Analysis
- max time kernel
308s - max time network
314s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
04/04/2024, 23:03
Static task
static1
Behavioral task
behavioral1
Sample
f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe
Resource
win7-20240221-en
windows7-x64
37 signatures
300 seconds
General
- Target f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe
- Size 401KB
- Sample240404-2127jadf46
- SHA256 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216
- MD5 5f48d3b5782fe1282b13a81089fb5ba8
- SHA1 cc3b8bd03e39458eaf4825e52efe3561ebb49bd8
- SHA512 a59a6714afbb8cb9d0099116dbf0c58a2668b18ea3714a0a7c9aa9427bc6bcb0cca8013f9ca9914dd427f1568c194d37d7da14ae052c1f82466ddf7d8dbfc684
- SSDEEP 12288:hmOCNKyhxbO+pOAZUpzi4dSZ1v5DZ3GwbwNMimW:hnAxqK3SztdSZVWwEnmW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Glupteba payload 30 IoCs
resource yara_rule behavioral2/memory/1376-131-0x0000000004F60000-0x000000000584B000-memory.dmp family_glupteba behavioral2/memory/3696-132-0x0000000005070000-0x000000000595B000-memory.dmp family_glupteba behavioral2/memory/3696-141-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-154-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-157-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3696-158-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3696-173-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-178-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3696-189-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-190-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3696-192-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-193-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3696-197-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-206-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3696-208-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-209-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3696-220-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-224-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3696-405-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-416-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-437-0x0000000004F60000-0x000000000584B000-memory.dmp family_glupteba behavioral2/memory/3696-855-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-862-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3696-866-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/1376-868-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3200-976-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/4696-989-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3200-1403-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/4696-1404-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba behavioral2/memory/3200-1535-0x0000000000400000-0x0000000002F40000-memory.dmp family_glupteba - Modifies firewall policy service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" qAsfUPMGIFlF65Z9sKdgORLO.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\CV2EDCcOoxI9QWwbC41UwSin.exe = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\SSPVCNRBrBdbEYFQcLxysQ8Z.exe = "0" SSPVCNRBrBdbEYFQcLxysQ8Z.exe - Downloads MZ/PE file
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\SETE1F0.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SETE1F0.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\VBoxDrv.sys MsiExec.exe - Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 4284 netsh.exe 3016 netsh.exe - Drops startup file 9 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qOJ58HuoKQQFp3VvcyvfsyQm.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7SiCwtuxOYcntrduNC8RpsZ.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zDyHdkrBTzJ13T8lgNZUd4Gg.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\V1Z6VOLb7TnWIgt4XhV83bUp.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HWQs7ybYzegCOTVgtriMoEdD.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\46P2kkEMESXe00Mgno9DCgye.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SNkOuSv17hSw00mWq284r9UT.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nMR3BykYHuMWaIN6itTjjH1t.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gcIOcZRLoOp47aYk54URTQZZ.bat installutil.exe - Executes dropped EXE 22 IoCs
pid Process 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 3696 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 1376 CV2EDCcOoxI9QWwbC41UwSin.exe 1796 8HYE8waSxic9BqtcxdNE4xcK.exe 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 1904 6k61FddqQPSk2e2KiUUeOfnn.exe 3336 6k61FddqQPSk2e2KiUUeOfnn.exe 512 6k61FddqQPSk2e2KiUUeOfnn.exe 4540 qAsfUPMGIFlF65Z9sKdgORLO.exe 4484 6k61FddqQPSk2e2KiUUeOfnn.exe 5100 Assistant_108.0.5067.20_Setup.exe_sfx.exe 4600 assistant_installer.exe 4216 assistant_installer.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 2888 CvZrDITVTivYVn6sS2fBIEdx.exe 1288 ce-installer_7.14.2_vbox-6.1.20.exe 4940 csrss.exe 3716 ce_7.14.2_windows_x86_64.exe 2976 injector.exe 360 windefender.exe 3060 windefender.exe - Loads dropped DLL 15 IoCs
pid Process 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 1904 6k61FddqQPSk2e2KiUUeOfnn.exe 3336 6k61FddqQPSk2e2KiUUeOfnn.exe 512 6k61FddqQPSk2e2KiUUeOfnn.exe 4484 6k61FddqQPSk2e2KiUUeOfnn.exe 4600 assistant_installer.exe 4600 assistant_installer.exe 4216 assistant_installer.exe 4216 assistant_installer.exe 4736 MsiExec.exe 4532 MsiExec.exe 4532 MsiExec.exe 4532 MsiExec.exe 4532 MsiExec.exe 4736 MsiExec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxProxyStub.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ThreadingModel = "Free" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32\ThreadingModel = "Both" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32\ = "\"C:\\Program Files\\Oracle\\VirtualBox\\VBoxSDS.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32\ = "\"C:\\Program Files\\Oracle\\VirtualBox\\VBoxSVC.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxC.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxC.dll" msiexec.exe -
resource yara_rule behavioral2/files/0x000800000001ac6f-1825.dat upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\CV2EDCcOoxI9QWwbC41UwSin.exe = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\SSPVCNRBrBdbEYFQcLxysQ8Z.exe = "0" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" CV2EDCcOoxI9QWwbC41UwSin.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" CvZrDITVTivYVn6sS2fBIEdx.exe Set value (str) \REGISTRY\USER\S-1-5-21-3727096518-2913484142-3593445157-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\S-1-5-21-3727096518-2913484142-3593445157-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" CV2EDCcOoxI9QWwbC41UwSin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3727096518-2913484142-3593445157-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe - Blocklisted process makes network request 1 IoCs
flow pid Process 79 4468 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe - Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: 6k61FddqQPSk2e2KiUUeOfnn.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\D: 6k61FddqQPSk2e2KiUUeOfnn.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: 6k61FddqQPSk2e2KiUUeOfnn.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: 6k61FddqQPSk2e2KiUUeOfnn.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 pastebin.com 4 pastebin.com - Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 57 api.myip.com 58 api.myip.com 61 ipinfo.io 62 ipinfo.io - Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe - Drops file in System32 directory 21 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.inf MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini qAsfUPMGIFlF65Z9sKdgORLO.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.inf MsiExec.exe File created C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys MsiExec.exe File opened for modification C:\Windows\System32\GroupPolicy qAsfUPMGIFlF65Z9sKdgORLO.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI qAsfUPMGIFlF65Z9sKdgORLO.exe File opened for modification C:\Windows\system32\DRVSTORE MsiExec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MsiExec.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol qAsfUPMGIFlF65Z9sKdgORLO.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe File created C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.cat MsiExec.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5028 set thread context of 3552 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 75 PID 1136 set thread context of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN SSPVCNRBrBdbEYFQcLxysQ8Z.exe File opened (read-only) \??\VBoxMiniRdrDN CV2EDCcOoxI9QWwbC41UwSin.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Oracle\VirtualBox\vbox-img.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxBugReport.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxGuestAdditions.iso msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_cs.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sl.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_cs.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat_postinstall.sh msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\debian_preseed.cfg msiexec.exe File created C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.sys msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hu.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_ja.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_pt_BR.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\msvcr100.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\x86\VBoxRT-x86.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ko.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_eu.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxCAPI.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.cat msiexec.exe File created C:\Program Files\Oracle\VirtualBox\sdk\install\vboxapi\VirtualBox_constants.py msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_pl.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\x86\VBoxClient-x86.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VirtualBox.chm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ja.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_sl.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.inf msiexec.exe File created C:\Program Files\Oracle\VirtualBox\x86\VBoxProxyStub-x86.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ubuntu_preseed.cfg msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_nt5_unattended.sif msiexec.exe File created C:\Program Files\Oracle\VirtualBox\msvcp100.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxHostChannel.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hr_HR.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\x86\msvcp100.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_en.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_it.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\License_en_US.rtf msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_bg.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_uk.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_en.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_fa.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_id.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_zh_CN.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_fa.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_lt.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat67_ks.cfg msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\fedora_ks.cfg msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxAuth.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_hr_HR.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_zh_TW.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\x86\msvcr100.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\lgw_ks.cfg msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pl.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_nl.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_ru.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel4_ks.cfg msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxHeadless.dll msiexec.exe - Drops file in Windows directory 24 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe CV2EDCcOoxI9QWwbC41UwSin.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI7405.tmp msiexec.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\Installer\{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}\IconVirtualBox msiexec.exe File created C:\Windows\Installer\e5aab0a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1A3B.tmp msiexec.exe File created C:\Windows\Installer\e5aab06.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\rss SSPVCNRBrBdbEYFQcLxysQ8Z.exe File opened for modification C:\Windows\Installer\MSIDF45.tmp msiexec.exe File opened for modification C:\Windows\rss CV2EDCcOoxI9QWwbC41UwSin.exe File created C:\Windows\Installer\SourceHash{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC} msiexec.exe File opened for modification C:\Windows\Installer\MSI7106.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA150.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1A8B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1DF8.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5aab06.msi msiexec.exe File created C:\Windows\rss\csrss.exe SSPVCNRBrBdbEYFQcLxysQ8Z.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Downloaded Installations\{CA40F441-F6FD-4494-9835-4F5534994BFF}\Charity Engine.msi ce_7.14.2_windows_x86_64.exe File opened for modification C:\Windows\Downloaded Installations\{CA40F441-F6FD-4494-9835-4F5534994BFF}\Charity Engine.msi ce_7.14.2_windows_x86_64.exe File opened for modification C:\Windows\windefender.exe csrss.exe File created C:\Windows\Installer\{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}\IconVirtualBox msiexec.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4864 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2256 schtasks.exe 1020 schtasks.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" SSPVCNRBrBdbEYFQcLxysQ8Z.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DDEF35E-4737-457B-99FC-BC52C851A44F}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5155BFD3-7BA7-45A8-B26D-C91AE3754E37}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{EE206A6E-7FF8-4A84-BD34-0C651E118BB5}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E8D3F27-B45C-48AE-8B36-D35E83D207AA}\ = "IFramebuffer" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FF5BEFC3-4BA3-7903-2AA4-43988BA11554}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{435B66A2-0C60-11EA-A0EA-07EB0D1C4EAD}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FAEF61E-6E15-4F71-A6A5-94E707FAFBCC}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{24EEF068-C380-4510-BC7C-19314A7352F1}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CC49055-DAD4-4496-85CF-3F76BCB3B5FA}\ = "ISnapshot" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50CE4B51-0FF7-46B7-A138-3C6E5AC946B4}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0F7B8A22-C71F-4A36-8E5F-A77D01D76090} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00AE6AF4-00A7-4104-0009-49BC00B2DA80}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B3CDEB2-808E-11E9-B773-133D9330F849}\NumMethods\ = "13" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48C7F4C0-C9D6-4742-957C-A6FD52E8C4AE}\ = "IBandwidthControl" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{C39EF4D6-7532-45E8-96DA-EB5986AE76E4}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6BB335CC-1C58-440C-BB7B-3A1397284C7B}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C984D15F-E191-400B-840E-970F3DAD7296}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4F4ADCF6-3E87-11E9-8AF2-576E84223953}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ABE94809-2E88-4436-83D7-50F3E64D0503}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{179F8647-319C-4E7E-8150-C5837BD265F6}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{00391758-00B1-4E9D-0000-11FA00F9D583} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DDEF35E-4737-457B-99FC-BC52C851A44F}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D803B4-9B2D-4377-BFE6-9702E881516B}\TypeLib\Version = "1.3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3E14C189-4A75-437E-B0BB-7E7C90D0DF2A}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{714A3EEF-799A-4489-86CD-FE8E45B2FF8E} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{D3D5F1EE-BCB2-4905-A7AB-CC85448A742B}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11BE93C7-A862-4DC9-8C89-BF4BA74A886A}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CB6F0F2C-8384-11E9-921D-8B984E28A686}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11BE93C7-A862-4DC9-8C89-BF4BA74A886A}\NumMethods\ = "18" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59A235AC-2F1A-4D6C-81FC-E3FA843F49AE}\ = "IFile" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{6620DB85-44E0-CA69-E9E0-D4907CECCBE5} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{A5BBDB7D-8CE7-469F-A4C2-6476F581FF72}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5ABC823-04D0-4DB6-8D66-DC2F033120E1}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9A0C183-7071-4894-93D6-DCBEC010FA91}\ = "INetworkAdapter" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00AE6AF4-00A7-4104-0009-49BC00B2DA80}\ = "IMachineDebugger" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10CD08D0-E8B8-4838-B10C-45BA193734C1}\TypeLib\Version = "1.3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00391758-00B1-4E9D-0000-11FA00F9D583}\ = "IClipboardFileTransferModeChangedEvent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2514881B-23D0-430A-A7FF-7ED7F05534BC}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81314D14-FD1C-411A-95C5-E9BB1414E632}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27C0B3D-6038-422C-B45E-6D4A0503D9F1}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9709DB9B-3346-49D6-8F1C-41B0C4784FF2}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EE3CBCB-486F-40DB-9150-DEEE3FD24189}\ = "IGuestFileReadEvent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C5E945F-2354-4267-883F-2F417D216519}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97C78FCD-D4FC-485F-8613-5AF88BFCFCDC}\ = "IVBoxSVCAvailabilityChangedEvent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vhd\ = "progId_VirtualBox.Shell.vhd" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{08889892-1EC6-4883-801D-77F56CFD0103}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{24EEF068-C380-4510-BC7C-19314A7352F1}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6FA2671B-0547-448E-BC7C-94E9E173BF57}\ = "IHostUpdate" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D984A7E-B855-40B8-AB0C-44D3515B4528}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4638054-F1F8-4590-941A-CDB66075C5BF}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{07541941-8079-447A-A33E-47A69C7980DB}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{081FC833-C6FA-430E-6020-6A505D086387}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D0D93830-70A2-487E-895E-D3FC9679F7B3}\ = "IGuestFileRegisteredEvent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0447716-FF5A-4795-B57A-ECD5FFFA18A4}\NumMethods\ = "26" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\VirtualBox.VirtualBoxClient\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{AD47AD09-787B-44AB-B343-A082A3F2DFB1}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C39EF4D6-7532-45E8-96DA-EB5986AE76E4}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{00AE6AF4-00A7-4104-0009-49BC00B2DA80}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{16CED992-5FDC-4ABA-AFF5-6A39BBD7C38B}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5BBDB7D-8CE7-469F-A4C2-6476F581FF72}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9A0C183-7071-4894-93D6-DCBEC010FA91}\NumMethods\ = "58" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{890ED3DC-CC19-43FA-8EBF-BAECB6B9EC87}\TypeLib msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 6k61FddqQPSk2e2KiUUeOfnn.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e 6k61FddqQPSk2e2KiUUeOfnn.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e 6k61FddqQPSk2e2KiUUeOfnn.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 3348 powershell.exe 3348 powershell.exe 3348 powershell.exe 4540 qAsfUPMGIFlF65Z9sKdgORLO.exe 4540 qAsfUPMGIFlF65Z9sKdgORLO.exe 32 powershell.exe 32 powershell.exe 4956 powershell.exe 4956 powershell.exe 32 powershell.exe 4956 powershell.exe 4956 powershell.exe 32 powershell.exe 3696 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 3696 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 1376 CV2EDCcOoxI9QWwbC41UwSin.exe 1376 CV2EDCcOoxI9QWwbC41UwSin.exe 2096 powershell.exe 2096 powershell.exe 2096 powershell.exe 4412 powershell.exe 4412 powershell.exe 4412 powershell.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 4696 CV2EDCcOoxI9QWwbC41UwSin.exe 2092 powershell.exe 2092 powershell.exe 2092 powershell.exe 2296 powershell.exe 2296 powershell.exe 2296 powershell.exe 2092 powershell.exe 2296 powershell.exe 1020 powershell.exe 1020 powershell.exe 804 powershell.exe 804 powershell.exe 1020 powershell.exe 804 powershell.exe 1020 powershell.exe 804 powershell.exe 4468 msiexec.exe 4468 msiexec.exe 3948 powershell.exe 3948 powershell.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 640 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe Token: SeDebugPrivilege 3348 powershell.exe Token: SeDebugPrivilege 3552 installutil.exe Token: SeIncreaseQuotaPrivilege 3348 powershell.exe Token: SeSecurityPrivilege 3348 powershell.exe Token: SeTakeOwnershipPrivilege 3348 powershell.exe Token: SeLoadDriverPrivilege 3348 powershell.exe Token: SeSystemProfilePrivilege 3348 powershell.exe Token: SeSystemtimePrivilege 3348 powershell.exe Token: SeProfSingleProcessPrivilege 3348 powershell.exe Token: SeIncBasePriorityPrivilege 3348 powershell.exe Token: SeCreatePagefilePrivilege 3348 powershell.exe Token: SeBackupPrivilege 3348 powershell.exe Token: SeRestorePrivilege 3348 powershell.exe Token: SeShutdownPrivilege 3348 powershell.exe Token: SeDebugPrivilege 3348 powershell.exe Token: SeSystemEnvironmentPrivilege 3348 powershell.exe Token: SeRemoteShutdownPrivilege 3348 powershell.exe Token: SeUndockPrivilege 3348 powershell.exe Token: SeManageVolumePrivilege 3348 powershell.exe Token: 33 3348 powershell.exe Token: 34 3348 powershell.exe Token: 35 3348 powershell.exe Token: 36 3348 powershell.exe Token: SeDebugPrivilege 32 powershell.exe Token: SeDebugPrivilege 4956 powershell.exe Token: SeDebugPrivilege 3696 SSPVCNRBrBdbEYFQcLxysQ8Z.exe Token: SeImpersonatePrivilege 3696 SSPVCNRBrBdbEYFQcLxysQ8Z.exe Token: SeDebugPrivilege 1376 CV2EDCcOoxI9QWwbC41UwSin.exe Token: SeImpersonatePrivilege 1376 CV2EDCcOoxI9QWwbC41UwSin.exe Token: SeDebugPrivilege 2096 powershell.exe Token: SeDebugPrivilege 4412 powershell.exe Token: SeShutdownPrivilege 4456 msiexec.exe Token: SeIncreaseQuotaPrivilege 4456 msiexec.exe Token: SeSecurityPrivilege 4468 msiexec.exe Token: SeCreateTokenPrivilege 4456 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4456 msiexec.exe Token: SeLockMemoryPrivilege 4456 msiexec.exe Token: SeIncreaseQuotaPrivilege 4456 msiexec.exe Token: SeMachineAccountPrivilege 4456 msiexec.exe Token: SeTcbPrivilege 4456 msiexec.exe Token: SeSecurityPrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeLoadDriverPrivilege 4456 msiexec.exe Token: SeSystemProfilePrivilege 4456 msiexec.exe Token: SeSystemtimePrivilege 4456 msiexec.exe Token: SeProfSingleProcessPrivilege 4456 msiexec.exe Token: SeIncBasePriorityPrivilege 4456 msiexec.exe Token: SeCreatePagefilePrivilege 4456 msiexec.exe Token: SeCreatePermanentPrivilege 4456 msiexec.exe Token: SeBackupPrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeShutdownPrivilege 4456 msiexec.exe Token: SeDebugPrivilege 4456 msiexec.exe Token: SeAuditPrivilege 4456 msiexec.exe Token: SeSystemEnvironmentPrivilege 4456 msiexec.exe Token: SeChangeNotifyPrivilege 4456 msiexec.exe Token: SeRemoteShutdownPrivilege 4456 msiexec.exe Token: SeUndockPrivilege 4456 msiexec.exe Token: SeSyncAgentPrivilege 4456 msiexec.exe Token: SeEnableDelegationPrivilege 4456 msiexec.exe Token: SeManageVolumePrivilege 4456 msiexec.exe Token: SeImpersonatePrivilege 4456 msiexec.exe Token: SeCreateGlobalPrivilege 4456 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 32 LogonUI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5028 wrote to memory of 3348 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 73 PID 5028 wrote to memory of 3348 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 73 PID 5028 wrote to memory of 3552 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 75 PID 5028 wrote to memory of 3552 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 75 PID 5028 wrote to memory of 3552 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 75 PID 5028 wrote to memory of 3552 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 75 PID 5028 wrote to memory of 3552 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 75 PID 5028 wrote to memory of 3552 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 75 PID 5028 wrote to memory of 3552 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 75 PID 5028 wrote to memory of 3552 5028 f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe 75 PID 3552 wrote to memory of 1136 3552 installutil.exe 78 PID 3552 wrote to memory of 1136 3552 installutil.exe 78 PID 3552 wrote to memory of 1136 3552 installutil.exe 78 PID 3552 wrote to memory of 3696 3552 installutil.exe 79 PID 3552 wrote to memory of 3696 3552 installutil.exe 79 PID 3552 wrote to memory of 3696 3552 installutil.exe 79 PID 3552 wrote to memory of 1376 3552 installutil.exe 80 PID 3552 wrote to memory of 1376 3552 installutil.exe 80 PID 3552 wrote to memory of 1376 3552 installutil.exe 80 PID 1136 wrote to memory of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 PID 1136 wrote to memory of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 PID 1136 wrote to memory of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 PID 1136 wrote to memory of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 PID 1136 wrote to memory of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 PID 1136 wrote to memory of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 PID 1136 wrote to memory of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 PID 1136 wrote to memory of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 PID 1136 wrote to memory of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 PID 1136 wrote to memory of 1796 1136 8HYE8waSxic9BqtcxdNE4xcK.exe 82 PID 3552 wrote to memory of 1860 3552 installutil.exe 83 PID 3552 wrote to memory of 1860 3552 installutil.exe 83 PID 3552 wrote to memory of 1860 3552 installutil.exe 83 PID 1860 wrote to memory of 1904 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 84 PID 1860 wrote to memory of 1904 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 84 PID 1860 wrote to memory of 1904 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 84 PID 1860 wrote to memory of 3336 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 85 PID 1860 wrote to memory of 3336 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 85 PID 1860 wrote to memory of 3336 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 85 PID 1860 wrote to memory of 512 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 87 PID 1860 wrote to memory of 512 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 87 PID 1860 wrote to memory of 512 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 87 PID 3552 wrote to memory of 4540 3552 installutil.exe 86 PID 3552 wrote to memory of 4540 3552 installutil.exe 86 PID 512 wrote to memory of 4484 512 6k61FddqQPSk2e2KiUUeOfnn.exe 88 PID 512 wrote to memory of 4484 512 6k61FddqQPSk2e2KiUUeOfnn.exe 88 PID 512 wrote to memory of 4484 512 6k61FddqQPSk2e2KiUUeOfnn.exe 88 PID 1376 wrote to memory of 4956 1376 CV2EDCcOoxI9QWwbC41UwSin.exe 93 PID 1376 wrote to memory of 4956 1376 CV2EDCcOoxI9QWwbC41UwSin.exe 93 PID 1376 wrote to memory of 4956 1376 CV2EDCcOoxI9QWwbC41UwSin.exe 93 PID 3696 wrote to memory of 32 3696 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 92 PID 3696 wrote to memory of 32 3696 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 92 PID 3696 wrote to memory of 32 3696 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 92 PID 1860 wrote to memory of 5100 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 96 PID 1860 wrote to memory of 5100 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 96 PID 1860 wrote to memory of 5100 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 96 PID 1860 wrote to memory of 4600 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 97 PID 1860 wrote to memory of 4600 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 97 PID 1860 wrote to memory of 4600 1860 6k61FddqQPSk2e2KiUUeOfnn.exe 97 PID 4600 wrote to memory of 4216 4600 assistant_installer.exe 98 PID 4600 wrote to memory of 4216 4600 assistant_installer.exe 98 PID 4600 wrote to memory of 4216 4600 assistant_installer.exe 98 PID 3200 wrote to memory of 2096 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 104 PID 3200 wrote to memory of 2096 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 104 PID 3200 wrote to memory of 2096 3200 SSPVCNRBrBdbEYFQcLxysQ8Z.exe 104 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe"C:\Users\Admin\AppData\Local\Temp\f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5028 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f0cfb77c569eb902fec30abfc3a70409a33e2dc49111dc246ea0596361377216.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\Pictures\8HYE8waSxic9BqtcxdNE4xcK.exe"C:\Users\Admin\Pictures\8HYE8waSxic9BqtcxdNE4xcK.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\Pictures\8HYE8waSxic9BqtcxdNE4xcK.exe"C:\Users\Admin\Pictures\8HYE8waSxic9BqtcxdNE4xcK.exe"4⤵
- Executes dropped EXE
PID:1796
-
-
-
C:\Users\Admin\Pictures\SSPVCNRBrBdbEYFQcLxysQ8Z.exe"C:\Users\Admin\Pictures\SSPVCNRBrBdbEYFQcLxysQ8Z.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:32
-
-
C:\Users\Admin\Pictures\SSPVCNRBrBdbEYFQcLxysQ8Z.exe"C:\Users\Admin\Pictures\SSPVCNRBrBdbEYFQcLxysQ8Z.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:2564
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:4284
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2296
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:804
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:4940 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:2256
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵PID:2980
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4704
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3248
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
PID:2976
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:1020
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
PID:360 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵PID:212
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
PID:4864
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\CV2EDCcOoxI9QWwbC41UwSin.exe"C:\Users\Admin\Pictures\CV2EDCcOoxI9QWwbC41UwSin.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
C:\Users\Admin\Pictures\CV2EDCcOoxI9QWwbC41UwSin.exe"C:\Users\Admin\Pictures\CV2EDCcOoxI9QWwbC41UwSin.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4696 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:2920
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:3016
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2092
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1020
-
-
-
-
C:\Users\Admin\Pictures\6k61FddqQPSk2e2KiUUeOfnn.exe"C:\Users\Admin\Pictures\6k61FddqQPSk2e2KiUUeOfnn.exe" --silent --allusers=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\Pictures\6k61FddqQPSk2e2KiUUeOfnn.exeC:\Users\Admin\Pictures\6k61FddqQPSk2e2KiUUeOfnn.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6fb0e1d0,0x6fb0e1dc,0x6fb0e1e84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\6k61FddqQPSk2e2KiUUeOfnn.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\6k61FddqQPSk2e2KiUUeOfnn.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3336
-
-
C:\Users\Admin\Pictures\6k61FddqQPSk2e2KiUUeOfnn.exe"C:\Users\Admin\Pictures\6k61FddqQPSk2e2KiUUeOfnn.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1860 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240404230420" --session-guid=36354681-2610-4f51-b77b-ca6eb7327057 --server-tracking-blob=Y2Y4YzgyNTAzNTg0ZTUzN2RjODliNjdlMjFlMWYzOWFlYmRkMDU0ZjFiNjgzZDdjMDc4ZjBlNDA3ZTFiNGQ4Yjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N18xMjMiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIyNzE4NTAuOTkzMSIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N18xMjMiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6ImI0NDEyMGY5LWQwMzktNDliNy1iZjEwLWY5ZTI1OGFiYjAwZiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=C4040000000000004⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\Pictures\6k61FddqQPSk2e2KiUUeOfnn.exeC:\Users\Admin\Pictures\6k61FddqQPSk2e2KiUUeOfnn.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2ac,0x2b0,0x2b4,0x27c,0x2b8,0x6e97e1d0,0x6e97e1dc,0x6e97e1e85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4484
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"4⤵
- Executes dropped EXE
PID:5100
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x248,0x24c,0x250,0x234,0x254,0xe10040,0xe1004c,0xe100585⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4216
-
-
-
-
C:\Users\Admin\Pictures\qAsfUPMGIFlF65Z9sKdgORLO.exe"C:\Users\Admin\Pictures\qAsfUPMGIFlF65Z9sKdgORLO.exe"3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4540
-
-
C:\Users\Admin\Pictures\CvZrDITVTivYVn6sS2fBIEdx.exe"C:\Users\Admin\Pictures\CvZrDITVTivYVn6sS2fBIEdx.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe4⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\SYSTEM32\msiexec.exe"msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe"ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3716 -
C:\Windows\SYSTEM32\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Windows\Downloaded Installations\{CA40F441-F6FD-4494-9835-4F5534994BFF}\Charity Engine.msi" /qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\IXP000.TMP" SETUPEXENAME="ce_7.14.2_windows_x86_64.exe"6⤵PID:2160
-
-
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:4748
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:424
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8BC66277EBEC596E20595A72A64D46652⤵
- Loads dropped DLL
PID:4736
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 02EC553D2D8872C6EBA603C2ACD31F5B E Global\MSI00002⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4532
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6AB29C25EFE7F081AE10355587E06F77 M Global\MSI00002⤵PID:1740
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
PID:3060
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3af5855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:32
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5aab09.rbs
- Size 894KB
- SHA256 7ba665330102953d4054f40f4c0fc1fa4234c7a13921d6a90baff1584f72ac49
- MD5 6551d7c9b2eca1e6962db5683b07dca3
- SHA1 24c607da6309b3441b0a0ed71f4f58a502523b45
- SHA512 2ec29813202f160e6f609f9061aaad0c10b6fc784fb70dd9ffd27fd5591098827e6ed1c5aeb632c146baf189c7171478840c06652843d22f62ff4f688aaad8f6
- SSDEEP 6144:ruG1AiB9PqvByOQV9xEMvvKKqS4s9Wj+WDUweVwHmkLlcD/lnr/3yIWAB111U:LN0kDhDWj+WDUweVFkSTlGIWv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
- Size 2.5MB
- SHA256 fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348
- MD5 20d293b9bf23403179ca48086ba88867
- SHA1 dedf311108f607a387d486d812514a2defbd1b9e
- SHA512 5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6
- SSDEEP 49152:WpEtY+ZMkWoGj5Yn5oayKr2ytwc44Qeg63lfPa9mtfdf6p71:WUQq5bPtnYeDfPa9oN651
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\assistant\assistant_installer.exe
- Size 1.9MB
- SHA256 3ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7
- MD5 b3f05009b53af6435e86cfd939717e82
- SHA1 770877e7c5f03e8d684984fe430bdfcc2cf41b26
- SHA512 d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27
- SSDEEP 49152:1vxvrJgfz93FORZZcyKeNHYRkr513s7xKAsaL7s2lJS0yal2O+:1vxvrJgfz930vcGN4Robs7xls67s2lJE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\assistant\dbghelp.dll
- Size 1.7MB
- SHA256 6d02ebd4ec9a6093f21cd8ccefb9445fa0ab7b1f69ac868a5cfc5d28ed8d2de9
- MD5 925ea07f594d3fce3f73ede370d92ef7
- SHA1 f67ea921368c288a9d3728158c3f80213d89d7c2
- SHA512 a809851da820d9fdd8fb860a8f549311dcc2579df2c6f6fba74f50d5d8bf94baa834b09fb5476ac248f18d1deb6b47d4fdd6d658889d5d45ca8774a9264483d2
- SSDEEP 49152:Fl8mF7ZT8IQD8TTmP8VtEjXv9rKdeqpNC+E62/5:Fl8mF7ZT8IQD8F8jfNsTJEN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\opera_package
- Size 103.9MB
- SHA256 473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b
- MD5 f9172d1f7a8316c593bdddc47f403b06
- SHA1 ed1e5a40b040af2c60ed6c2536b3bf7ee55e0e52
- SHA512 f51ab2bdf29ca6839e4f7cf1fac1bdfc03ba2da4569a8f21e5d2ee13e6519097c3da40bf0b4ca7642286ed033d0126bbd14ef7842eb9f2db1d6e503849521b02
- SSDEEP 3145728:S+ayq92nwGon6Q2G24ciIVAE3FA+Hly3y:PO92nsn6MaVX37E3y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VirtualBox-6.1.20-r143896.msi
- Size 101.9MB
- SHA256 5e4fd3d3aa4666014213cd384da90d59bcd77bc7ae7fedcb6951e9c4945fc0fb
- MD5 a198248d82bcfe0548af2dd8b5d234c9
- SHA1 b48db4ee1171682510b7f9768a119da78937f0bd
- SHA512 ebff424004dccf67613e3caa5a04d6865f581125cec31539d86d9bc89e89a0571f979c1a877d651bbcb63aa4cc1c6569cc6af64d69dd0a9b0ddde28b0e24d878
- SSDEEP 1572864:6M0aBuvsKBc2Wc+a7mib+4KR7qnMLTA+wwJ5aQvpZ76Rw+ytniH8/jEflHmM:3uE25+Iz+407zbh5z5tU8/jEfU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
- Size 158KB
- SHA256 a6ad9d59c8b2dcef13da38edd6a7339072840d2691a85ff07bd00a5ac300cb9e
- MD5 b0e01c5413b9a6b760acf7a495bb3416
- SHA1 d8f105ae851eb0da195502635ee9a803c088f7bb
- SHA512 c525ded66ddf5219ab9d5914c9a9c81bb618134e189269627867e6df4f432fc455a70f4923d8fa9f563670148ce9b323a45dcb0edda12864368f03ca1eab4920
- SSDEEP 3072:PQ6xn9yOASYYgce15EgpHnCLkh+pzFT4RRA5GWGnN4TAP:PhnES1gce1HpHCL7R4zhxP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe
- Size 9.1MB
- SHA256 564bf3600f612e5ff0e4c9bf3cc5eaf3b45e97d050f43da72d475c755b247cf6
- MD5 20e63b1dee3107f67b55967b9c1f3cf9
- SHA1 a030db13ae7b034d495637033686dc733a05d7f2
- SHA512 f2c8c842af1b9d8736462d5dcc18074af48fcbe80d8e05ad7d23bf701fe13f94a7e0e35ccefe46758393b64d654dfefdf1d32cd5c29285ff558b5cfde60dd105
- SSDEEP 196608:mzytBOL5SJFeovfgROzNzM8x4V4/KS/cydkElF28YgqRaP:mzyg5noRzNzMmw4CZapL28MW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.cfg
- Size 6B
- SHA256 1db4af39a74048a8e19a92b2cfda4e6d2577b8073915e00f5b305031db227e4d
- MD5 08adf158c610aceaa735ea78248e909e
- SHA1 e9fdb470cd39bd8d4175bb5f3b00d665a89d9dab
- SHA512 339c6113cf6b2f96d8557109ccb5ac891ab64ab255a2af95161af51504908c4ddff704af3818090a02f1be0e0a52708101fdbda269167cc21c856993a7cd4e32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_plhgxmdg.upu.ps1
- Size 1B
- SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
- MD5 c4ca4238a0b923820dcc509a6f75849b
- SHA1 356a192b7913b04c54574d18c28d46e6395428ab
- SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\_is737C.tmp
- Size 1KB
- SHA256 ea3bf541fda20b288238748ee98adbb296a2432e89bb170099c12aa04b235b56
- MD5 38abb1658fbd39ad6351400246789dff
- SHA1 7d0d61adbba2d4781022240d30e35a885c61299d
- SHA512 232f105e45123899ec70940037f7fd97e2cbc9f3209f0cf2787b4266a9295e7a6fc7d34128003dcd7c15e2291134e78bf65ed4f7126b631907fd3d2beb11fba7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
- Size 281KB
- SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
- MD5 d98e33b66343e7c96158444127a117f6
- SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
- SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
- SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{64D55B14-EB5D-479C-8695-55A5C88E7471}\0x0409.ini
- Size 21KB
- SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
- MD5 be345d0260ae12c5f2f337b17e07c217
- SHA1 0976ba0982fe34f1c35a0974f6178e15c238ed7b
- SHA512 77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
- SSDEEP 384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{64D55B14-EB5D-479C-8695-55A5C88E7471}\_ISMSIDEL.INI
- Size 20B
- SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
- MD5 db9af7503f195df96593ac42d5519075
- SHA1 1b487531bad10f77750b8a50aca48593379e5f56
- SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\~7137.tmp
- Size 5KB
- SHA256 c6429a015801230766a064c4bdb45327a3c6943bc32d96f1a341a2199d7a69da
- MD5 7caf5391ba50527d23a1c9f15db103d1
- SHA1 da9caf14019a8c2e3dca42415bd0941109ed51b2
- SHA512 e643309ce03247e8214e9aa6ff9eb89409676e815d12b65c752716929a3e5cbc7d322ed0e2a3d62378a8d6175c2a3f38d901bb10b7ff2800e818ebe97b7f307e
- SSDEEP 96:rEhkMTE44Fh4wON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlnAMc:YhB0h8cuQaEZhdxoIWRGcQbPr/p0050V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
- Size 40B
- SHA256 fce71d8f4da17fd27cb210a04c8c56cd13843cf2c3a0dfdc5da3ffc841f94c1e
- MD5 6a533446c74cbe8651109907ebd392cd
- SHA1 0fc62378669c9191b7407e843a34500e73ae86d7
- SHA512 c537797d38cca7e4a6f8d17a443514cab6569df0555c633a3145bf32061c9e83fbc9bd7c9d84a1cf6a407436aeaec08a69bb80998b76769ebb9d70477cb7d5cf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Pictures\6k61FddqQPSk2e2KiUUeOfnn.exe
- Size 5.1MB
- SHA256 3070a12a12325dcdd9996843317457dd57c5c92aee13a93e73066bb5758f1655
- MD5 5e91be8d34f6de43d6d0d7dee0faf6d3
- SHA1 741229d5d86918163e52c5b34f4f7d800e8ef013
- SHA512 40548794e1ab6c18deed3f5ebfe70029f70162871312c108f4aa1b0feb813d6da6dbc8212c67093aec88e25085fdee0b560a3f21f370c3d87f8e69e3228c5381
- SSDEEP 98304:g0NFG6666666666666666666666666666666x666666666666666fwwwwwwwwwwS:pIOT2I5mTtpbvphIGZeXMxOjGe809wZ8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Pictures\8HYE8waSxic9BqtcxdNE4xcK.exe
- Size 344KB
- SHA256 7827ef500933af282d9aaa20d835f82910c2abfb221dad8dd4980c0eefb578bf
- MD5 8270fda454a2261c1e7af0b0ca1f977a
- SHA1 1791e713f6b1f9adceb86b1d82ee14faf67ec5f4
- SHA512 b7a3efa71033a8e172ebec4ab99a99268ef157befbc0e4b10547b884a78bc15f90c2bbda2bc0233ef7631231cf9e5f9e5a7cfbdd46e95276b4649ce82c006c0b
- SSDEEP 6144:UCnqiSd2DNnc2qXbmWn5FnN+gSslFzgHaEGdFD3gr0V80tnl/:UGqiSd2Nb+bhn5FnN+gSuFcHNGdF7xl/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Pictures\CvZrDITVTivYVn6sS2fBIEdx.exe
- Size 108.6MB
- SHA256 ca6a2a6e7a3361c22c40900f58d221a1a337cd4a44e4e97840bb7e85a5f5085a
- MD5 d2a1400da7889266674cc21bbcb82f3a
- SHA1 cb9121fbcf78a38fedcca0d16630b9c038108e83
- SHA512 d677bc46a0a8660c7c486ccd756920f24f85d5b1887711e74829f4eb74f411a4b7d3f519303d972d32adfeb7b1bc9fd7da0f5fbb75b2d172c461510a4a65d5bf
- SSDEEP 3145728:gufOYvugqfb5sZYV4p2SYugQXvKzCG7n6uPxV:gPYvKb6ZCyTTXvK57nxPxV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Pictures\H63rI6CT3Qn6VwWQfwcTQyJU.exe
- Size 3KB
- SHA256 a8852ba5b0f7e4e50e472a13a2d6258c7724a8393eec027ebb46f6a9e1b8d857
- MD5 16c1f567ded04591fdc06d18621bda1b
- SHA1 bb12a3dba1afaabc4e70811011bf24c18bc53100
- SHA512 050d8e1a883dceed76b88b827d7dbccc97f9b76b881f03d17bc81b67707bb2012bb155b9c2a0b1848a298e2b91398e3d7fd427dd7a3a12a6e8ec0ca300680ac6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Pictures\OJ5WkadKsQ2ixVXXeQ46rqdM.exe
- Size 7KB
- SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
- MD5 5b423612b36cde7f2745455c5dd82577
- SHA1 0187c7c80743b44e9e0c193e993294e3b969cc3d
- SHA512 c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
- SSDEEP 192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Pictures\SSPVCNRBrBdbEYFQcLxysQ8Z.exe
- Size 4.1MB
- SHA256 7e3d844edd6d0a788ab1c9f1ea88ca2cb04809ee21aa55f0c2265a927507b187
- MD5 72af3194aa7989bf478c74588c42223f
- SHA1 cf0ebbf512f38af05668c53841828ac29d080af2
- SHA512 2dac5a433285945ced4ad5026667408ab911ebf60fa800f057e7a19133d8ec048a025e0cf9c670fac9b1db0a6bd340690533f0b429af2f60ab6b4efdf6f82a0b
- SSDEEP 98304:bb/DMr9zhhA/6kdXfrYp8ia1yEQL2NpP26oG9WRoP1Ku9:nwrNhhArfryXaXE2NpPVoG9WRMp9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Pictures\ky79frCgUhkxNVny8VY30aGr.exe
- Size 3KB
- SHA256 4061239201db7e566f376c78c2ca49f56d78fa45def8be1b87eb0d276527b9e1
- MD5 8ef50d56e57468332c5168aaaa67ae3e
- SHA1 6fd4d7c4bd28a53cffc0ba043649716224150499
- SHA512 b44aecb62d96deefeaf9aa725945c3dd554942f4a5e2bad54b30d55c27d7017f46fe60b4958f05a4707aba26cd9b9602d14f4c017fdc42845a282f4456d3132d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Pictures\qAsfUPMGIFlF65Z9sKdgORLO.exe
- Size 4.8MB
- SHA256 8b3ee970a1b172952a665247aa5ff590d12d8f4b33c0775573044595df6383c9
- MD5 451f4eeaec602b55d2b46166cc9255dc
- SHA1 3faf87169ec97a6a4500d858ce44b586c85673d6
- SHA512 6b5d3f8cd1c6ba69da92cd3d7dbe30b804108c9b9c9abbaac0692bd3cae2a1d3bae9fb195718d568c7cb6dd5aa677cc0e2b5fe301bb68c7cc3961bef76484f96
- SSDEEP 98304:HG6jwxwlOaz05U+YDKztJsG08079LCEIvBAMV0N869Jo7xDXz:H6wMazb+qK68MLCEVm0G69mFX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Downloaded Installations\{CA40F441-F6FD-4494-9835-4F5534994BFF}\Charity Engine.msi
- Size 9.8MB
- SHA256 e1d8c792c479e327810022487f11598788f8e0b44e79654276026d5b51188703
- MD5 168773d273d5a3a5e473d1a70f0eda4c
- SHA1 bcd0806862fd9d9f99e06f9d0226535762e0e394
- SHA512 59b479a57571e21c92bfe46311ede05ad6018eb68ad16bfd3f71113b080b0f5432d5fd1749ffa685af30851b3afa2bb9cfd20a4ea2527b2190d6856dfbeb75b2
- SSDEEP 196608:J3BOv1AMHdtEq6fm3pNBQDiVg5QEah2CuKtCf:6vHdt33Xg5QEdoCf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7405.tmp
- Size 149KB
- SHA256 ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
- MD5 418322f7be2b68e88a93a048ac75a757
- SHA1 09739792ff1c30f73dacafbe503630615922b561
- SHA512 253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef
- SSDEEP 3072:rfmUZkq40ok1KA+2LSQa/967K4AcIaWHTnYzMgYesp0Ccaw:rfmekqAA+2RTCcZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA150.tmp
- Size 195KB
- SHA256 cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8
- MD5 4298cfa3dab9867af517722fe69b1333
- SHA1 ab4809f8c9282e599aa64a8ca9900b09b98e0425
- SHA512 37b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b
- SSDEEP 6144:t0UiqtfViMTahVzgDpW90yNShZWpUhysme1:t0UfWyiShZT1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIDF45.tmp
- Size 690KB
- SHA256 cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4
- MD5 8deb7d2f91c7392925718b3ba0aade22
- SHA1 fc8e9b10c83e16eb0af1b6f10128f5c37b389682
- SHA512 37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c
- SSDEEP 6144:f1AiB9PqvByOQV9xEMvvKKqS4s9Wj+WDUweVwHmkLlcD/lnr/3yIWAB1R:/N0kDhDWj+WDUweVFkSTlGIW+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
- MD5 1c19c16e21c97ed42d5beabc93391fc5
- SHA1 8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
- SHA512 7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
- Size 41KB
- SHA256 03f4d293b34e18f429d34282179a04a705d448f3b88b88982486997f6cd51f39
- MD5 0f38a17bbaa7b6f75f51c671be981097
- SHA1 ee95e5225cfb623b6ddd58902bf72504993e2030
- SHA512 429100ae213ea857fa3fefea7b512bb616219f76cf2a55a4735776650806d42582ff886cd4779a1406d2bc9d0f514c93e40c3d12d9e764ffa8b880067bd704a2
- SSDEEP 768:u+/3hFJ+z302oV3IpNBQkj2Fh4iUx/aVgfrRJv5FSvV4c3EyO0LyOdBJzztAHk4y:Rh+z302oV3CNBQkj2Fh4iUx/aVgflJnU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 18KB
- SHA256 ea06f7b6019211753b30a2d1f7f62af42ad2cdb5d12efe3acf9c7bb9acbacf47
- MD5 b37eb6731a5930784d95597686b15382
- SHA1 7b60b25b8b491d9677594d2d8b4a318470d9235c
- SHA512 d0c46177e0297c9588d52e7a3897e73360a6649cc6e0ff9d4ffe11b1c6a2a9a68d6b56a32814e174591e1b8bde1cef0c5fd002b85f14a91c6b9e9f5615b6a2dc
- SSDEEP 384:PAbla7GbUX08AqSlH6P44o01fJHSHcftlodBPJk6wf78KR5YL0I8:kUKbc07qaa/rSH4HoLJFwfgKRGY/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 17KB
- SHA256 81fd66aaf14f1f2b1c36f79b734257bea1715e6f7d550cef31433a228d6cd700
- MD5 b555995b39e433f8f0c83bbc3f90340f
- SHA1 880bf20c6cea9a66da10463d4a0de8ad9c9d65c1
- SHA512 896f186f1b87efa444cbc3d3a392e44864279c82d1033cf1951138f6d19a0d6712ea5e5187cdcc2f24674816366c9da261f743e8dec5c4b2832404f43eb9c3db
- SSDEEP 384:zATxna7h4XIgzZNXhxobKAiVRsMMICUNJoqeB0CKWdr0W3:I8lIP8vBMVhboq/W4y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 17KB
- SHA256 aebc305de76901e31a06f6c10bd320f2bbdf53ca100a27f78fd78ad02f3c5d05
- MD5 5f1bd2a9f803dfea1a4730b819ce4ab6
- SHA1 3abe5e9cfb05678cc9e0c697162c64837b750ce3
- SHA512 d23421bb38f4cbb80d3030c52f657c198dbf48834efebd417bf72c0d5dba86032a5f92d0a13edb87a37f7f94922679082532b96a2e8457d32137ab7de13f1d57
- SSDEEP 384:r2bTh/a75/XIgoteIAyODRMKAiVRsM4ICUNJZdB0CIuiOGFuGvSzaa:yPkNvP/PXOBMhhbZDH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 17KB
- SHA256 527aa2359f3d537dbd34ad2ea01150010f9faf977bea96195c6050d200596a50
- MD5 1753c74ea6fdd0908a849718d3645349
- SHA1 c0ccdfbbb72f92e4a4a675b81562578b62fa4b9f
- SHA512 2af8b9f1649ce51f0c751e4b82d9346cd23d53271e298e552527f4100d038924922ed65c40a2ea2f2303368c8ccbd7271880ea54eb6e96a2339f4e788f155f65
- SSDEEP 384:0ATX9yDNjXIgoteIAhDp8U3NbKAi4301R0MgI2UNJoVBLBuuOGFuGvSzKa:78DNrP/P1v2oMZFboWX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 17KB
- SHA256 516afc8da9312818ec3458a9324db1d39b44ccc05323e84dadf56e660bc0701f
- MD5 b45d49857660f3fdd307ddf692d39ef0
- SHA1 634d01d8d0bd24baef3e3d32d9439d0e81370310
- SHA512 90ec9f29270c338beda56048f2b749e3caa06708d2b84918e59b5875e5a42f895b451d02473165b9f59a704c292feec1dc4ff77f1ed111cfdd2305f73eeeaf0d
- SSDEEP 384:5QATXVPOgRsX9ySilRATr91/pbKAiQ01R0MgI2UNJoVBPsLuaOGFuGvSzNwa:lNtR0I3QtHv2oMZFboDsQJt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys
- Size 1013KB
- SHA256 05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b
- MD5 321ccdb9223b0801846b9ad131ac4d81
- SHA1 ac8fb0fc82a8c30b57962fe5d869fda534053404
- SHA512 75b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a
- SSDEEP 12288:CXYAhsH3POTVWXUoRJfXRML5cHTe3n2A9ICnPIjc8d0q8d8XG:nAhk3PKWXU+gLkTeGA9ICnPCV8aG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\GroupPolicy\gpt.ini
- Size 127B
- SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
- MD5 8ef9853d1881c5fe4d681bfb31282a01
- SHA1 a05609065520e4b4e553784c566430ad9736f19f
- SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
- MD5 SHA1 SHA512
- Path C:\Windows\windefender.exe
- Size 2.0MB
- SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
- MD5 8e67f58837092385dcf01e8a2b4f5783
- SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
- SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
- SSDEEP 49152:y+SUiJeHpNnxG745Mfi39uXrbcI6DOdVgeuaNjwAx1bJljkv6kXjxNh:fdlHA4yiN8cI6SX3hbJCvhx
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042304201\assistant\dbgcore.dll
- Size 166KB
- SHA256 926d444ffca166e006920412677c4ed2ef159cf0efc0578cb45b824f428f5eb2
- MD5 8b6f64e5d3a608b434079e50a1277913
- SHA1 03f431fabf1c99a48b449099455c1575893d9f32
- SHA512 c9aeac62ece564ac64a894300fb9d41d13f22951ead73421854c23c506760d984dff0af92bef2d80f3a66e782f0075832e9c24a50ae6110d27a25c14e065b41c
- SSDEEP 3072:MhXBaQASh0NdOZPQOxTcbmpslNAD59wc5YzmhQPE0g+3UgjSbiZUNpPT76eg9kOx:MhXDASh0NdOwGFhSagjSeZyT76b9kUn
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Opera_installer_2404042304163701860.dll
- Size 4.6MB
- SHA256 668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303
- MD5 2a3159d6fef1100348d64bf9c72d15ee
- SHA1 52a08f06f6baaa12163b92f3c6509e6f1e003130
- SHA512 251c0d3cdd0597b962d4e32cf588a82454c42067cbe5e35b41b0548eea742ea25815e5d6830b63c1992b5730a4e6d7c005fb0019aa4c389549b06fff9a74b38c
- SSDEEP 98304:n6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwM:yIOT2I5mTtpbvphIGZeXMxOjGe809wZe
- MD5 SHA1 SHA512 SSDEEP