6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
Size

981KB
MD5

b8a9491233cac3a3636821da151329d2
SHA1

7686d860ad1e60378a93054c33514771f67286c0
SHA256

6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b
SHA512

973ee75db9ef72fa9a5073b2b336840247ecdfb00fcc201f821b645c6a5021c246f39897e6a807d56b1d4e725c9ecce877ac22628ee91482616ec315fe843010
SSDEEP

12288:RnWwvHpVmXpjJIUd2DUusvalxPnWwvHpVmXpjJIUd2cUmsvalxR:9WTpjJI82IpWxPWTpjJI827xWxR

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\RKQ4D2J.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\RKQ4D2J.exe\""	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0009000000015616-94.dat	acprotect

Executes dropped EXE 5 IoCs

pid	Process
2692	service.exe
2568	smss.exe
2552	system.exe
2572	winlogon.exe
2316	lsass.exe

Loads dropped DLL 8 IoCs

pid	Process
1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015616-94.dat	upx
behavioral1/memory/2552-228-0x0000000010000000-0x0000000010075000-memory.dmp	upx
behavioral1/memory/2552-242-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\sOU5I7N0 = "C:\\Windows\\system32\\TON1U6PQVH0C0Y.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\0D2JVH = "C:\\Windows\\LNX5I7N.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\sOU5I7N0 = "C:\\Windows\\system32\\TON1U6PQVH0C0Y.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\0D2JVH = "C:\\Windows\\LNX5I7N.exe"	system.exe

Drops desktop.ini file(s) 28 IoCs

description	ioc	Process
File created	\??\UNC\SCFGBRBT\O$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\B$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\D$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\K$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\ADMIN$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\G$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\I$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\Q$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\Z$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\M$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\T$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\V$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\Y$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\P$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\S$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\U$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\E$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\H$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\J$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\L$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\C$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\R$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\W$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\X$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\A$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\F$\desktop.ini	lsass.exe
File created	\??\UNC\SCFGBRBT\N$\desktop.ini	lsass.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\U:	service.exe
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\I:	service.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\SysWOW64\DCF6K4V.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\TON1U6P.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\TON1U6P.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\DCF6K4V.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\TON1U6P.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\TON1U6PQVH0C0Y.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\TON1U6PQVH0C0Y.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\TON1U6PQVH0C0Y.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\TON1U6PQVH0C0Y.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\TON1U6PQVH0C0Y.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\DCF6K4V.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\DCF6K4V.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\TON1U6P.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\DCF6K4V.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S\TON1U6P.cmd	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\SysWOW64\MEF6I7S	system.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HLH6L3E.com	system.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\cypreg.dll	smss.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	service.exe
File opened for modification	C:\Windows\lsass.exe	service.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\cypreg.dll	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	system.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\QVH0C0Y.exe	lsass.exe
File created	C:\Windows\MooNlight.R.txt	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	service.exe
File opened for modification	C:\Windows\LNX5I7N.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HLH6L3E.com	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	lsass.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\QVH0C0Y.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	smss.exe
File opened for modification	C:\Windows\QVH0C0Y.exe	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\RKQ4D2J.exe	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\LNX5I7N.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HLH6L3E.com	service.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\RKQ4D2J.exe	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	service.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\RKQ4D2J.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HLH6L3E.com	smss.exe
File opened for modification	C:\Windows\QVH0C0Y.exe	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	smss.exe
File opened for modification	C:\Windows\lsass.exe	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\RKQ4D2J.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\lsass.exe	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\LNX5I7N.exe	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HLH6L3E.com	lsass.exe
File created	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip	system.exe
File opened for modification	C:\Windows\lsass.exe	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	smss.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\moonlight.dll	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
File opened for modification	C:\Windows\moonlight.dll	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	service.exe
File opened for modification	C:\Windows\LNX5I7N.exe	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	system.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2552	system.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
2568	smss.exe
2692	service.exe
2572	winlogon.exe
2552	system.exe
2316	lsass.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2692	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	28
PID 1660 wrote to memory of 2692	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	28
PID 1660 wrote to memory of 2692	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	28
PID 1660 wrote to memory of 2692	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	28
PID 1660 wrote to memory of 2568	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	29
PID 1660 wrote to memory of 2568	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	29
PID 1660 wrote to memory of 2568	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	29
PID 1660 wrote to memory of 2568	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	29
PID 1660 wrote to memory of 2552	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	30
PID 1660 wrote to memory of 2552	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	30
PID 1660 wrote to memory of 2552	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	30
PID 1660 wrote to memory of 2552	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	30
PID 1660 wrote to memory of 2572	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	31
PID 1660 wrote to memory of 2572	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	31
PID 1660 wrote to memory of 2572	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	31
PID 1660 wrote to memory of 2572	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	31
PID 1660 wrote to memory of 2316	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	32
PID 1660 wrote to memory of 2316	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	32
PID 1660 wrote to memory of 2316	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	32
PID 1660 wrote to memory of 2316	1660	6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe	32

C:\Users\Admin\AppData\Local\Temp\6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe
"C:\Users\Admin\AppData\Local\Temp\6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2692
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2568
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2552
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2572
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HLH6L3E.com

Filesize
981KB

MD5
5ac5b29a46d074703ed12c054b6f8c85

SHA1
0c91c16a4068409b9c3e4be3e6b764440f74f4ac

SHA256
7a308325c9f3aea461ebe635132f3392929a7980227d0f2ea5dbba9098ec709a

SHA512
f70225a0474444044246a8134ad07f79ddecf09e77a32fcd41b126b47f1c4caea396ac7300cadf7ed2c83498a1ee212844cb5382b79d3bd635e71aaa249688d7

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HLH6L3E.com

Filesize
981KB

MD5
138c1c6debd6e7048ef693da84da79b6

SHA1
5fbb3f25eee1eb30301f9a62fc063772cba07593

SHA256
6bfe4baffcd7ae6568112da673321aad5b4b6d99219e3fd9ddd05524fe3ffc9f

SHA512
dc9bc06dc38bb4ebe4960b436cdb032ca6d8cf1b68298ff1f7a8f65cc626696d1b24d316c9e89457b69d1fb354abc5bbd73da0cbfa793f68548ff5b7598f8fcd

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HLH6L3E.com

Filesize
64KB

MD5
3f5b19968e04afc15505e5eb96fe1734

SHA1
4438c1553a9f8ea268995685a710b715021bf5b9

SHA256
3c33914172622a76d7470abea5a91f095de4b28332641d2efbfb622af799fc6c

SHA512
219c6014cfe374752cd1dd50bb03630d009297635bebb20cee62f4d534287340a21781fdd590d319f9fd54a679355b2c2bbe86dce13fd90923f20186ec6be35f

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\RKQ4D2J.exe

Filesize
981KB

MD5
2d13004870e4b800b8792a0ed4a77ef9

SHA1
908d53a565ae105cb36e6f4293450827cf691e78

SHA256
b8baf1652458388ca1a94e5c48f93752bb95d53efa1dac18250d8f2600117d96

SHA512
4cdced938983563d48e30487f6f1f9675e284cbebfec322416eec5e8447b1948e3a0baff0641cbc324df3d639f542115d9909ee8b69c5473b38f4569b16169ca

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
981KB

MD5
f5adad55f5878a3b1b43f884fd67a479

SHA1
2cc04526f554ea33b2e61bc3e9cbed7c588f1a96

SHA256
8e4f187b5f9f1fdd46eb451ddc4b4119d27fffe8456b82d27fa0de2cc378f8a6

SHA512
6b1f67e7c733ab6aa00b47e331ebe284461dd56ab6ea7e2fbe64953b9fbfb846fc4e0eedd0fe17ccb9841daf019e9a9f668e3c13237e7a493ba6777855898b12

Download Submit
C:\Windows\LNX5I7N.exe

Filesize
981KB

MD5
d09622b0f347eec199b894fc9f2015b7

SHA1
a16ea7385c51c3263497233197da63b75389a777

SHA256
e10fb29d96172faf62f5d4793907fa2214ccfb54f2dae059f07015daba8b0f33

SHA512
d0acbb88dfa17991aa7c238774ac3eaa865e7f4389e7fed151c6460429589400008352c5f174c42c9527b9f9d211dfaf66bd880a795345d1dbc7db9d5878e444

Download Submit
C:\Windows\LNX5I7N.exe

Filesize
981KB

MD5
52e879201d27d5210371cd11fbedb1af

SHA1
eab2db2fcbe8cab2282323c1a84be9b10c2b278e

SHA256
b830de1cb498e83a3f0e9ae210dff23aeb2c954948b46d232ca7f54f2869cdf8

SHA512
a7d9c66446109271eedee10e1da098943f792e0e017c5c55f718390559b12137c840ad676b2eabfcfc01ce297d535d66fb0a2357e2b25532b615129697cf4764

Download Submit
C:\Windows\LNX5I7N.exe

Filesize
128KB

MD5
bf47e7e4f3410b822d4db67e6dd5ff58

SHA1
b378b8a7ef76cb1410cc79df22e9e4695d498101

SHA256
508b22f7a15ed568be92b8f76cba5a3a4294c138eb8197470a1b20bfc11d6c57

SHA512
b74e7c574050290932838e1acdc4ccd03c0500babf99f369dc09d5ddff74f1339a574a36a7c985e6979e4680842f14ca52aeeee8056e6b780c1b03f39456250a

Download Submit
C:\Windows\QVH0C0Y.exe

Filesize
896KB

MD5
607fd0197ae20ee18011f0070c768a52

SHA1
943c84ddf38bd06e733532727564e6ac1667bbfd

SHA256
f4f52aa0cc0c48c9d0a6f423b5ca2634abc4a4321f1a257678328dfb142a5308

SHA512
2f36ed4ffa9bcf290ce891b68dc9151a0b40709a35fbaf9bf10994c668becde9eb97d95ccfe75e95648419251e2dfcdd608bff68aa0795112d425da77798584b

Download Submit
C:\Windows\QVH0C0Y.exe

Filesize
128KB

MD5
af87613abe6a6f327a893957152edcfd

SHA1
39e7f1a2430fd37229c6095b95b8453383d4940a

SHA256
b43065d08ca0c18625fde6d088b73cbcc85033060414d0222b5734a8bb59e098

SHA512
5a45150c5d29f3510f6b3f0c094f6d25f899e27ee4c5ac393e2e4bbd8171a7c86fe341f149e2a5b6710ba924e367a7c2c59c6c130cfb62a07b261a618667e8c3

Download Submit
C:\Windows\QVH0C0Y.exe

Filesize
101KB

MD5
93f0a672508201db8e888675c6c137cd

SHA1
041eb466f929e621ef921986da859bb7b4b2160c

SHA256
0520ad6820415d4055a54372a6e7caae89974153f244bc701a19443629850fca

SHA512
b7b5dff57890777764fb682a53c40dfd83dba7c0a0a25b4c3db4cc10c8385eadb19ac04766205bc3e464dad17b427467986edf6c71d9f57c2ab51aa733b8d7d8

Download Submit
C:\Windows\SysWOW64\DCF6K4V.exe

Filesize
981KB

MD5
f908f29947c647a11aaf7dc09a6a6b14

SHA1
60a4a7f5765032416ff2130070086de34bcc2847

SHA256
195585b22a252ec7590375498ef889faa5bad0b388a8d3cfc8552d692a0d8adc

SHA512
b84bde0c997949f0e0ec47eabbbdd7707f052c26ad64cd321c1624fb2bcf4a2f292aa4131572f795df15b1f0afbc59374db535c0e39a16258dcb6f39672d1c34

Download Submit
C:\Windows\SysWOW64\DCF6K4V.exe

Filesize
981KB

MD5
1942362a577b1a61afeb52ef365ffdae

SHA1
26a7500d2b279e6770e6ef4bf768b95ee047b818

SHA256
8c710c1ead6a401f4d38a1bd1a6ab8d55de9f8b032ca6d0e69f0d6645d9a2aa7

SHA512
613f9bbfcf160f7f74a474e24f114167ff9ef0da990294fe22d0e69c378b1893af011c680a4e24f3f6c7929dd18d738e42740d1ceba43033ff3bc835c7794743

Download Submit
C:\Windows\SysWOW64\DCF6K4V.exe

Filesize
907KB

MD5
2c2db310f043f6cb7cabc54cde695c33

SHA1
4cc506e0d6b69ba1d74d0d6f97f19a0bff00b445

SHA256
a792093d223b0f2096e730e009cc2b3677aeeaf0ce54d2fe06502b3ec9ec500f

SHA512
0b881ba9ced2e99e742e9c6ab0f0561e614c65df9415c153f950e7a7ddee5dd7a3ec8906febafe6fac9424c52180de5c597ef3008cafc383ceb747e7f764a6a7

Download Submit
C:\Windows\SysWOW64\DCF6K4V.exe

Filesize
64KB

MD5
7c097e7278dc18f157439465465a0a58

SHA1
d420bcde5c2b602554c6d26545a7aa032b1d6cc6

SHA256
44aa5af0de4ad9a06639a3ff08e354e2bcd0701e699bdd171a59e5c7a43dce45

SHA512
2fb6ee986ff3b8ad372fd91eadce027f3321f259659d4f2d00f0b24f1dc079dc052a8b9338e0e97a7b96fe90b42a1b4584b77159400ead0bb38ddf3fa9a3ab8c

Download Submit
C:\Windows\SysWOW64\TON1U6PQVH0C0Y.exe

Filesize
981KB

MD5
b8a9491233cac3a3636821da151329d2

SHA1
7686d860ad1e60378a93054c33514771f67286c0

SHA256
6ff8d5f8850a7e3cb44953f1a78a292a4b354d1b1c805cce55279fc6d908ec9b

SHA512
973ee75db9ef72fa9a5073b2b336840247ecdfb00fcc201f821b645c6a5021c246f39897e6a807d56b1d4e725c9ecce877ac22628ee91482616ec315fe843010

Download Submit
C:\Windows\SysWOW64\TON1U6PQVH0C0Y.exe

Filesize
981KB

MD5
7eb7a6566d328fb924e770ae2c2c285f

SHA1
932241f21d712056188214d88384045b3c9a701c

SHA256
c59fe28b7baad6189166aa2a87678fef82640447c8197e035f6fa8c111501a9a

SHA512
7b14d40ea31a5ebecb46b5a86fbc7f8b3793505a7c74d9c5ef917eedba9f61fff4395414e6c13bb8f1159019bed4e216cc05d379f6e395f46ae3610dfa1ee597

Download Submit
C:\Windows\SysWOW64\TON1U6PQVH0C0Y.exe

Filesize
64KB

MD5
f72dd2541435f6701964f72f61d3cb7e

SHA1
00856212fa042907bfd1593337bb66cf8ea2eab3

SHA256
aa0fb53f0ce9dbc38b6252945ed234505febcc5e38582062d1393f0d3d76fdd7

SHA512
1269a9afc09e6e1608435f438fb8bcbc4a07ad3473fa5a000cbc5431d63066716b7e03b1864e62507e3c5340596bb61a68aa260a682990c3bdb36729c7fe89fa

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
dc8a22beaf1fa856834a045ccc0054c2

SHA1
3ef0a0fde51e0b38c9b226dd1440ae085fbd02bc

SHA256
324c30864d4d31e75dbbd612bec8f8db9783ad5e8ceef9d2d6a099314dcb3b74

SHA512
296a92bad701b62f83b75b06c8d3c4b98a4c8407e80a26399209693d02e6a1f21f837adc26cb0c18e4fe096974ad84bcc75c4635f423a9c7138e5ed7f3b33eaf

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
127B

MD5
cd86af0410b060eccc03aeb189436eda

SHA1
a31db1a2d4d24d54d27427183a881e7a2e9e183c

SHA256
26dc7dee39b67df9504e185cd265836d3a9118648087c1980c2d306b002fde34

SHA512
26733e9c3ce560f08fb03b6a8ea53dc2257fb6979a5841e89f337433a1acfdca1940d43abdf470dff4846a02b7ce580efa9221ff6d2b0ee040015bd531451655

Download Submit
C:\Windows\cypreg.dll

Filesize
417KB

MD5
b045b17d0ea4bf07c49a973ee0f051aa

SHA1
ab401855bcddfb3d86020885d5b9fe9e0cda63fa

SHA256
1fbc34b516034154520a98f6c92870e6c3937957b3716968d2a441cd5187233a

SHA512
d6b0d33e357d3edd01902adb9d009eb1e70e23ebc207ea507b2324d59d5ad415aa2a825bf6efe0584ac290e5af72341eebb0b02600a48d5b1fde9d2050669464

Download Submit
C:\Windows\cypreg.dll

Filesize
417KB

MD5
3e4aa52683adf2ae9b4ab3f64a02d1a2

SHA1
b7e309eb33f95a409401effd72f919c720030edb

SHA256
15c9ad0863df8f1db620e11044020a237fc27af295404ae62bc4bbd2608c5538

SHA512
2fb67a139fe992317e77c0acc291da363481a949f359b8472ceb0131c20a17d17d14d25682ab9b215290734532e564d72d75e8c1cc88d43dcd3fbba618732385

Download Submit
C:\Windows\lsass.exe

Filesize
981KB

MD5
b75ad126e8b44ed65377d09e74158028

SHA1
c185b8164490b7c2ad902a3b114ba71ea871afe9

SHA256
4adf53ecd7357348c216e1b6e278b3f7a4c9181ef5bd53fd9a01720616446334

SHA512
16e30b90be12d66de500fd12addee7960b7da1a437bb876585de864f2a5a18fc9bf090e418d40588338f5b4295f1e9d1b6bf940d07575d7d802b29b9a240a726

Download Submit
C:\Windows\lsass.exe

Filesize
981KB

MD5
9061d71ce004df466236bf2e320bddf3

SHA1
0778860e116315b32444d0d9b0a948a3d496efff

SHA256
6828c1eccfa8e613dc01df8b207251bcd39d4bb466a02ed367686dc76a8da676

SHA512
4ed1339d18585b97ff2f17b47894682a31d92675455f6309b494a6fed958b86a2dca5571ecba861a3cb5d002cf39f0596b9f76674410457e0b1cde5e11492d94

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.3MB

MD5
b821822bb2c66bee3975a0678ed0cfd2

SHA1
d5248d3579ec1e78e9701e286b9ec533e143e268

SHA256
fee1434388d771b4d9beb74200de6ae488ae80f1a7f2b22333dd921c60281192

SHA512
0c182bb8aac22553339c0641ecfeb1f2b43ec2e6c5c30800834afe3bfb33c37bab99657279ba82a388be824b47110b651d9872b96c9ca5797522b964b58570d0

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.3MB

MD5
0b56afade202c406eacbf7cdc87152e0

SHA1
6781240f65be24dd3d171f9b9d950b61349c565a

SHA256
494797cd029292876cea51dd6ef96e361416fc35682d2503dcb7ee989e77a98a

SHA512
5e2792f2ae7473218e92e7e40c39d0f46d31252205ec2fc4433f438797b3bb0d056847f882912ec2e4039c8229edc17e2e9e5b0f134bfab1e674b8273215ecb5

Download Submit
C:\cool.exe

Filesize
981KB

MD5
7f174420bd0db127592dcfee4076561c

SHA1
76c475740d32fad7a7c7635987af7e0d5c17cd8f

SHA256
18184eafb5c6843a79d0f7bcdcf614a36be54cde711f6ca5ebc4a4464e913d41

SHA512
a76de65582b2ab93e4082ac1b8f8738923f301b69e8e634fc775ceff0807b5877f202abf9d99443c4dcb539441c4d91da7dbfe0a5b990ff82ca86cd28d043dfb

Download Submit
\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
981KB

MD5
f6892edf08f0e84d0acdf484271f8225

SHA1
8e365edd1f2ff3e1eb90771caede278019d57f4b

SHA256
a6acbff015b2e0e707f29bb627131bb83593e7432448801fac80ae7bf1c4a451

SHA512
31309077265fb554440722041b7766ccb9e514969e94a5daf43fb0ce79982cca7befedc86816048c20184916307b67a90a84c1783148773e77deb85f1aad1da5

Download Submit
\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
981KB

MD5
25044ab6fdf7c89a484e5f01da7e5a65

SHA1
77f53f3b0ea11cfd917c2e78c2375071da099236

SHA256
b9d3f7237596b04f56d2ef70da3fbc9ca816e87aaa607de97c6231227fd01e7d

SHA512
6969593dc882ce869ad586600d03cd733f262bb08f3c3a1e2de1adcf07bc03cdf531e57a624d93cee78426a7b983f4cdf0fcde760febc266e011d738c1e79c89

Download Submit
\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe

Filesize
981KB

MD5
029bef7bb162b91646bf0fc59a56d32f

SHA1
7453fcd47a5cfdd236e5990d97e6df1c6b7e6309

SHA256
bdf7182f98a8f8bd8d5f4a8b867c0dd4764fa2360311afc2277c65ae9ad06ae8

SHA512
33905cc8766c921c93777f5027ca9bf870bd30b2552a0b3c9e74d7e829d94d5d3b465516f44d5cfccf6990bc24d617545f9a2ad6df27a52aca4243a8fa0e048d

Download Submit
memory/1660-79-0x0000000003510000-0x000000000356C000-memory.dmp

Filesize
368KB

Download
memory/1660-189-0x0000000003D80000-0x0000000003DDC000-memory.dmp

Filesize
368KB

Download
memory/1660-0-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1660-192-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1660-188-0x0000000003D80000-0x0000000003DDC000-memory.dmp

Filesize
368KB

Download
memory/1660-49-0x0000000003510000-0x000000000356C000-memory.dmp

Filesize
368KB

Download
memory/1660-65-0x0000000003510000-0x000000000356C000-memory.dmp

Filesize
368KB

Download
memory/2316-191-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2316-241-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2552-240-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2552-242-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/2552-91-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2552-228-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/2568-90-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2568-239-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2572-92-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2692-238-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2692-87-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads