c7b8db12c4af4ed1da49b99a0fb2579bc92c625a17766a08bb2ae297ca6f55e2

Analysis

max time kernel
86s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
25/02/2024, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lova_sosa.zip
Size

747KB
MD5

00b2e4360f871e4a975da239a03ee439
SHA1

4ff409e42c3596e40a1ffc53d1b1c5e36959b4a2
SHA256

c7b8db12c4af4ed1da49b99a0fb2579bc92c625a17766a08bb2ae297ca6f55e2
SHA512

3d533e4fb49cf1123be265ce5f5178c00aef54959edbe9a6559d55905721f9c094979162892c9cdfe701e8f86b62ae68eadf639dfa78d85964b15d07f9711203
SSDEEP

12288:d3Yxwx5+BGpgvYw1Z5fLJL8+3isN//hgXY26JAM8XfllxpDapUk8p1RfzL0dMcQ4:doenBgvfTZ18+3/zgXYLFCV0sXlzN0

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
640	WINWORD.EXE
640	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
640	WINWORD.EXE
640	WINWORD.EXE
640	WINWORD.EXE
640	WINWORD.EXE
640	WINWORD.EXE
640	WINWORD.EXE
640	WINWORD.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\lova_sosa.zip
1⤵
PID:716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1508

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Files.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
201B

MD5
35375f95b1430c8b11ebeb931fba0dda

SHA1
5122d139ac357db969c191b941bd479ceb9dc59f

SHA256
fd5691afe44306226fa973037fe144c3214867067cf88cb2285394888d959d5b

SHA512
b9043a4d4470ac90f83244a81fad5de8944b83ba1e8ab6bbc7d29fb216c2ded74bf1c7b1ca8c84535b989075660e83f676e273a1b524f9e5dd8e04fee412cc6b

Download Submit
C:\Users\Admin\Desktop\ClearReceive.cab

Filesize
184KB

MD5
5f04205aeedc3b9785ba5fa801bfc0d0

SHA1
e4c36b3bb81f7fef2e033475bae6c586e00ff9e5

SHA256
c61ddb15c5a125d9ffb3687aec0f0a486c770ed5786cd7067865ff4c862a1171

SHA512
cf7e3f5537ad0bf3a79f3345c1862befa1b53a3e9cb7cb1a510b4051e263bbe4a3aad671d3ff5ad0622884f730609cbb3b04c107e1092c55b9142ad5a0c2e24b

Download Submit
C:\Users\Admin\Desktop\CompareCheckpoint.wmf

Filesize
390KB

MD5
0dcbee7860e62de97d16a0b18b11313e

SHA1
b16669c83a0ca524b6acfa0ab2461a8e6017279f

SHA256
07c580e20bfa2b416a8977769c648853d3e602119d5e44c77a9ee7e00f301e7e

SHA512
aca58bbb88701a4bd356052229889c1157aa99748c1127a0c6499c63e9d81c738499483a78e502620058c62c4698a143d02fb2b4908d8a26ef4479aa8940aea8

Download Submit
C:\Users\Admin\Desktop\ComparePing.avi

Filesize
405KB

MD5
0bd168466cad18f703f26317c00fceca

SHA1
3d706276cdbd5b1743e9add10d15dccaa6ba55a0

SHA256
1d076abe249929c71cad80a6ba44715ec305de109b8f77de718da6716307c4db

SHA512
511afc7658a973d58cf71fd3891b4bfd3d9c0f8d6a34ac6b471167045baee1f373ef23de3ab266d55ab7b7066b2434f048c4d9fc9015c2fc0ebd6f41715fab5f

Download Submit
C:\Users\Admin\Desktop\ConvertFromCompare.txt

Filesize
722KB

MD5
4f52ebb0dc541a96a2ac24a3d04186a7

SHA1
3d44b23e4465d695a4fdd80bf28efe731027d4ea

SHA256
8bb1ebe66b2bb49df542f9c5daff300cfd8f1d89faef6eccc47112e70116d787

SHA512
2a5d4e101868f972f0f9e4f401e1baab61c98f51d7f2a84baf49201698f70b94e8baeb9e8729fdd9b405d18d4921431a7ff298493574f98edfdbe34536dd5b8f

Download Submit
C:\Users\Admin\Desktop\ConvertSkip.search-ms

Filesize
434KB

MD5
5ce43c75fbc5743bb4738f083590b029

SHA1
096c4da817438e79ac6a9fe4e4520af5a1d3f0a5

SHA256
f92c046f155b342ad6beeb4c8aaa96f4683dbea25eebb00fb29712df48b69e1f

SHA512
8e4de2dc7e13e82fdf042a3136f7ea4654755af2c648c6192df8cafef48a23dda01b1bf9f0aa29779ed975a14f997c80d51112523e80f695e22d5b21834dd6b9

Download Submit
C:\Users\Admin\Desktop\CopyLock.lnk

Filesize
199KB

MD5
578bc88b5444ffb62b7c260690303045

SHA1
af9b7653073000d2b33ef76d0ccd1c16ab5fc6dc

SHA256
e509350281669c23af4dc1b7b5429d112b84e5573bd67f2e338727600094e93d

SHA512
b4d2441f2aefc4a3b59b797cbbb74e30dceffb1a144e0fb9cbfc058c2b3f6bed2caef6c25f70b3df47ec1b5c1a0abae81c6ff96fcd943e677710cef240b2cfdb

Download Submit
C:\Users\Admin\Desktop\ExpandOut.mp4

Filesize
302KB

MD5
f6d3e3211df1d7799ce151efa1408e9b

SHA1
adbb24891cd53cc3221993aa425d29865200b949

SHA256
043832a6deed1afb8ad2fd4fff6365c9531f591ba821d61f32e8af6851584cc0

SHA512
e386158aa6360d4595a3f53e7d067974aabe708d533aa1d22034e5cd9912a1fa96f0d92b1500e62d4968007b192f08b289e5d38fc48e24d5344666b31d4ee01c

Download Submit
C:\Users\Admin\Desktop\GrantApprove.mpe

Filesize
508KB

MD5
b3f9fa9054c5a154075c24f849e14d48

SHA1
bee5f3681251b1ecc582c51e78d89b8a45791d9f

SHA256
632e4d85f11f43a860945768640433f9855da92b40ca9c6095849a865e972ec9

SHA512
e28fe4641dfe14cff7445be9c710ea9467538e7849a39a0822a4f4a588c91bc435da90c7fc5277b73e632738239ef9109674feb16eba09c9ab9ebf54049f660b

Download Submit
C:\Users\Admin\Desktop\JoinGrant.ico

Filesize
258KB

MD5
0512c909c0c3ec0b5b143611acd9796b

SHA1
ed99470d6fb85c91034455104d40e72d4b6f4072

SHA256
f3592ca8c76ed8dedda6952cacac9a002e739c699f01b98d4ee131dd27f2cfc1

SHA512
2adacf3f501dba99326297f9b11b72e5fa13542f97565a1b1f4378485701308f9fb18efe5f60960facf27cbb00fa7ec12bba8fdf545c7704bbc88737f30233a3

Download Submit
C:\Users\Admin\Desktop\JoinSubmit.tiff

Filesize
331KB

MD5
c60b81cd20635edaed475321a68b4d12

SHA1
e17eef9ec4ad2ac0ba985418691dddda132c814a

SHA256
d8e495b83a38ad1ae96d9630aea5569b3f493ca7246b2798ef0f7c0ebb016ad2

SHA512
c224cf3a2e04415bfdbf03d8a49cfbf16ef8f27b1841687c4fa4af748b3aae661363e4c94fc5a47c972c088cc36e206fb6ba82dbc268cc49abfba222cc06c811

Download Submit
C:\Users\Admin\Desktop\LimitWatch.mpe

Filesize
228KB

MD5
76e9b405192d709c2378f7098acb7549

SHA1
0d6e7922fa8c6d69a8427688077a8a87a640c003

SHA256
092eaa2536fabdc9eb3a48ac74a393ab637ce7a004b6fe7d50a4ed2950721cd2

SHA512
5ba048858591207c79e405726e8fbcda5edde78c9a7d4310cd5a7c75dcb7df0da11143961c951e20c2b6d4c840188dbf5c5341b08c9148125d49fcfca95fac70

Download Submit
C:\Users\Admin\Desktop\MergeExport.pot

Filesize
376KB

MD5
b087433ac5b702737c1e6c825211f4a8

SHA1
fcd52f3396db089c4bbff57f7a2d5041ffd49b26

SHA256
18f005828dcde18034b11943ed1015bb5711632cf0ae3b8d0977ab15d7eed220

SHA512
225c28c6efaac2247185f2277f05cb0b7416d204ec4cb8b2410307013ad8e61375416159fefe9fc1cb63973d6f96b264f570c84f9cd671971b807d93fba80163

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
820819331bf26551fb5b9ade1baabeb5

SHA1
4e0ed39804de0f9364e03fd530b8d00ad9bfb7b6

SHA256
ade2a7ae9493c1c12fa7ca7a6f48b6b153340490e1d3a3b180b9b3ecabc34f24

SHA512
83a50733841d3648b40299490e58949bfd30852e9c40566293402a51b378f486bebe49b46a6d9964580e254017e9b64eb965216fc123c931f0cba9af98440460

Download Submit
C:\Users\Admin\Desktop\NewDebug.7z

Filesize
213KB

MD5
edd9e5116cb484f0038bec195b3bc50e

SHA1
6a7adfec60ddcf5e0eaa6f04175dc4874afca00e

SHA256
807e0256715332dd8d6271f4fae5635079214a71bd801acc1673d5889a6f0b24

SHA512
fb019c40b3fe1717181fa3d3aefa5929d58dcd6a5cb3a9a8498ad3400601351e460b2b8bfe939e832a635fbfd7ff2bea516bcde627181a925f0f11f1bd30e1ba

Download Submit
C:\Users\Admin\Desktop\OpenBlock.aifc

Filesize
243KB

MD5
47c126de3cad43dfa0ec10e3bb45a450

SHA1
414005601560cdfe1002d1911e58e9d4af031759

SHA256
3fef55f2de13faa075fdbe6eea0f621b4485eae467a5ba33e692e81edb71947f

SHA512
c62413ecaf739ff22112f68fa0d12aca0521de3a1b0464b5b2805286999070ae6be231e48889c463b51bf764eb0d75a77b9eab7866054bbc55c3e3eb157d3b58

Download Submit
C:\Users\Admin\Desktop\OptimizeCopy.mp4

Filesize
361KB

MD5
11b16252dad4616e50fc984da1b5b38c

SHA1
4bd6862e84432d19ba007f4a7ea694382356d798

SHA256
c9735391f77609986ef1f27b98238ffe9685c99b9673fa6f25734176a9ce1816

SHA512
47361c994d9f80a206d2c465b407429b7b6bed87eff602e9ed0d9884bb005e3701d2020f3b2c448dad2865cac7d7b5d8ceeed35f872bd2184a90a5c4d1a6c1d7

Download Submit
C:\Users\Admin\Desktop\OutWatch.jpeg

Filesize
479KB

MD5
36ae2fc6c000390a9bdac965924af71f

SHA1
f1a73b122889702e65370722f53b41cb1ec1a334

SHA256
afbc2c7f6c9ee0887fadb1f1a42d26b059c971d6d4156fdf9918649a5fb132a3

SHA512
540e699085185ea8195940ca2dc40f2b8239e70c5c11f81e773129acb2a992731e10999a20c13b00d22af1db7d2a854fef964604cd27341f543bd6c8ee6411cd

Download Submit
C:\Users\Admin\Desktop\PingOpen.dwg

Filesize
523KB

MD5
096f105cffb282fc06144ccd99979b04

SHA1
6cb0911cda2997d39d380f0ebf7cdebd79d85caf

SHA256
1b6c37b8e966c0d3fc35ba34c01e519a6523b0947cb96e5f01098f7d3fbe5e6a

SHA512
db2aaa0d944386942be79660ef8946c4c249eaf26efd7076bc9def751ccab410366e59cf128308cc750f7813ba3ae4c550425a208ad168225977c0ec08e30373

Download Submit
C:\Users\Admin\Desktop\ProtectUnlock.xht

Filesize
493KB

MD5
26ed92968a6596ce0e3ab4aba0cff610

SHA1
67f41f651ded1f31b25a4a3e335c5671535b4dee

SHA256
8dfce444949319188951c53ea3a169b3462e202ccf01b91ab3ad239f04232e73

SHA512
14e86b8f23d6524d218cfba40280e142693468966a8f559d405d726994323297d9a931cae75d347b6a4a35dc7b1a938dba60c2d66833ba9b2b3dcf7b52f0c54d

Download Submit
C:\Users\Admin\Desktop\ReadConvertTo.DVR-MS

Filesize
287KB

MD5
c0b6b60faef66e528cc8368aa4dbeffa

SHA1
545f93c9e47ee3b4e72449fcf5458893f28c67d9

SHA256
5e7177dd396bd44fdbcb82bb530b31da14fa76bc452cc5322337a68a196916a9

SHA512
8a2c2160813cbda98ac8a119ee16f2f48ad8cce548c425163763ca629a3d3c21e1b87417eda636480dbc6838a2366fb9762b285ad510792e49341ebe61a4e4ab

Download Submit
C:\Users\Admin\Desktop\RedoRepair.vsx

Filesize
317KB

MD5
6caa498902449f239d3bf0786ab686c3

SHA1
5f5f3f48c046653e17cf7c5f3bb934c7c0879083

SHA256
06f8b999e0d43cb3b71806b3d92bbdfbd8b6ea694502550c30318731a13a17f5

SHA512
657590ae86cb904e669511a7af39d20c9968d392b0c4f4d251f640e17af3323b1bc34f640e1a4701e5e633e649e6adae04ddbba9bccf6d9cb3e7f987fd0fa315

Download Submit
C:\Users\Admin\Desktop\RequestRepair.wax

Filesize
449KB

MD5
712aa71de8368785bb80a6d46eb42924

SHA1
685eac4d091380b9adf5b0d84825533d71337cac

SHA256
8a5057ed981d213b34f18535e235078bfd2434bd75c5518f5126299bac42927a

SHA512
aa3dd7bab402d44a0fa3992545032a426b4e127cf8256d8898a8a196bd0bf60a611e88aa472e2ae30a58669acfdc5166d614146d80660a38fbef207de84ae522

Download Submit
C:\Users\Admin\Desktop\ResetPop.aiff

Filesize
346KB

MD5
efd15cecbf631722a3435940b5042370

SHA1
0e68a6d4a31487f6afb45ec6e35bd54eefadb7eb

SHA256
6a97dae1080deebbad720c3fe419d4ee48db20745f2ee1e805efa76c1dafd79e

SHA512
a48bab41ec858ec635caef7ce35c95213c0bd2979e19920c42d3c4ec873f2a020bb45796fc8c1058472e31b91ad0e8ba7aeb86315dbf4d083765fe56de2e72b6

Download Submit
C:\Users\Admin\Desktop\TraceSelect.easmx

Filesize
464KB

MD5
30e2082fe9e5e8a86496c64381bd019f

SHA1
3ecd16802dfcc7a31315e7898fa213269d8afb30

SHA256
4280b5f88ba398bef6f82cbff72f6a0b81d601d88ad7caaf6b13c5b07878c3fb

SHA512
cee78fef414453a35ee82c2c67129735716897a12c2170e439d154bc2620134d653c0ebd4650b5e23dd36ef9dc3f802e17c6f3da19731c44b529781495aa7b1e

Download Submit
C:\Users\Admin\Desktop\UndoRemove.vb

Filesize
272KB

MD5
ebaf3b3fc3101d528dbf4002f875a58d

SHA1
478ddeb0aa3dcc2d52c182117ee4050761796c16

SHA256
0f39a6fbee957d73d7bba5811a5cb6e49e91958dea2416d8ed4ef344db6dd2a3

SHA512
aabee6787d3d6c42e184ff2ca01c1955ea71955aedafb04a9f8e2f122755506a101cae5691d850d503fec01509631fe104d62cf9ee9fe0b219b9258ed5c2dc2b

Download Submit
C:\Users\Admin\Desktop\WaitSplit.ps1

Filesize
420KB

MD5
5cb6f50a081f171df0570431e3658845

SHA1
d88c568abf364943b06fb7c445ed49cbcd05609f

SHA256
28fa265227048fc541cbccc1e968e6e252de7281d91dac736eecf6452a0b72a4

SHA512
c740b9afbb4af42a66723f1c854e6761721dfc2d4ecdbcbb96a011bcfcbde79e3bd541a687510a81615366863911086086c48a3e8970a200d1a0d0835c517180

Download Submit
C:\Users\Admin\Downloads\CheckpointClose.doc

Filesize
569KB

MD5
861af33140ed4b452786cd52276ed4f6

SHA1
b08461ff24088baa3908edebfb41702fec66d845

SHA256
b0d3ad819e5f508f84a1c598337ae359f2203b1669827afb658e1f0980dd2c69

SHA512
bd4ded6a3e32f2dee3b2bec5c24ddeca1673176c65cc33c3e38cc17a5d569aa40a1d0696145a3354ca85f2bf96a21f2c963077d36c1a6f041afdd6af41fc1558

Download Submit
C:\Users\Admin\Downloads\ClosePublish.m3u

Filesize
223KB

MD5
438ea239c772d48215457cc88c7ef0fc

SHA1
77cbe9f2ea9d3b164515028d4a914f3ff237f0a1

SHA256
17227acf1b0244269cc10977f43f53de7377b0027cd7ebdbd987a200c091ae74

SHA512
f95d2d0ec0a0e7bd295e3dec9a3d462f12f676b23596b0b97da0a82dd5452957c56362eb74372cc2b63505770ecc7a1ae14d48b4fc05f39fb6e4b953241dedcf

Download Submit
C:\Users\Admin\Downloads\CompleteInitialize.zip

Filesize
274KB

MD5
e65e7003b610fc684fdc7c6e9ce81996

SHA1
ecc51f825ffd37e788cdadc2793e76d53b416386

SHA256
b2ac4d2b51e45da728876f3fc5dc4b517edd957c5f3d097a8d622d54b68b7a83

SHA512
ff26f5107a3e143062e9db6e909a7f0882685643a0303604f60a3c5f72397c9528b8eaff5de9b54e3ea8dd744d2f1ef5998dac3ac213b9dcaaaca2534649eac4

Download Submit
C:\Users\Admin\Downloads\CompleteRequest.bin

Filesize
441KB

MD5
a633a27e9691e16d077c0ba4996d6c78

SHA1
f7417e93163fd76a16f215930b0f13a9f78dc129

SHA256
b1c37288731e8be3a87ec9681f44450c7fcb3060262affac0ec47489ce1bc62d

SHA512
3185eede898921490e34c769e950221b2c34901e09474d46b036715d60dc970a9582bd9bd91c4bfcd2156ef34efe2b7bc0c7886edd3f63c922f4e215d9176034

Download Submit
C:\Users\Admin\Downloads\ConnectResize.tiff

Filesize
505KB

MD5
c6ceb1518adb1e376b0e67be8b470d20

SHA1
5d932c697c0cff7c9b916066ee6bc82c9d988852

SHA256
bae80366c836a467ea6b6c1c816e37905532ad26f40401792462983992b9fe71

SHA512
724d77b05ca92e0b6091c927e2de7035a5df78172e6b98a61bc73997a5dc96a8fad71acd9f4012f3231eba1732205bb3b3e6ff269309676e6c54105083ef893c

Download Submit
C:\Users\Admin\Downloads\ConvertFromTest.mpeg

Filesize
262KB

MD5
3302e8c536bfbde82b68acdfc5f21ed3

SHA1
31fb5fd586c2b9b4b8d820d71777ae6841e68dbe

SHA256
283d1b314598584957c1374f2e1d69cc36e89f739a1fb62a264a699976c0642d

SHA512
a4d6ce51f25ac240ddc33a10a4a43db0b3f555db6753a23d2ac8b86fd93e58b49bdbcfad0dd68a1bcdd54e9ba451c3bcf96d0cc63d1f2fb1ab2ca7a442fa9cec

Download Submit
C:\Users\Admin\Downloads\DebugConfirm.clr

Filesize
466KB

MD5
c7915f8455a4b39c1ef80728e0aed08a

SHA1
1552418820bf76c37e1e28df3237b77849172f4a

SHA256
9049d49c7c6b27d05c22a782ae04d4ae817a9bd9d18721926282935a8415a9ce

SHA512
91acfa85b2dbf8ebed0006a6f5e195500bbfe361ebd070ab3458f5ca0bc05a7bf056bd67f7475acb514f53fbe4102de1345b21b9dacfa0c91eb49ba294e27c6f

Download Submit
C:\Users\Admin\Downloads\DenySkip.mid

Filesize
326KB

MD5
1339958e048d488e5c04a60a1f040c4d

SHA1
b359b1e7d3ba3cf6287cfaacb6f4c61cca357fb3

SHA256
f7178d95974b7c2810f9c344a239be32c888a580df61fc4afffa61189583a3bc

SHA512
049923849cc45db20a9f85c3a0038922b2e252ac90f1548b45b4b390970f456d035e7199f1550c56790bc5313dc28ee02e20d734a78c8206c0e08520b4a14978

Download Submit
C:\Users\Admin\Downloads\DenyWait.asp

Filesize
198KB

MD5
4302f36021459a5d9a25b438b3939c42

SHA1
7802c84a68e13b66a757084aba934f7e620cd284

SHA256
1b8d2c7501758d077899f7752d71326def31a9d3e5d4a6857589107700b5e575

SHA512
6762a260c7e8014f0cebbdc9deba1885c1ae94bcf678576fa7079b2486fb9ffacdebd06925a3e63a9a720aa29c85980afa655e74a7fdd23f388953eefef348e6

Download Submit
C:\Users\Admin\Downloads\DisableResolve.mht

Filesize
530KB

MD5
056683dab7cf8930828e3eaa909e7469

SHA1
3bd72309ef65f6161324d4958375b368ac00754d

SHA256
0965cbc7548f872f704c65368be0908a070b7f415d492ce54a0195c20bab8cd9

SHA512
85e0c6b93746bc4b2304f5165506566308184295c2a36c93d55b99c3427c0ac1392388e5b52f50364dd7214f18e9f1a93c1bdbec56b0468c93cac140d61d1066

Download Submit
C:\Users\Admin\Downloads\EnableInitialize.sql

Filesize
338KB

MD5
393c19d2ce3e0fb6b20aeb750f11fc47

SHA1
bcebba2a3ec877eccb9e87274d44cba4b68e6779

SHA256
5400791015e0a0dace50c35ee9f7020f6f66dcfdca4435ed4e5718227b3e8965

SHA512
c912c5ecc0e0a2ccba3e704873175326dbe46482621b33a9595ab3b32b45b899510a1cc763361d5c8b1bdb018c853641aabdceb4f0a2631c17b1a7540feff5ce

Download Submit
C:\Users\Admin\Downloads\ExitFormat.exe

Filesize
210KB

MD5
ab5372dc481dbc2d43b0d576868f4cce

SHA1
ffad78a07ebcb097d7d0b9cafefcf3a286c038cd

SHA256
0f19bf18c1dc2f53a1d9d34b55b953d0a07c2a7c457409eddbd1a666e1f7813e

SHA512
6c8f83a4095b8467bc307f5249c26aabcf32e8ed44e4b0076d3d0b16b08f374ec6306c64ece69b1596e6865ee512a36c3a5b3f8593dcc05e9b6b0b433cc7d98f

Download Submit
C:\Users\Admin\Downloads\ExportMerge.cab

Filesize
287KB

MD5
a95a522ef78845c6e63ebdb402d90c75

SHA1
24eca533db7eb099883e1e6a3d154a1e22d2d716

SHA256
a3fe037832ced17b40cb0586b1c61ef7131710c97de0971f8e5fe2e5d3e991bb

SHA512
0588455b6c530579fc283d00fedd1d98c53338fb615c9a72c58b577e3f3e8895dfb4cede0876e92dce0cbad83c3f777011f33a88789efa5da218ede31a3ec632

Download Submit
C:\Users\Admin\Downloads\LockRegister.reg

Filesize
377KB

MD5
2e37e795bad796ee50b8357fe2a635d9

SHA1
9c8280ab64b24894332007356e48682ae71aec7d

SHA256
39b7e6349e5f9cefa705d3ca627708fec838569560f554cce6e5a3a8784bf789

SHA512
7b6a8c47cc36a3d009c9eba9427fd3696764561bac8ea4be686a5732355c85ebe5abb29cc79277266e24805fcc1e216bfaf698f28a539ac7be1b9a8766c59a43

Download Submit
C:\Users\Admin\Downloads\MountConvert.lock

Filesize
236KB

MD5
c5ff172d6a973ae25c45f8aacf870ca3

SHA1
927e448e21c698953c80b42f5de44bb45e78c4cb

SHA256
ee6513db1a1e472b144bfa16e1bb9f2208054c7b28955c71393b2554e0c41cd8

SHA512
74b67e4beb9239041801dc7f16ec92f953d4f895a9e599d124fd348cebe5065b486801e74e27d4205066304d1ae584c8dc80d861c19388b37b2817a6f85e03bc

Download Submit
C:\Users\Admin\Downloads\MountRepair.ps1xml

Filesize
364KB

MD5
ca37fdc0e449cace70ee591b180cc96f

SHA1
0ce938ee30eb44d9586475e252f0ae8721ba35e0

SHA256
a3612fd2de9ef97591470602adcd89e6fc4da1beaf3918497eb7b15f29e0984e

SHA512
6ed83b7879f2171358d6214019cf51458dfb309f87179b515986b1cc4cfc4aa987b5be1416ed9a05ab25f2472f1a2dbb7a0a04faf9c9637b6ec08ac6bc6bd1c0

Download Submit
C:\Users\Admin\Downloads\PublishSend.rtf

Filesize
556KB

MD5
b05c7aca36df2dbf5d0a830c7dbb0ac9

SHA1
e2599d54922b5acae13cdee7e96467d473f32303

SHA256
62ec107909bee6f4e389e314efd182f5b404799b37fd3c15c11a1d80b13e2d91

SHA512
af8e62d431b7e9c55fafa92e571a54cc719c2885f085c806f7638ac4086faea33e6261a0b976ef748f7ed0acd79ec045c44bb281128ea2a2ef7fdbe6884b10c1

Download Submit
C:\Users\Admin\Downloads\PushSearch.tiff

Filesize
543KB

MD5
7b2e25367879909e0c4b15b02d7f326c

SHA1
03a112d5e71c2c4ff29c63aca20581088699de0b

SHA256
5820012a4679dbd3dfc38d1c3ac65b9a99a2f996097be28dcbcaeefe709e9e35

SHA512
f9ec3794bdf8baa32ee8aa1a6c1ceae20862c2cec901f10c8a8b7d09dc98fab30943e5a1c274654e06f261c137f06b94102064f321aa8c770d9ea95691d219b5

Download Submit
C:\Users\Admin\Downloads\RegisterStop.rmi

Filesize
517KB

MD5
1ff4cfde98f9f91feda81ac568a047ff

SHA1
8c0a67d65a4df7e4a103072317de640994aee392

SHA256
a379543d1ee4d95a03525d7c24a2ed32843db7526bbd0da168196884341d3bb6

SHA512
c1cbd8f4736edeb27cc95052f1f94f5d08a373d70508d659a32321efed09b633dd20b73d2e5f74ea9f79a759f91b280bc9c154464f86727c2d8f1d7e51394cbf

Download Submit
C:\Users\Admin\Downloads\RenameOpen.emz

Filesize
779KB

MD5
36458539f96ba5c80643a2c5eac39fbf

SHA1
9b391a22bd07fe01946fbb3bd3c9c44d39b452f9

SHA256
6d31339d3b5fde3d29076ee001f1bb4f6c9eaae00d73347a84def82e2304d1f5

SHA512
e1cc2c712b559901294c6dd8a4d0a14cf7ef9880ebf01b80f9a6092364fa90f8255e60bb01aca259e760dfc536b88f95e437fad42eaee06a4b0a917851a669a9

Download Submit
C:\Users\Admin\Downloads\SelectWrite.dotm

Filesize
415KB

MD5
e684d4b1e42ea7a8135de8a6e9667cee

SHA1
481e9c1cf9377e6aa393aa3c6fda880d8603e2dc

SHA256
7dce9f735c254fa95101374ef7c0c2a7c2e5724a697871254143080f55643489

SHA512
4c7c07b223ee2cd83383aaf450f8ec8b1e1efd65fe2c167dc5a149ebd194fbaf42d910fc0f641f0cbe671f453a7c6361278ab666328bcf57bb5095915f23424b

Download Submit
C:\Users\Admin\Downloads\StopConvert.mov

Filesize
402KB

MD5
2d9c0f47f6bcae131564084b478e74fc

SHA1
e8e298b1275a9a142903427aabac6550edc98201

SHA256
ea081926b2b8d5167f022764c1f218fec1fc1025f767d9530422bb66b14596e6

SHA512
979ff44390a3d580890023b7363e3f32a85cf6ba6d13f3f4dd08075de35b0805cdbeb40fabe893f6da8bfd9ab0ed58280a72d4d83ed9ca7a32ad6cb188b7f202

Download Submit
C:\Users\Admin\Downloads\StopInstall.htm

Filesize
313KB

MD5
a02fedd28821a201323903aeee201b4d

SHA1
3b6ef5ab7309a88df52044c1aa3995668d526a96

SHA256
3e427f0d7719aedd9cc5e662a65eaa27396f3669c15394fa61e1f2f63a126087

SHA512
62fbd15d9ab11e04238b7f3168dfb9fff4d15005749e295119c3d3d225be74dd4087ff7b0a4b669418afc2bac6edc036f63fa0a3e1f2c35464ecba0c550e09d8

Download Submit
C:\Users\Admin\Downloads\SwitchImport.m1v

Filesize
300KB

MD5
8cd0c3fffdbeb7c1a8569d8732ac60bc

SHA1
ec1f80800e0a847f576adf205ffb80906383ee11

SHA256
ab6440cb1278dcca95ff6f2f9a63258ecdb900751655d9457014aabe2547417b

SHA512
520369954b1f114010543c1aad39893401ce88589d2f312ae028684cc51e96090201f012d5896b6a675244c640e2327bf4a10449a5ec9690cf845f83293d13b1

Download Submit
C:\Users\Admin\Downloads\TraceMeasure.csv

Filesize
453KB

MD5
a820215765f5c1e788bb6f88926acee2

SHA1
2398e29d73b5dbdabfadeb953408814f74419f58

SHA256
dc09a51dc4ac48baeffff5a70cc4b486ff3fd4941eaa3aa646661b30d73bfeb9

SHA512
85c5130d7c63c9cc06dcb1583e23f528228acbeb928bd54eb80628f5bb5b65ee2068b3843eb2b7e7a02040bafd2151bbe108b4a2d19366586783733101ab65fd

Download Submit
C:\Users\Admin\Downloads\UnblockInvoke.mov

Filesize
479KB

MD5
e8c06113024303536478d446b7865e97

SHA1
1249764634f64248d111ca4509e0591828291643

SHA256
48cec5ad42c39d3a56932f8b85c6b0aa206c1b891edb71194523f5f05950766b

SHA512
da18461c5fc700f98003bae1f9f503bc824019ee409e5fdcd6904a6bb3e1315d455540a8a4d0475d1ceb7a6a960bfa7e1ca6efff7328e338ad6b6b6e466d6e19

Download Submit
C:\Users\Admin\Downloads\UnprotectProtect.otf

Filesize
390KB

MD5
2a7a94b5d43be869916bec96a4a2bb5e

SHA1
22f9d50bd406e2af8681b33b5ce9932f31dd173d

SHA256
a4227d420214c79c695d0ac38d270d13c4e5d7acca41778f0a511f2962841322

SHA512
ac3b7d0c9e8d5d1e4f231e9b5ddb45565f5a10a89bcfde42d124bb0b0c07e814f444b84fde8d1c535ec258772bcb4dbf0f9f051df59c47c1c614610e8a662827

Download Submit
C:\Users\Admin\Downloads\UnregisterResolve.ttc

Filesize
249KB

MD5
7c883e33884fb499084bdabb13f77e49

SHA1
c544bee87dad9340ff7b5170d9e718b749d53ef0

SHA256
057ecea0db28c628a629d911824d3eb4aaa13592816d8435b19891702b6c8031

SHA512
f44969d280874e24eed981d223fcb8b6cfff72c64d29804e31f2542868f0727821281fb97d803d9dfe4a403344e710c82afdc00717a2feb20f95266cc9f8a57f

Download Submit
C:\Users\Admin\Downloads\WaitCompare.eprtx

Filesize
428KB

MD5
d9a464072b56713b1ed7ae1254b583c1

SHA1
398edf15f89938cf54ebf452f13441079b4b38cd

SHA256
d4484d7316822ed774b885edbe9ae679b937d95a1bad4ecb050f55b6dd553947

SHA512
07173fda97258802fb3219d316f497a1ecd4c9d79959fb2144794da36007374c359f2bfc6b18a0904c60286042c6b02ae1ac0714d249b2fbafa19715ba0074ee

Download Submit
C:\Users\Admin\Downloads\WaitStop.cab

Filesize
351KB

MD5
594c6864df6cc2fce5019b5acaafa4f3

SHA1
529e33545b94a1e90ac05e644182f2126f7972b2

SHA256
bfe8c6328f108bb6a8ac77b1017b47d6aff7c46738eead974e99c7521cf5a7c2

SHA512
f14d998a90ef2b4dc561022dccf6a8fa98416794e11ac97054757e7284ad72185d549968d9bff77ae3386b2226f4520141a29b5ed04841c416bf9b5fafbed756

Download Submit
C:\Users\Admin\Downloads\WatchRegister.xlsm

Filesize
492KB

MD5
7a131003296221fe1e03625970176514

SHA1
21f39cdd920ecf61c708917cca352125e1baefd2

SHA256
28f224b398057b2eb05444fc9f0293f41a73e032c27cabd27ccb8490a107f77e

SHA512
ba6307b9509e55cd6294cc4c4b101993ffb3621b1b505578ed2af0d0c1d0494b49c508e4cb32baaa940f753c42e4ac404a3cbd42d5ed12fdb19731380f22c627

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
259707af41ae165f4ed6c301df4b5b8b

SHA1
c3a730a1236f5cd011bd3274c76f5b3936a21f97

SHA256
c612dee000bad2eb2c9ad7b5ab390647018a99c0b3989a95eba4e446f7dbecb5

SHA512
b875fa6c9a5b72656ea15fc86f8bf2dfea4a922cf82824b68fe2d7c22c3aacb52eb942f70c548b0ad031f2bc5e3b9f1459719bbf184301a7ba47c1c6d36ecbed

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
298edf39152a75177ee51a1f8820f4b6

SHA1
463dcfeabc34e3c110e562232f938232bf350af1

SHA256
ea4568ae0cd798328c004cfe58936d6a1a0b9642af627d423494d2d4b804efb2

SHA512
90a8843a1fe8ebb7d5876ffbe07d5b7769faaedfa0d34d606aa7277cdd15e7291fc789b3400e57910457dc85b31fa3a1efac670bee021b58ebf7f738d1d4eb1f

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
f238d2b42705b25207cb299bf861f35f

SHA1
4b75d24bc283d61f5f33f094e25cc5111fa42f95

SHA256
b97821d7a68d5e00699633695e8c0e81fdf1167f70dc235ecdc79390fc0c4a17

SHA512
3f87c8f4609dd66f888a5dcfb396b36d7be0a69c15c97599554a44049e9f7afd534b55bfda8f39da2c2410445147807717cf64e7c0cc1b51380e19f4d5758354

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
7686d39fce1029a6a6f33888c5a0d4e0

SHA1
8ba5a994df2d9d671be8889ec48de18e52c915ac

SHA256
47a4afcfef252b963efbd5502c210f86c672faa3d07eedaefa85111a7a1f09e0

SHA512
9be9d9274f394f20517df670b3d4e22fb95656efa0292e9f978dd58e4cdc279ef07633decc8ab5416db04bb6ab6d9b4e2190d4e30146abb47b393bbf3d972ce2

Download Submit
memory/640-71-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-75-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-65-0x00007FFF7F1D0000-0x00007FFF7F1E0000-memory.dmp

Filesize
64KB

Download
memory/640-67-0x00007FFF7F1D0000-0x00007FFF7F1E0000-memory.dmp

Filesize
64KB

Download
memory/640-66-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-64-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-68-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-70-0x00007FFF7F1D0000-0x00007FFF7F1E0000-memory.dmp

Filesize
64KB

Download
memory/640-63-0x00007FFF7F1D0000-0x00007FFF7F1E0000-memory.dmp

Filesize
64KB

Download
memory/640-69-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-72-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-73-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-74-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-62-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-76-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-77-0x00007FFF7CA90000-0x00007FFF7CAA0000-memory.dmp

Filesize
64KB

Download
memory/640-78-0x00007FFFBEC30000-0x00007FFFBECED000-memory.dmp

Filesize
756KB

Download
memory/640-79-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-80-0x00007FFF7CA90000-0x00007FFF7CAA0000-memory.dmp

Filesize
64KB

Download
memory/640-61-0x00007FFF7F1D0000-0x00007FFF7F1E0000-memory.dmp

Filesize
64KB

Download
memory/640-111-0x00007FFF7F1D0000-0x00007FFF7F1E0000-memory.dmp

Filesize
64KB

Download
memory/640-112-0x00007FFF7F1D0000-0x00007FFF7F1E0000-memory.dmp

Filesize
64KB

Download
memory/640-113-0x00007FFF7F1D0000-0x00007FFF7F1E0000-memory.dmp

Filesize
64KB

Download
memory/640-114-0x00007FFF7F1D0000-0x00007FFF7F1E0000-memory.dmp

Filesize
64KB

Download
memory/640-115-0x00007FFFBF140000-0x00007FFFBF349000-memory.dmp

Filesize
2.0MB

Download
memory/640-116-0x00007FFFBEC30000-0x00007FFFBECED000-memory.dmp

Filesize
756KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads