4d104f2a3cb1812c62f80e35f7287d91b68c0163377001779b10e88c974f038d

Analysis

max time kernel
147s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-03-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spyware/butterflyondesktop.exe
Size

2.8MB
MD5

1535aa21451192109b86be9bcc7c4345
SHA1

1af211c686c4d4bf0239ed6620358a19691cf88c
SHA256

4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
SHA512

1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
SSDEEP

49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2392	butterflyondesktop.tmp
2760	ButterflyOnDesktop.exe

Loads dropped DLL 7 IoCs

pid	Process
2368	butterflyondesktop.exe
2392	butterflyondesktop.tmp
2392	butterflyondesktop.tmp
2392	butterflyondesktop.tmp
2392	butterflyondesktop.tmp
2392	butterflyondesktop.tmp
2392	butterflyondesktop.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	butterflyondesktop.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-8QE9Q.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-7NUAM.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-UC5UB.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-MC9CT.tmp	butterflyondesktop.tmp
File opened for modification	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0722e90086dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "4017"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4113"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "4095"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "4095"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415590485"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4035"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000858f8fd322dfcade8773b509c64d8f0f9390f11f403b27b2fe94886675c31f95000000000e800000000200002000000035bad82cd6815719ea134d6e15876bc8c6d56cf9c9a5c78586e9b3613624f40b20000000391335ef70c49586ec65fc3054e3285ccbe28f996c68098e3ff6e0571e794e544000000016040a22fb1c11e2fdab8a28c10071f4b9d0e02db941924fa47063b95f15897dab8111dbaca29340b523aa194712e3720eea2e5cbf5f297336594e530df15b7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4017"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "3981"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3981"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "4017"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "32"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "3981"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA559591-D8FB-11EE-B17A-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000e42597ae33efa19ee6e8477cd67e0ddac587093697b848ae363e58431fccbd4c000000000e8000000002000020000000dead8ef89868f59bb1b77fd0d3f5efe6520291c8e4b97c5d2e5fcc842e014d559000000063d379c0fb8ddae873cd2fde2021b79e31ef12be1f9a38524cc44b47bda8ca84272d033a726d67f7a95995f85e202a5515119069b45211bf5e00147f149204cf96484abb16ee1383967c57ed0fb9b21e1daaa707022110a1b46f88e96560f939310055e3efec0554d2dbc64fff40fbb0400c967677d1e534d4915eae8bc5878811d4b09a385f78d7495fc7eb239102a540000000fca9abd7cf4aaa730a8338addf43a43a4880fb73c006e31f72b47f2337d2ea9544980c616471ca4ce16e1645581f4d0238c4aaa30cd2a1fe15f4c3db537884a6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\ = "32"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2392	butterflyondesktop.tmp
2760	ButterflyOnDesktop.exe
2172	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2760	ButterflyOnDesktop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
572	IEXPLORE.EXE
572	IEXPLORE.EXE
572	IEXPLORE.EXE
572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2392	2368	butterflyondesktop.exe	28
PID 2368 wrote to memory of 2392	2368	butterflyondesktop.exe	28
PID 2368 wrote to memory of 2392	2368	butterflyondesktop.exe	28
PID 2368 wrote to memory of 2392	2368	butterflyondesktop.exe	28
PID 2368 wrote to memory of 2392	2368	butterflyondesktop.exe	28
PID 2368 wrote to memory of 2392	2368	butterflyondesktop.exe	28
PID 2368 wrote to memory of 2392	2368	butterflyondesktop.exe	28
PID 2392 wrote to memory of 2760	2392	butterflyondesktop.tmp	32
PID 2392 wrote to memory of 2760	2392	butterflyondesktop.tmp	32
PID 2392 wrote to memory of 2760	2392	butterflyondesktop.tmp	32
PID 2392 wrote to memory of 2760	2392	butterflyondesktop.tmp	32
PID 2392 wrote to memory of 2172	2392	butterflyondesktop.tmp	33
PID 2392 wrote to memory of 2172	2392	butterflyondesktop.tmp	33
PID 2392 wrote to memory of 2172	2392	butterflyondesktop.tmp	33
PID 2392 wrote to memory of 2172	2392	butterflyondesktop.tmp	33
PID 2172 wrote to memory of 572	2172	iexplore.exe	35
PID 2172 wrote to memory of 572	2172	iexplore.exe	35
PID 2172 wrote to memory of 572	2172	iexplore.exe	35
PID 2172 wrote to memory of 572	2172	iexplore.exe	35

C:\Users\Admin\AppData\Local\Temp\Spyware\butterflyondesktop.exe
"C:\Users\Admin\AppData\Local\Temp\Spyware\butterflyondesktop.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\is-EPA6F.tmp\butterflyondesktop.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-EPA6F.tmp\butterflyondesktop.tmp" /SL5="$4010A,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Spyware\butterflyondesktop.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
    "C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2760
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://freedesktopsoft.com/butterflyondesktoplike.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

Filesize
3.0MB

MD5
81aab57e0ef37ddff02d0106ced6b91e

SHA1
6e3895b350ef1545902bd23e7162dfce4c64e029

SHA256
a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287

SHA512
a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1e15f565c453fc30e13f693e8f4755c

SHA1
12278aedc7bed0697a4fd88b71e1e945401b2f3a

SHA256
391ad4b8122912b2c44465b5f3400b22fd23e5f3ea3cce4929aaba2732229396

SHA512
2cbe2e2c1029a3364ac1fb97e2baedda2dc7be5b6df9e7ab590451a7ad5544474c21107687203471a9765a1661619e0bef57f7455a66ebdd360ba51347a14a9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18bd6674c3769cff6364d815b92e227e

SHA1
cfc9be005715bf093f506f0cfb0b9411b177d286

SHA256
076b84b371819e1e47481dadd294771a05251bfd9a2d77ba8a23b8a9fdba0a2d

SHA512
265936dce7e41b1b565f6994f6443cc0a723d14a4eaca318294f0e03b7dfa40b5fbd9e18700a787be6f5a8639535855d3065b3ccf9c0b2843933adb1a7cc696c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58b81f613ef5c6f82079e9437502e833

SHA1
27bfe8fc3c548fa6e257cd92b13b6ea7b14ba860

SHA256
fa401e3a618b48d2acccf556c49048124daa164693656e753297eebbacc11fee

SHA512
360d9d21d189c58319f2c4e525898d887e91845b717029679b75073b353483385ac5df0c987fa38a2908559c2ff0b22af8bf682f3731cc3aceecfc3d712e66c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c59790b8b62b8f0c78edba4d4f034d5

SHA1
b5dccfc8395a18fea4cc2dce6708c2ad04e54034

SHA256
ff512c5a6bcda99a2ed57e9dcfd781039d819b0e44b258853c8a80b06f3c4391

SHA512
c599a4729510841920db636f2a90cd64acdbf725d05dfe84bd153387c6167a2b5aa8870bc87639b3883d238ce3f1203cdc63395479e097120bfebb9a24f9a3ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59406f13708361a1fa429780554c636d

SHA1
63fdf40dbec958e8b0bd9401fc0addb0ce02a7e7

SHA256
57097f5e89aa0b11c6a568afc9e59bf15e50c2cf54c39702362f68a2468f0127

SHA512
056b5b8975850bc77b82e2849fe17570aaf04e9fddf34337306bd95e8a9705a5f14c3bb3dd6bdf405b7e23b07a66ee1c0eeb923a504f6a6de035d0ac34c804e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
568ea5fb5e0754ef1fd2672863f75381

SHA1
a5eab88897aaf42615bd2e739297eeeca27a6c0d

SHA256
081a3f8239d6071707628079ca994306d089e734c4f259c64d184b4caadcb284

SHA512
13fc4f260924af5d2a78905d776bc21ff23dcdcb2401525afe87d411c726d8d5164916818fd8333c5684889ac1cd073273d067cd1a904b0a2b4619a0275772af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faf276c510b006228da17e722347a798

SHA1
b3b82e9952c61cbce483e702623e0320ffb3d81b

SHA256
8f7c2394ab8aac359b9b7689ca0a6eb674400134821119bad8fc0fefb7a162e2

SHA512
852cb37b59eb888389ba285d4e035e9256f30a85233d18de2325b2e67328e2b69e6338f7e410044b02be4fde3247744a42acdbf020ea386b652af1a0f046572e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
540146b862780acbd869c40da2495083

SHA1
b3ea0431df76e8313fa7c161603c9b00876c8b58

SHA256
ad8a871060a1ab972cfa96983dd078a7371e7a3cb31068cac8b9e5ebf446314a

SHA512
033bd43e02f415550bfde105c7366b904cb3d9c2a8cd671e74c1621721623f3820e75ceb1169716129b9d69fe9796e82042fe81d425df2e1d0a37143ce5647c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91833aa6d18dd64f9579904b3fd886b8

SHA1
80d3bee1860cc0f7489202dd62ea0de88813ee59

SHA256
8bc515a74d8b1278c414c7d1c5eae8435518e28a67f95e5bd2bfdef823dc3e17

SHA512
9f9525eb26ed595f70994c7249552725df90ec0b3f963ff6a620050c224484811a54d174a44761d8e72b6949c8ce94f80abb5136571df64948814cb3cbd7dbfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e43fc77658f195f31d2b85a7486e1386

SHA1
07d56f7c79315f795e2266cddf6c876769b44eed

SHA256
8e4c5b07a7ac0d3e806cb1765010a2d784e415060b68710e54af8f3e51127877

SHA512
396ccaddbebd3c84652f1f4650beae3917d154fac8f9d7a9b7e7740057af1d12e2beb42a6e8b7aed515a5b7a92fb592a6422e6ab7293afa55d1cf7ad890ce292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac9c4657e1e6be01163cc73c5556b9bb

SHA1
071a4d24773febcd42801db42b1d0d1220a4a4a5

SHA256
787150ec90bf534ef3d397bf76dc42d875b2484e448599c453ff518a437fc28c

SHA512
c294877a20c5b472c5a66848156025857fabbabc77fd4d855a20113b845ad0e03b7baa60b4fdf814cfa14eca70789c59183ccdda5969685e0f9f5735a14d29db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dad03b02a61f53866c9bd93d8563c501

SHA1
169607c330de7926d86f24c97eaa0b5fae6093be

SHA256
c2368b8f05659bf50011eac4be40fde8dc5b63bcca6909ace4227c22ce9663c3

SHA512
d2ba1b624115429eb9b76a96a70c4982f5a51bafa57aaf5d7ac16b4add399ebf29ef3f9795d2234b7d4a36730efadbdfbc0a219a67973c9e9326a565990e6d9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82920b8e3f694a8f64ff53f520102548

SHA1
f848876f951d8560a7020f13d86606a23b1225fe

SHA256
1d25f0075244ec04f2a6cc7d5653f2d9a0827054aee31a2dd75b6cc6ed50169c

SHA512
a2cb02e4bb951f88dada4aec656522f400817ee0d784edcf58093d56ee7dc1447e0c8e7b0fc25f33c7fefe9a7fd32a82f4455c61a553636d6076aae10e95b5c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a8e4618618f3e1a592de15035200312

SHA1
1a3b89f0a9ed5a1c31a4c6544dbdd1a2612d2895

SHA256
875d24d85d0e08d3db22456325cdbbe2fbe95ae296d4b9ae2e99cd4bf57c35d0

SHA512
0b99d4b85d68cb8022dd1783a441645ee2f09a689cae0f6cc6a931d220ad7a55343f4ad9548ab8726b02faf53dbb1d56fa8d7acbee074fd69cb01bbe2475cbd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
893ccac1c982178a343a9148743e3529

SHA1
c55b8dd88f22293f650df79f714f693ffc10b66b

SHA256
de40ebccd76d0dd50b52ff26ba76126fc4a7879e33895d4f8f3ea8b53c5722e9

SHA512
4b33b91706c391c26994805f11cf94021ebe54708d641219ba8fc729402437541cb59adbd50294f5240c0b3a05ea68a6e11f34358415d3957964ffade9723c64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc51bfb8ccedf67a46e6e042bfd06c9d

SHA1
26ca37974309500273524f67a0236acebbb80bb0

SHA256
3ce9e312a2dc567a2609080c56ee153ce27f46b107edf5d356923f7ebbc7d96c

SHA512
44e710018d18bb7701bbc3b4678ea3f2349884545cde6cb719dfe617c6a069142524ee993df5ff2aa7cde9ab3c6994abe3aee439bf18a4f3881096b24bfb21b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecc9301d91fb93c48fc6dba817fc815b

SHA1
e70f3a76f610dd1bea077d99ce3a331ec1fa99eb

SHA256
5bd309a9b835f75ff991309b79f019655ffdc2d8b29ccefc46c6161037b431e3

SHA512
12f7257bcc38511dedb58388191d41362df5eb3143d9db4ac992c8122870cb6cb93fcf1a49ddbf52ddecc9f931d9220839da767ae2e98f17825f71714a14732c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eab35055cd8792d69e6d597e92074fad

SHA1
bf6e7fd3e2ee4f3649d52d4f555afb05d875519f

SHA256
66559a4f07b5ca191b78c64fd82affd5ae739c580314dfd269aa9089271f2f8d

SHA512
a65aa1a132e2e1806841425e1e1f1ea8340862055501a97adf68027f236c82b6374db6b103f0f5acf439966c7ca4b2bc386a4e87997a58dc774d7ca3fada4f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7f43db2e9683992d43b6da678f1e50a

SHA1
fbee8d950ab2597ec9ceced1819e5b659445fcb4

SHA256
d65f34de7c1d1973d775a53950619837bf75c17c8e9121db4ee66cfe53c9f1df

SHA512
2cf0c0cbf015b6283ae2a6438c0ebd6101950542f91e2686a4a5a0aeaaa19d319b72a34dd358d1b2ca1c42bb1bf609101177bd3a8ff838f5677cac8068ed9973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb4a31610588933c2e0e68bd0885c30d

SHA1
bcdcbbfa3d3915d9f1cb8a1965eb3fdac30052b4

SHA256
47095fc3e6c00d98a3de2e72e38d403232330d82ef80b0350b6b6ba6a80e2d81

SHA512
f772c595c24ae0d0c211f00d4b51326bd9c130097d4ced09ee8ff9a54202a6521e41930c3fe249b0586d50b26d05d5a7ac8713d13cb687a0cf5e448e1bc2385d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HM2KNRUS\freedesktopsoft[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HM2KNRUS\freedesktopsoft[1].xml

Filesize
5KB

MD5
53c8770652ea46132678534a6c9b14a0

SHA1
51ca9fb4b1c85c4004d41a9a5d8af9ff0a1b75bb

SHA256
381d9f7e4b07ff3cfbb60031a41a5f2782245c5a18e84ce9c56976d20077f199

SHA512
b025a2576d3281791bf9ed164e5c5554b8cf266700d64adc07b7af9c4e8cf36e15b97d8715eed53598cc4a09df54bd93a675299537083f987a126ca55708191d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\REKTWPR1\www.google[1].xml

Filesize
92B

MD5
78a2e81319879ddd44590662537645fd

SHA1
89af7fa26a42e357cd87c3c107125dd6a8bff7cc

SHA256
8747f5e0c178423e7dda7d97048a841ce191debded08aa1d19caed01ff6d7e3b

SHA512
b013bfdf28d3b87340882ff4b3ce54bd19f9f1597499d5cb6c8da99913b5877a5ba109463679fab2aced9eb4102362f1351a4d9ac96f9f400974ccec35f2d395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\60nmxlj\imagestore.dat

Filesize
1KB

MD5
f1dbda9571337cdbfbcb3e59cc7765b5

SHA1
c6f74e8cdc099ff28164f8905906b53686329233

SHA256
21945b7582422f4f34c3bf643aee570e8d9a0463c05ad42c185f415494b6b6a8

SHA512
05769cac0584303a15aeed44b09067c5ac471f37c4a368f804df88b1d8d1f78625651ffdbcda4f259e43d0b5eb807b75e45258b346cd1214ca6d93616591d719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\23EIUNT7\favicon[1].ico

Filesize
1KB

MD5
972196f80fc453debb271c6bfdf1d1be

SHA1
01965ba3f3c61a9a23d261bc69f7ef5abe0b2dc3

SHA256
769684bc8078079c7c13898e1cccce6bc8ddec801bafde8a6aec2331c532f778

SHA512
cb74de07067d43477bd62ab7875e83da00fad5ac1f9f08b8b30f5ebb14b1da720e0af5867b6e4ab2a02acd93f4134e26d9f1a56c896da071fc23a4241dc767f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQQVSTWU\Yk7kXw3xmNIEQwV5aHBYwiZqLRR9Phy-vB_38Kv_jbg[1].js

Filesize
52KB

MD5
9903ed9036b945330075bc960d5208ce

SHA1
9453578133fd06f30287f93f9eeaaccc45c173dc

SHA256
624ee45f0df198d204430579687058c2266a2d147d3e1cbebc1ff7f0abff8db8

SHA512
9fa3c30efec3a01acf4cee5a26bfaeb56d8fe0752e0778ef3b22c10fad604087f37a3363a576b542322455a026bce38f2284138eaaddf8e1dfa80945cd8d48de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22FD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24A9.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
\Program Files (x86)\Butterfly on Desktop\unins000.exe

Filesize
698KB

MD5
1fee4db19d9f5af7834ec556311e69dd

SHA1
ff779b9a3515b5a85ab27198939c58c0ad08da70

SHA256
3d550c908d5a8de143c5cd5f4fe431528cd5fa20b77f4605a9b8ca063e83fc36

SHA512
306652c0c4739fce284e9740397e4c8924cd31b6e294c18dd42536d6e00ad8d4c93d9642fe2408f54273d046f04f154f25948936930dd9c81255f3726f31ee65

Download Submit
\Users\Admin\AppData\Local\Temp\is-6LTKF.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-EPA6F.tmp\butterflyondesktop.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
memory/2368-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2368-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2368-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2392-7-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2392-59-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2392-16-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2392-19-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2392-49-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2760-692-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2760-825-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2760-824-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2760-693-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2760-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2760-691-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2760-690-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2760-689-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2760-1258-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2760-1259-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2760-1260-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads