftVvHiRGielbEoVm.bat
Size 95B
SHA256 102e9e1f76065e7c6207880bdcdba7cad4aebb61e2644ac80f76ed1a2ca92b1b
MD5 d7fa26c8b1aa0d91d5c3682c87970269
SHA1 9934cb04ec5d81e86519c36c38d9e7caf5c01a1d
SHA512 71d72daaab45e8198d375a6fdf78bb7b3173c757cb2b6e349bbe516a67461b8ddb183ab028579f80c44392bba46a00b82f66bc5f01da4297af2a222be7ac5117
MD5 SHA1 SHA512

Submit Download

aISwmBA1tz2Li9c6LCYbI0c56v7tmGzpAA7ZdNSGvv0YyEqFbmxvfE9xX.vbe

Path C:\MsWebSession\aISwmBA1tz2Li9c6LCYbI0c56v7tmGzpAA7ZdNSGvv0YyEqFbmxvfE9xX.vbe
Size 250B
SHA256 fee3cc05c5cd12982240bd1e83cf2362871ab9b656fd807928387ddb67e831f7
MD5 472b891861c2851f23fc56f0da9834f0
SHA1 1938881b09e054a23c46369d850f92c52a9b1164
SHA512 77850c8c9d95733ff9128a9e19f87be4b64ee450ed4aa27be4dcaceded74c0ec8c05d57d8c78249c30ad8cdfcd96a9eeae51e587adef1ad38cd24a0125cbb129
MD5 SHA1 SHA512

Submit Download

agentreviewIntoRefdhcp.exe

Path C:\MsWebSession\agentreviewIntoRefdhcp.exe
Size 576KB
SHA256 5b6486e3c8b4f1795fbac3a17e2e42dfc4d413ac143d416e23a6d723d7209cf1
MD5 35dc1ce01378b73631c59d84664f691b
SHA1 caba3a78786ecca834696b0714416956796ec67b
SHA512 a527438ec23ac781a101e1917fcbaee0725e7575fb9ff775d5d88523ad812a63e1c3fa34a1bd84ef888b34b04cafec62ebbc72e0f5e53f2ec1328375e6278fe3
SSDEEP 6144:klDyDsu6jt7/bEuu9L4t7l/uLk46vu/VTQ3k8Leg2D42c28XQWl3eldsQz:iu4PVHJl/uLk46mtD4f2ilAbsQz
MD5 SHA1 SHA512 SSDEEP

Submit Download

agentreviewIntoRefdhcp.exe

Path C:\MsWebSession\agentreviewIntoRefdhcp.exe
Size 1.7MB
SHA256 b1a40cf47142dfd12ffe7face6558059a2f732a0d662d5b7ca5857f265b7d0b2
MD5 88553b0010d2c27dadb8a31feddc6beb
SHA1 cc0246d84a68cacd852a3804f5cb2b47b6f2f3f2
SHA512 3d3ee30add22351332c7d2cf005af1779c9830a664509e893e66f1206ad7501bdd50a9f4249cabcb5e45c715663ba9f7fd75accb800b448b2466bc04875337bc
SSDEEP 24576:x4NHJB4lTzYu9HNxZX6GoTBABGDCYrfztMrrp2ZOm9ao9XNgfwzN94qQ2GdLwcqj:CW1X6BWkOYXz19tXN1zNOqeRvycGRr
MD5 SHA1 SHA512 SSDEEP

Submit Download

services.exe

Path C:\Recovery\WindowsRE\services.exe
Size 3.6MB
SHA256 3ed028c17d0038c69998ad942feb78aff2f9f363bae2203250b0eba6ce0d26be
MD5 1e8b556d7c4cefe0023e5ba9b6d021e5
SHA1 1f2dd53b352fd7b5972b38d1a5eeb2aec378b9e5
SHA512 788395a9013db192ff4054fc766aef4f55335c5816d0b5fa57d3019f7254aea32e194790930bc8255e05e80e9e9d5e2a77d0dfb45aac142c6f65edb9ae6061c0
SSDEEP 98304:CYX6sYD1rXzznYLGRk3/ZuPqInTeNlZD6jdKkb8:Ckdq1rIH3/OnaJu
MD5 SHA1 SHA512 SSDEEP

Submit Download

buttonimgs.xaml

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3112\buttonimgs.xaml
Size 351B
SHA256 18573b641fd232ce9506dfbb4a15f7871b73bf3499f6a6b5734c2bc152852c94
MD5 118f4c63590056978ac5065ecd4337b7
SHA1 3c8b555894deb0e0f3872ab6badb75d73a837ff5
SHA512 3a6ca3bd174b88dd0bb1b2b160a78e46a2ffe3e52228d48683493e74881419f63bf9c7fbd4a8a754583fb77ef97d77d04136bb9c7c6eecd76a143ac5016fc982
MD5 SHA1 SHA512

Submit Download

HCyNVv4gv8.bat

Path C:\Users\Admin\AppData\Local\Temp\HCyNVv4gv8.bat
Size 157B
SHA256 b2998479c535653dff9ecf1cd3237568dfa06498cb792036e115f1a6af9344ec
MD5 c0aaea9d1c00d02b1338de70cca0c270
SHA1 47921c434d2e6ab331990b7b270de1f2623a9cb4
SHA512 833be16776a4dfed662d33e70c2bb3e30c91909d8735f17ab061e2eb7fb960cd18ff3498e06be6f8b0749ebed1d6cf7dcb07c7af58c48e3ac4813e773c1a2a37
MD5 SHA1 SHA512

Submit Download

MSI56F7.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI56F7.tmp
Size 587KB
SHA256 42b8adafcb4e8496d9822a0c504f449e56456528a9251c153381d3f63d197e5b
MD5 9e0aef52f6c03b2fea067342d9d4f22f
SHA1 d4431a858c8a7a79315829ec7aa82e838c2714f4
SHA512 42858a6695d7906b3df4dc97f3b1fac737633a51ffb52e8ec8eddeb21f8cdb53c199bb698e54c4a931155eafd879de6fff114b84f298c84436b776e286ebeeb1
SSDEEP 12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI5E6C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5E6C.tmp
Size 1.1MB
SHA256 3c21e1f3bb3ebeb5f0ff68658db8abd18b62f8b195288c4bf87936fc51f8ae9e
MD5 c04ed00ddcb3518e8cf6db24db294a50
SHA1 cc98cc3ab9c4371f85ea227d9f761bab4aa76baa
SHA512 736946a3130f294878ea51145960017babcc1b8ac2c96afd8b9e2a4d120f173afb84bbd04b6f0113f286d4bc671befecd4e92c582f1de1a0d5bc8738c3cae9c5
SSDEEP 24576:96KyJqotyEbjgE3pr9CxKoibHCMm7HH4d5+u+Tx5KzEKrbsUT1wZS:d+qotJCxKoibHCNbH4d5+u+Tx5KzEKrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6718.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6718.tmp
Size 709KB
SHA256 ad706739b04256b9215e80d2d030863a37f0d7fd0e4071d0a3a73d6704d8bd8f
MD5 eb7811666ac7be6477e23af68511424f
SHA1 1623579c5a3710dcc694a2fd49defa27d56d9175
SHA512 3055baa15c92f476513c66a423043dc4b8c5f83f47643ad77665d6a2f823f4655bf4ae241d8af4bc34d53630df1c35989f0b11b934a631960668fcc7a8c81a7b
SSDEEP 12288:jn6hflHZVr6xVYUiONE4i1uDiSNrETsc4UYK/DAt5c1+vn2eFzLT:mUTxipSxETsNV35c8vn2mzLT
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6AD4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6AD4.tmp
Size 490KB
SHA256 d616c02fb7ba7346ead2a8a7d2e7fbdc7c1a546f9b627aa48cfef6515bc4bac1
MD5 73b05c93aba8fb4a5ab29e52f02eaa06
SHA1 633d4542cb59e1e61e3f569515d39614a6bb8ee5
SHA512 7e896b2779eaad9017a8303c7ff8c4e88fcda2399397d3d5e5e8904e942097c79e484610cdab5b9540cb8b378d172cd37ee69579a1922a64788cd000f97b7c43
SSDEEP 6144:q+zdBX82ovcCBTkMAEaeK1p66UlK5Py3nINAO6Y:q+zdBoU6TPAjp66Ulgc2z
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6B04.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6B04.tmp
Size 313KB
SHA256 5fbe5929859f72bab4009b643ef5b03c796b7e378ba14c2720cc7b4b60bd36e9
MD5 fbfffb63a48e71d82637a7a9df1d31cb
SHA1 190e214bcf79cd6ea18065902954133c020f9216
SHA512 e80edcc2812f54f5234d9cb56c6c8c7ae2ed45a81b4cd4e5b6ee8f7b6e75d40b5cebdb5ad265d516cb06f6fcd0ae6929b6db0bc449118f2a40b219cc4690985c
SSDEEP 3072:qLyzcEFBd6lyZdNxI2RG9nvlLEcKt8PECBTEs24yYzrEvMAl6aeKfkqp64RU+uVo:q+zdBX82ovcCBTkMAEaeK1p66UlKn
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6B04.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6B04.tmp
Size 218KB
SHA256 5440f3503bba1ac98e7a518df2366f613ea7806851dfa912392b1b8ed086055e
MD5 f1e2b1072df5ced69912d90f820bce08
SHA1 850684c4b143951241268b8810f7b221098ef839
SHA512 a2290e9879ada54777bf322121c122b05b3c71eeef7bfebae184b3ade6cde315c5e4fd8a45c90213aed3f1ab5c7b41a47a4ef4e0b98ad9c92754fd5ceb7505e1
SSDEEP 3072:qLyzcEFBd6lyZdNxI2RG9nvlLEcKt8PECBTEs24yYzrEvMAl6ae1:q+zdBX82ovcCBTkMAEae1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6BA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6BA1.tmp
Size 40KB
SHA256 637d0908491c0f984f44e33449bb1813f9accb101f2ca3d34e0754ba920f8518
MD5 1884b7b740b1bae57d29936f610b6405
SHA1 0bc30ebe5ee5d8c7c40eaa9e9fb010d95887fbed
SHA512 48dcbbfbc1ae8ddbf49d7780aa608f3b103a0055c342c9b40aabe4ab3e655b4b032135145dcb5a45045e6ae734b48340b8b70d345388f8a6c62dcd9e1fbfc009
SSDEEP 384:N8njRsqwRFewRgSrhC4CHlIzBHYvguDwGMmGJqVdjbWBIRCBcbd5OXi/H2pWkIxO:0VJ5/SHLUTyznPj5KNMuMOkilv2kQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandelloChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\SandelloChecker.exe
Size 10KB
SHA256 e6d86042d9c64c6cdbce2de187ee84b3db2fbaf54ea15200585f9a871094af30
MD5 1909b34f75bbc9e15ff2055e969a28ff
SHA1 4966e40143d6b7395c1152377ca77bc12b2c37ae
SHA512 ce734eb3f7f40eaa5fca145b6dd7b1712a6b2334dd358fdc5004a628d448c0423f4d42c5aadccaaa780650a33d0a9d5ae0ea456cac910c55cdb9871a94b785cd
SSDEEP 192:urt4iw7Ap7sBpTuL4+1ljtJABg5+NLt2ygcv5b5E7eAeO2RcRIz8CCRn5joHrDkm:44iw7Ap7sBpTuLt1ljtS65+NLt2yjv5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandelloChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\SandelloChecker.exe
Size 1.8MB
SHA256 2062047006e1f2e3f14a14d7f7cb119389494fbce7fe28ff57abdab4782c93dd
MD5 0a5e840f2c5a81b5fe516768ca6cc9f5
SHA1 099b91e0a844c4d091e2045f56c9370c1da56cf3
SHA512 6d450206bf1e0b5fb3ed64a0f769a0887a51c47a6c9c524a039a54fdd1bf2669e890856813458bb9889ccd4aab6e82903351118585dbf885f45e3024fa2a6a0f
SSDEEP 24576:njltHUbDcVy/oOaZJfA+fSEn0gNElJgB0v7v2EW3nXq4C+MU0:nTHvLOaHtf9n0gIJg4W3Xq5+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandelloChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\SandelloChecker.exe
Size 1.3MB
SHA256 9904651c57d37cf2aafbb4effb1ae9dddd7117a076ece229ca0d242fa80a45c3
MD5 0822b946b39b27f6f46d888c4d5709b9
SHA1 d69d398db286dda1edbab52c72b3aefaed71b85f
SHA512 72316ebb0bb1a6d75a4d563810ee13faa9e4c613243317f99ed9f2814beed12a9ebfe45bcda1edcbd797bb43f5b2e19d6279fc5758d5d56b0c359427be92f162
SSDEEP 24576:njltHUbDcVy/oOaZJfA+fSEn0gNElJgB0v7v2g:nTHvLOaHtf9n0gIJgM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsMD5Checker.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsMD5Checker.exe
Size 360KB
SHA256 20779910fbe37d1deabafdea29e909ee2f982bce4aed6d5c41dea70b84d578f3
MD5 d601fe412f3e93bbfecf55e648d4c14c
SHA1 963d741c415d963e2a5cab4c0e9c03a5cd699e99
SHA512 c1af3a1456ceafdd0dd98475d0b4c18701c54b2ae30355f5ae168cc4bfafbbf53208efd9aa5018b9669ba8ad03b0523b029441396bb239610088a48d3d61f2b7
SSDEEP 6144:2TouKrWBEu3/Z2lpGDHU3ykJotX+t41/uQ:2ToPWBv/cpGrU3yVtX+t4Vp
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsMD5Checker.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsMD5Checker.exe
Size 2.5MB
SHA256 2754cf14b4d82e1282e1dba09eeb0ccd6a4bc0777c6c35863029219ca096b1fb
MD5 15b26fcb98ef9e596cefdc7a52b279e1
SHA1 65ef00ae73a624098e2f017c21ebe34611665097
SHA512 fc7c5cff005553970c1842fb83d6524c57dcc701eccca601ec0a8817c48a03cd6a904e6f63bfaaea1091eea3a3d7720d117612bd428a148432895a81c8c93fc1
SSDEEP 49152:IBJQW1X6BWkOYXz19tXN1zNOqeRvycGRk3h9ZYFRPqIS3:yOYX6sYD1rXzznYLGRk3/ZuPqIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsMD5Checker.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsMD5Checker.exe
Size 2.6MB
SHA256 4acbc196c12705e6441f507e32a401562f89ff969725f4edc99f632c1f1579b6
MD5 de881e4deaaa9d5f43798573d705e043
SHA1 def2a3a228a96a0e715c3e83279c6c7a5f5704f6
SHA512 fbd7102ebf290ed25dab3a3b48077eff5a4f67fe84744c63b55373f92d03368f7969769b24329adf02751b8fa1180fe2950eeadc3b7f240954f971ded0547d89
SSDEEP 49152:IBJQW1X6BWkOYXz19tXN1zNOqeRvycGRk3h9ZYFRPqISav:yOYX6sYD1rXzznYLGRk3/ZuPqInv
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandeLLoCHECKER_Installer.msi

Path C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\install\51B5780\SandeLLoCHECKER_Installer.msi
Size 64KB
SHA256 2d30d83d180fcd25e4071f72fd5de313f09644679365c0ede1dd711f2e6c06b5
MD5 6ecf95b9807e7759334dfbb7a0c38131
SHA1 0b4cb41ecbf1b1a2c950668a6e149aeaf7e21c20
SHA512 02fd5e3ef6db7d72f61320d6a120af1cbfd323cb2af6a697e27487f348b01a6494cfe19ed91eef2de738415f4b2a5019bae4b78ba342455da0ff43f6af7a101f
SSDEEP 768:Pa/48fSpsQ63XCw6ZKon0SpjikI8alwDdBwc0IAgnIvmRzlRj0Eh:+4FWn8PdimalwDdBwcrAgIuRpRjTh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2280-0-0x0000000000850000-0x000000000085F000-memory.dmp

Download

memory/4428-189-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Download

memory/4428-198-0x00007FF907D10000-0x00007FF907D11000-memory.dmp

Download

memory/4428-163-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Download

memory/4428-164-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Download

memory/4428-167-0x000000001BE70000-0x000000001BE96000-memory.dmp

Download

memory/4428-168-0x00007FF907D90000-0x00007FF907D91000-memory.dmp

Download

memory/4428-165-0x00007FF907DA0000-0x00007FF907E5E000-memory.dmp

Download

memory/4428-169-0x00007FF907DA0000-0x00007FF907E5E000-memory.dmp

Download

memory/4428-171-0x0000000003360000-0x000000000336E000-memory.dmp

Download

memory/4428-172-0x00007FF907D80000-0x00007FF907D81000-memory.dmp

Download

memory/4428-174-0x000000001BEA0000-0x000000001BEBC000-memory.dmp

Download

memory/4428-175-0x00007FF907D70000-0x00007FF907D71000-memory.dmp

Download

memory/4428-176-0x000000001D200000-0x000000001D250000-memory.dmp

Download

memory/4428-178-0x0000000003370000-0x0000000003380000-memory.dmp

Download

memory/4428-179-0x00007FF8EAA50000-0x00007FF8EB511000-memory.dmp

Download

memory/4428-180-0x00007FF907D60000-0x00007FF907D61000-memory.dmp

Download

memory/4428-183-0x000000001D1B0000-0x000000001D1C8000-memory.dmp

Download

memory/4428-181-0x00007FF907D50000-0x00007FF907D51000-memory.dmp

Download

memory/4428-186-0x0000000003380000-0x0000000003390000-memory.dmp

Download

memory/4428-184-0x00007FF907D40000-0x00007FF907D41000-memory.dmp

Download

memory/4428-161-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Download

memory/4428-188-0x000000001BEC0000-0x000000001BED0000-memory.dmp

Download

memory/4428-190-0x00007FF907D30000-0x00007FF907D31000-memory.dmp

Download

memory/4428-193-0x000000001BED0000-0x000000001BEDE000-memory.dmp

Download

memory/4428-192-0x00007FF907D20000-0x00007FF907D21000-memory.dmp

Download

memory/4428-196-0x000000001D250000-0x000000001D262000-memory.dmp

Download

memory/4428-197-0x00007FF907DA0000-0x00007FF907E5E000-memory.dmp

Download

memory/4428-194-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Download

memory/4428-201-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Download

memory/4428-200-0x000000001BEE0000-0x000000001BEEC000-memory.dmp

Download

memory/4428-202-0x00007FF907D00000-0x00007FF907D01000-memory.dmp

Download

memory/4428-162-0x00000000019E0000-0x00000000019E1000-memory.dmp

Download

memory/4428-204-0x000000001D1D0000-0x000000001D1E0000-memory.dmp

Download

memory/4428-205-0x00007FF907DA0000-0x00007FF907E5E000-memory.dmp

Download

memory/4428-206-0x00007FF907CF0000-0x00007FF907CF1000-memory.dmp

Download

memory/4428-209-0x000000001D270000-0x000000001D286000-memory.dmp

Download

memory/4428-207-0x00007FF907CE0000-0x00007FF907CE1000-memory.dmp

Download

memory/4428-211-0x000000001D290000-0x000000001D2A2000-memory.dmp

Download

memory/4428-212-0x00007FF907CD0000-0x00007FF907CD1000-memory.dmp

Download

memory/4428-213-0x000000001D7E0000-0x000000001DD08000-memory.dmp

Download

memory/4428-216-0x000000001D1E0000-0x000000001D1EE000-memory.dmp

Download

memory/4428-214-0x00007FF907CC0000-0x00007FF907CC1000-memory.dmp

Download

memory/4428-218-0x000000001D1F0000-0x000000001D200000-memory.dmp

Download

memory/4428-219-0x00007FF907CB0000-0x00007FF907CB1000-memory.dmp

Download

memory/4428-222-0x00007FF907CA0000-0x00007FF907CA1000-memory.dmp

Download

memory/4428-221-0x000000001D2B0000-0x000000001D2C0000-memory.dmp

Download

memory/4428-224-0x000000001D320000-0x000000001D37A000-memory.dmp

Download

memory/4428-225-0x00007FF907C90000-0x00007FF907C91000-memory.dmp

Download

memory/4428-228-0x000000001D2C0000-0x000000001D2CE000-memory.dmp

Download

memory/4428-226-0x00007FF907C80000-0x00007FF907C81000-memory.dmp

Download

memory/4428-231-0x000000001D2D0000-0x000000001D2E0000-memory.dmp

Download

memory/4428-229-0x00007FF907C70000-0x00007FF907C71000-memory.dmp

Download

memory/4428-234-0x000000001D2E0000-0x000000001D2EE000-memory.dmp

Download

memory/4428-232-0x00007FF907C60000-0x00007FF907C61000-memory.dmp

Download

memory/4428-236-0x000000001D580000-0x000000001D598000-memory.dmp

Download

memory/4428-237-0x00007FF907C50000-0x00007FF907C51000-memory.dmp

Download

memory/4428-238-0x00007FF907C40000-0x00007FF907C41000-memory.dmp

Download

memory/4428-240-0x000000001D2F0000-0x000000001D2FC000-memory.dmp

Download

memory/4428-243-0x000000001D5F0000-0x000000001D63E000-memory.dmp

Download

memory/4428-241-0x00007FF907C30000-0x00007FF907C31000-memory.dmp

Download

memory/4428-160-0x00007FF8EAA50000-0x00007FF8EB511000-memory.dmp

Download

memory/4428-259-0x00007FF907DA0000-0x00007FF907E5E000-memory.dmp

Download

memory/4428-159-0x0000000000EB0000-0x0000000001248000-memory.dmp

Download