purelogstealer | 5a7757d1d3fb70c2e261e3e3a14a6c79d0451b3bd67b262059ca001f9c48b308

Analysis

max time kernel
194s
max time network
286s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
26/04/2024, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EngineChromium.msi
Size 34.3MB
Sample240426-msdrmsef83
SHA256 5a7757d1d3fb70c2e261e3e3a14a6c79d0451b3bd67b262059ca001f9c48b308
MD5 a74cc7b62eaed6394bdc89f8ae24ae45
SHA1 c0bc2eb10ef1e9891a5f1587cf180a67ac3a72a6
SHA512 a8962c92d0ea8e24f3a98e6fd01c3eedf708dcd4ff54724cd7a4e35d673ccae3f21c1094834ae44486ad785f8905dc975fd31093cf9454f34a0eb85b5331ca9f
SSDEEP 786432:CUz141w/2wmggH4vdjpi6TeQHnjAGVRZ4U2XCUydEB6msg:CUZjXmggOdov8nkGVeXCUIEWg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogstealer redline zgrat newhope2 discovery infostealer persistence rat stealer

Malware Config

Extracted

Family

redline

Botnet

newhope2

91.92.246.148:3362

Signatures

Detect ZGRat V1 35 IoCs

resource	yara_rule
behavioral2/memory/700-370-0x0000000005770000-0x0000000005824000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-372-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-371-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-380-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-378-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-376-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-374-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-382-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-388-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-386-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-384-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-392-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-398-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-400-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-406-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-418-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-424-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-432-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-434-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-430-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-428-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-426-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-422-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-420-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-416-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-414-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-412-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-410-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-408-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-404-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-402-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-396-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-394-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/700-390-0x0000000005770000-0x000000000581D000-memory.dmp	family_zgrat_v1
behavioral2/memory/2336-1320-0x0000000005CA0000-0x0000000005DCA000-memory.dmp	family_zgrat_v1

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000001ac6e-364.dat	family_purelog_stealer
behavioral2/memory/700-366-0x0000000000C80000-0x0000000000D54000-memory.dmp	family_purelog_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4288-1312-0x0000000000400000-0x0000000000454000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2200	ICACLS.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	costcodeproresieres.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	costcodeprores.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 700 set thread context of 4288	700	costcode.exe	93

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{A9CC28B9-1D51-4AC4-B983-3D5E9B4ED314}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E15.tmp	msiexec.exe
File created	C:\Windows\Installer\e579cad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e579cad.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE

Executes dropped EXE 4 IoCs

pid	Process
1348	costcodeproresieres.exe
1984	costcodeprores.exe
700	costcode.exe
2336	probablyprogram.exe

Loads dropped DLL 1 IoCs

pid	Process
3044	MsiExec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	4288	WerFault.exe	93

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4056	msiexec.exe
4056	msiexec.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
700	costcode.exe
700	costcode.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4748	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4748	msiexec.exe
Token: SeSecurityPrivilege	4056	msiexec.exe
Token: SeCreateTokenPrivilege	4748	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4748	msiexec.exe
Token: SeLockMemoryPrivilege	4748	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4748	msiexec.exe
Token: SeMachineAccountPrivilege	4748	msiexec.exe
Token: SeTcbPrivilege	4748	msiexec.exe
Token: SeSecurityPrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeLoadDriverPrivilege	4748	msiexec.exe
Token: SeSystemProfilePrivilege	4748	msiexec.exe
Token: SeSystemtimePrivilege	4748	msiexec.exe
Token: SeProfSingleProcessPrivilege	4748	msiexec.exe
Token: SeIncBasePriorityPrivilege	4748	msiexec.exe
Token: SeCreatePagefilePrivilege	4748	msiexec.exe
Token: SeCreatePermanentPrivilege	4748	msiexec.exe
Token: SeBackupPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeShutdownPrivilege	4748	msiexec.exe
Token: SeDebugPrivilege	4748	msiexec.exe
Token: SeAuditPrivilege	4748	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4748	msiexec.exe
Token: SeChangeNotifyPrivilege	4748	msiexec.exe
Token: SeRemoteShutdownPrivilege	4748	msiexec.exe
Token: SeUndockPrivilege	4748	msiexec.exe
Token: SeSyncAgentPrivilege	4748	msiexec.exe
Token: SeEnableDelegationPrivilege	4748	msiexec.exe
Token: SeManageVolumePrivilege	4748	msiexec.exe
Token: SeImpersonatePrivilege	4748	msiexec.exe
Token: SeCreateGlobalPrivilege	4748	msiexec.exe
Token: SeBackupPrivilege	4860	vssvc.exe
Token: SeRestorePrivilege	4860	vssvc.exe
Token: SeAuditPrivilege	4860	vssvc.exe
Token: SeBackupPrivilege	4056	msiexec.exe
Token: SeRestorePrivilege	4056	msiexec.exe
Token: SeRestorePrivilege	4056	msiexec.exe
Token: SeTakeOwnershipPrivilege	4056	msiexec.exe
Token: SeRestorePrivilege	4056	msiexec.exe
Token: SeTakeOwnershipPrivilege	4056	msiexec.exe
Token: SeBackupPrivilege	4948	srtasks.exe
Token: SeRestorePrivilege	4948	srtasks.exe
Token: SeSecurityPrivilege	4948	srtasks.exe
Token: SeTakeOwnershipPrivilege	4948	srtasks.exe
Token: SeBackupPrivilege	4948	srtasks.exe
Token: SeRestorePrivilege	4948	srtasks.exe
Token: SeSecurityPrivilege	4948	srtasks.exe
Token: SeTakeOwnershipPrivilege	4948	srtasks.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	700	costcode.exe
Token: SeDebugPrivilege	2336	probablyprogram.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4748	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1348	costcodeproresieres.exe
488	cmd.exe
1984	costcodeprores.exe
700	costcode.exe
4288	MSBuild.exe
2336	probablyprogram.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4948	4056	msiexec.exe	78
PID 4056 wrote to memory of 4948	4056	msiexec.exe	78
PID 4056 wrote to memory of 3044	4056	msiexec.exe	80
PID 4056 wrote to memory of 3044	4056	msiexec.exe	80
PID 4056 wrote to memory of 3044	4056	msiexec.exe	80
PID 3044 wrote to memory of 2200	3044	MsiExec.exe	81
PID 3044 wrote to memory of 2200	3044	MsiExec.exe	81
PID 3044 wrote to memory of 2200	3044	MsiExec.exe	81
PID 3044 wrote to memory of 5060	3044	MsiExec.exe	83
PID 3044 wrote to memory of 5060	3044	MsiExec.exe	83
PID 3044 wrote to memory of 5060	3044	MsiExec.exe	83
PID 3044 wrote to memory of 1348	3044	MsiExec.exe	85
PID 3044 wrote to memory of 1348	3044	MsiExec.exe	85
PID 3044 wrote to memory of 1348	3044	MsiExec.exe	85
PID 1348 wrote to memory of 488	1348	costcodeproresieres.exe	86
PID 1348 wrote to memory of 488	1348	costcodeproresieres.exe	86
PID 1348 wrote to memory of 488	1348	costcodeproresieres.exe	86
PID 488 wrote to memory of 4788	488	cmd.exe	88
PID 488 wrote to memory of 4788	488	cmd.exe	88
PID 488 wrote to memory of 4788	488	cmd.exe	88
PID 1348 wrote to memory of 1984	1348	costcodeproresieres.exe	89
PID 1348 wrote to memory of 1984	1348	costcodeproresieres.exe	89
PID 1984 wrote to memory of 700	1984	costcodeprores.exe	90
PID 1984 wrote to memory of 700	1984	costcodeprores.exe	90
PID 1984 wrote to memory of 700	1984	costcodeprores.exe	90
PID 700 wrote to memory of 2544	700	costcode.exe	92
PID 700 wrote to memory of 2544	700	costcode.exe	92
PID 700 wrote to memory of 2544	700	costcode.exe	92
PID 700 wrote to memory of 4288	700	costcode.exe	93
PID 700 wrote to memory of 4288	700	costcode.exe	93
PID 700 wrote to memory of 4288	700	costcode.exe	93
PID 700 wrote to memory of 4288	700	costcode.exe	93
PID 700 wrote to memory of 4288	700	costcode.exe	93
PID 700 wrote to memory of 4288	700	costcode.exe	93
PID 700 wrote to memory of 4288	700	costcode.exe	93
PID 700 wrote to memory of 4288	700	costcode.exe	93
PID 1984 wrote to memory of 2336	1984	costcodeprores.exe	94
PID 1984 wrote to memory of 2336	1984	costcodeprores.exe	94
PID 1984 wrote to memory of 2336	1984	costcodeprores.exe	94

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EngineChromium.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4748

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 92FA3B075DCF072F216A560E4C2E3BBC
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-fafa9dbb-9204-462b-b9f3-5e91ca12339f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:2200
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:5060
- - C:\Users\Admin\AppData\Local\Temp\MW-fafa9dbb-9204-462b-b9f3-5e91ca12339f\files\costcodeproresieres.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-fafa9dbb-9204-462b-b9f3-5e91ca12339f\files\costcodeproresieres.exe"
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c costcode.bat
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:488
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcodeprores.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcodeprores.exe
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\costcode.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\costcode.exe
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:700
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        
        PID:2544
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 912
        7⤵
        Program crash
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\probablyprogram.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\probablyprogram.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

costcode.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcode.bat
Size 145B
SHA256 a6236e067a745bc082ab9b7ce0b4d7b39816efa191ea2c25baee7a334fa70a2b
MD5 aad2830f24f0808e7fe50b82acdfbdf9
SHA1 53d35b0dd209a10dd4cbf4394cbd3cd64bf758be
SHA512 4b30f274012064bac12fd88289f16a592328bec99557d1514f90bdc2402e9a790badd0fed116734fd6dc4654f2e7d0b681d9aff506781e7407a68312a983cd1f
MD5 SHA1 SHA512

Submit Download

costcodeprores.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\costcodeprores.exe
Size 42.0MB
SHA256 b32c0a94ae198325d5d78821ab0d526f2e5c6ac00638f5d6aff10d720874d35c
MD5 73bb756b945ac9734b3ea50d583b6da7
SHA1 6184d653cd6b0906267a1874d54d26892685af44
SHA512 8ee8dfee11c7d7415ae2990ad2a2b1067cf90921ed7873f87a151f32119b61fa24aa1ef7c2fb219bb01d3cb047d944c9cac453ba53cfec74184b3066782649fb
SSDEEP 786432:Z/exBF+Bj1Sn61q0NcF+Bj1Sn61q0NcF+Bj1Sn61q0NW:Z/E2BInN0NvBInN0NvBInN0NW
MD5 SHA1 SHA512 SSDEEP

Submit Download

costcode.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\costcode.exe
Size 838KB
SHA256 22df3ecc6bc24b47ca6afb25525bd0c247bdd18a105ae8fa3174176b4c1fcf9c
MD5 688dc2be58e652d1683cd909b92480ff
SHA1 1b0dfe0801762ef89daa2a5e7ff55cc7615b5f81
SHA512 fbf386421bbde29f763a1ad5e9f0d06dda308e5e58528a74ee67ea37f945dc77156b2e5e0522e0a64e6630ac16a555c353b92117217948fa432325f9202fb215
SSDEEP 12288:KdQl4yKAuCSEjhuJ9oDIzcnHYuzwf3tzbwQESM+rSW/Oi07gR2e:KdQlCFCSEkJzmYuiZbEOS6G7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

probablyprogram.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\probablyprogram.exe
Size 1.3MB
SHA256 fc8100e9dbce6a4338a569bf12bfc4497239a781cb7e6cd3f80949ee6675ca1f
MD5 f73d1e0fd9e1300a131861fb367ac7eb
SHA1 82543f273ad9d8ae93bbe3fd4a0063927c505a84
SHA512 e78bf7e274388742bdb7e42305f5290d03da3e51f0d8c355ee79e179c58b2d043efb652e3f35f90255559ffcf97f4a1b7e4f4d9604f7b33f1e404975ee6c8d20
SSDEEP 24576:Km3AYSG9T2uFvG0xqK4B2srUt8Tkj2bRY1F8Lk3FEmDi8HqPG:KwAYSG1vG0YK4IPXOnkVEwMG
MD5 SHA1 SHA512 SSDEEP

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-fafa9dbb-9204-462b-b9f3-5e91ca12339f\files.cab
Size 34.0MB
SHA256 3281204875c3905c97d5e918362f749a7c870e263709cf0413ea1dddb4bc9fda
MD5 39eadf22ac87b0b26ba46d10198aa230
SHA1 f91ecff4e43b492d562547c350fff560a72167de
SHA512 b15bc5fdc548e201d8eb57d5283c8e840d9c71ed34fc9b15373c6e4b84bf8d497705f5cbcadb1b93d84d1fb19de8373060f1ad613d9d13f7fb06290bf31bac02
SSDEEP 786432:+Uz141w/2wmggH4vdjpi6TeQHnjAGVRZ4U2XCUydEB6msg:+UZjXmggOdov8nkGVeXCUIEWg
MD5 SHA1 SHA512 SSDEEP

Submit Download

costcodeproresieres.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-fafa9dbb-9204-462b-b9f3-5e91ca12339f\files\costcodeproresieres.exe
Size 34.0MB
SHA256 b6f7b366ebeefbf492b25db56e67934f0f5c3d26391348277e58a0351d312301
MD5 13887aee1ef3f47ae357a139360e052f
SHA1 9c5c229bd23f1e82a9c627f192e661716b648090
SHA512 3f593db09613f5d2c3255b604bd74943b918bb66441c3eccc7df11408374d48e1cda0fedefdc3b3fa0b0e49aa9ac319d756e4630176a877b77486d70206491c9
SSDEEP 786432:kDBFyOiA8N/frahgE/Xt2NJPVmElqJbyvpvff6nRXVcR87:kDDX4/frDu9CNm4qJkff6RXn7
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-fafa9dbb-9204-462b-b9f3-5e91ca12339f\msiwrapper.ini
Size 1KB
SHA256 0b9073c2a6037bd9fb0d89585ff8ca45dcaefb5425350dc2e69bca996f1f5cb8
MD5 312e9622ea543eda496d1b51e64a66ef
SHA1 708ca62e1467b64a159bb37c738e4bc2f215a15b
SHA512 8b057711e71e9522bbf7b073597da236ede8cc9be8d75288a284e3ccef7e404b46cee6d42d4b46f24ef8be2cf83152a55f83524d7064aeb218c5e3e52c563db5
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_nq3opbia.1w1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nq3opbia.1w1.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.0MB
SHA256 261afc4bfa419b080bbdf183744f5931a4086ad82eb9987e7f5d641c8555c5ef
MD5 e92193683149ada9809fdf761fe03f6a
SHA1 aee72daa7446ae9b6a8f9b8480a4ed0cd1772d5f
SHA512 e105f12382f0463218e9184b4e7a7c377c5b0128a0d1e0a25545f275cee3fccc4f670deea32ecec518ca96f9fa3cd1021f41fdea10e61b3a66ea2f94f516256e
SSDEEP 24576:RzlmM/z9doO/vvTL/87vuOqDmHX4J+Y2e1eJgkVpFGd5yNVB4q5ih0E2BtG+YA+z:nH
MD5 SHA1 SHA512 SSDEEP

Submit Download

{ac36e8ec-4844-4e5f-bd6d-34796a2693b9}_OnDiskSnapshotProp

Path \??\Volume{39cd0eda-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ac36e8ec-4844-4e5f-bd6d-34796a2693b9}_OnDiskSnapshotProp
Size 5KB
SHA256 54b957a5f20a35ccc3cdb4de7940afa8303f6f7d3b714ab0969a0e87cd929df1
MD5 1af2159a372df229113a61ddfba75eca
SHA1 a747c2f6c205bb4b684769b69a231b16c7ae0158
SHA512 0e4722ac545282007ed5f82fa1b005c1cffbd870a95d91ebc38145d5ad9125d91a8ae6ada9443f8413e674a859deae02d52980ad57ac603104809ebfd49f8485
SSDEEP 96:F5zkQvRJXW1DDD84LTHzbOHXOHBlBRQp8O9XE56nSVQpuO:Xg0W5b++MqVO
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI9E15.tmp

Path \Windows\Installer\MSI9E15.tmp
Size 208KB
SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/700-404-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-406-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-1310-0x0000000072550000-0x0000000072C3E000-memory.dmp

Download

memory/700-1307-0x0000000072550000-0x0000000072C3E000-memory.dmp

Download

memory/700-1306-0x00000000063A0000-0x000000000689E000-memory.dmp

Download

memory/700-1305-0x00000000059D0000-0x0000000005A62000-memory.dmp

Download

memory/700-1303-0x0000000005820000-0x000000000586A000-memory.dmp

Download

memory/700-1304-0x0000000005870000-0x00000000058BC000-memory.dmp

Download

memory/700-390-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-394-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-396-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-402-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-408-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-410-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-412-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-414-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-416-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-420-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-366-0x0000000000C80000-0x0000000000D54000-memory.dmp

Download

memory/700-422-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-367-0x0000000072550000-0x0000000072C3E000-memory.dmp

Download

memory/700-368-0x0000000005580000-0x0000000005632000-memory.dmp

Download

memory/700-369-0x00000000056C0000-0x0000000005772000-memory.dmp

Download

memory/700-370-0x0000000005770000-0x0000000005824000-memory.dmp

Download

memory/700-372-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-371-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-380-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-378-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-376-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-374-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-382-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-388-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-386-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-384-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-392-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-398-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-400-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-426-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-418-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-424-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-432-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-434-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-430-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/700-428-0x0000000005770000-0x000000000581D000-memory.dmp

Download

memory/2336-2259-0x0000000072550000-0x0000000072C3E000-memory.dmp

Download

memory/2336-2257-0x0000000005E70000-0x0000000005F30000-memory.dmp

Download

memory/2336-1320-0x0000000005CA0000-0x0000000005DCA000-memory.dmp

Download

memory/2336-1319-0x0000000005B70000-0x0000000005C98000-memory.dmp

Download

memory/2336-1318-0x0000000005940000-0x0000000005A68000-memory.dmp

Download

memory/2336-1316-0x0000000000FA0000-0x00000000010EA000-memory.dmp

Download

memory/2336-1317-0x0000000072550000-0x0000000072C3E000-memory.dmp

Download

memory/4288-1311-0x0000000072550000-0x0000000072C3E000-memory.dmp

Download

memory/4288-2258-0x0000000072550000-0x0000000072C3E000-memory.dmp

Download

memory/4288-1312-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/4788-103-0x0000000008010000-0x0000000008086000-memory.dmp

Download

memory/4788-120-0x0000000009100000-0x0000000009133000-memory.dmp

Download

memory/4788-122-0x00000000090E0000-0x00000000090FE000-memory.dmp

Download

memory/4788-97-0x00000000075B0000-0x00000000075D2000-memory.dmp

Download

memory/4788-98-0x0000000007650000-0x00000000076B6000-memory.dmp

Download

memory/4788-102-0x0000000007D60000-0x0000000007DAB000-memory.dmp

Download

memory/4788-101-0x0000000007930000-0x000000000794C000-memory.dmp

Download

memory/4788-100-0x0000000007960000-0x0000000007CB0000-memory.dmp

Download

memory/4788-99-0x00000000077C0000-0x0000000007826000-memory.dmp

Download

memory/4788-121-0x000000006F270000-0x000000006F2BB000-memory.dmp

Download

memory/4788-127-0x0000000009230000-0x00000000092D5000-memory.dmp

Download

memory/4788-93-0x00000000068A0000-0x00000000068D6000-memory.dmp

Download

memory/4788-94-0x0000000072520000-0x0000000072C0E000-memory.dmp

Download

memory/4788-128-0x0000000006890000-0x00000000068A0000-memory.dmp

Download

memory/4788-129-0x0000000009420000-0x00000000094B4000-memory.dmp

Download

memory/4788-322-0x00000000093C0000-0x00000000093DA000-memory.dmp

Download

memory/4788-327-0x00000000093B0000-0x00000000093B8000-memory.dmp

Download

memory/4788-355-0x0000000072520000-0x0000000072C0E000-memory.dmp

Download

memory/4788-96-0x0000000006F10000-0x0000000007538000-memory.dmp

Download

memory/4788-95-0x0000000006890000-0x00000000068A0000-memory.dmp

Download