mafiaware666 | ec53369ff55e735e14b5b87eb793dabf043ce0fd7f93bc47fd0e5fd4fd7e6a77

General

Target

Chrome.msi
Size

288KB
MD5

10cca9ff7368ddfb2301d36fa386669a
SHA1

9ec12af4a97eda16513aa51ec685601c64eec626
SHA256

ba9933fa2ea29f27d73736ecd78d3f598e4786f2207e29fa6c7f42f008d529a9
SHA512

c72938d43e08de87c0328a500810e0c33448110eefb3eaf9569dbb9b91e61e9db4022ca6359e84e2a9b376077d5242948ecdbd2fb433b508a4006463d56d1c85
SSDEEP

3072:81L7cspAtO9mXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8VlhD5:btO9iRQYpgjpjew5DHyGxcqo8f7

Score

10^/10

mafiaware666 discovery ransomware

Malware Config

Signatures

Detect MafiaWare666 ransomware 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MW-e1438e29-25fb-4b23-b3bb-088647172f68\files.cab	family_mafiaware666
C:\Users\Admin\AppData\Local\Temp\MW-e1438e29-25fb-4b23-b3bb-088647172f68\files\WindowsFormsApp1_original.exe	family_mafiaware666
behavioral1/memory/1384-71-0x0000000001060000-0x000000000106E000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666
Renames multiple (90) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

ICACLS.EXE

pid process

2304 ICACLS.EXE

pid	process
2304	ICACLS.EXE

Drops desktop.ini file(s) 3 IoCs

Processes:

WindowsFormsApp1_original.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	WindowsFormsApp1_original.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	WindowsFormsApp1_original.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	WindowsFormsApp1_original.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeEXPAND.EXEDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F6A.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\f762e8f.msi	msiexec.exe
File created	C:\Windows\Installer\f762e90.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f762e8f.msi	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

WindowsFormsApp1_original.exe

pid process

1384 WindowsFormsApp1_original.exe
Loads dropped DLL 5 IoCs

Processes:

MsiExec.exe

pid process

1476 MsiExec.exe
1476 MsiExec.exe
1476 MsiExec.exe
1476 MsiExec.exe
1476 MsiExec.exe

pid	process
1384	WindowsFormsApp1_original.exe

pid	process
1476	MsiExec.exe
1476	MsiExec.exe
1476	MsiExec.exe
1476	MsiExec.exe
1476	MsiExec.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2344 msiexec.exe
2344 msiexec.exe

pid	process
2344	msiexec.exe
2344	msiexec.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeSecurityPrivilege	2344	msiexec.exe
Token: SeCreateTokenPrivilege	2024	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2024	msiexec.exe
Token: SeLockMemoryPrivilege	2024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2024	msiexec.exe
Token: SeMachineAccountPrivilege	2024	msiexec.exe
Token: SeTcbPrivilege	2024	msiexec.exe
Token: SeSecurityPrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeLoadDriverPrivilege	2024	msiexec.exe
Token: SeSystemProfilePrivilege	2024	msiexec.exe
Token: SeSystemtimePrivilege	2024	msiexec.exe
Token: SeProfSingleProcessPrivilege	2024	msiexec.exe
Token: SeIncBasePriorityPrivilege	2024	msiexec.exe
Token: SeCreatePagefilePrivilege	2024	msiexec.exe
Token: SeCreatePermanentPrivilege	2024	msiexec.exe
Token: SeBackupPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeShutdownPrivilege	2024	msiexec.exe
Token: SeDebugPrivilege	2024	msiexec.exe
Token: SeAuditPrivilege	2024	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2024	msiexec.exe
Token: SeChangeNotifyPrivilege	2024	msiexec.exe
Token: SeRemoteShutdownPrivilege	2024	msiexec.exe
Token: SeUndockPrivilege	2024	msiexec.exe
Token: SeSyncAgentPrivilege	2024	msiexec.exe
Token: SeEnableDelegationPrivilege	2024	msiexec.exe
Token: SeManageVolumePrivilege	2024	msiexec.exe
Token: SeImpersonatePrivilege	2024	msiexec.exe
Token: SeCreateGlobalPrivilege	2024	msiexec.exe
Token: SeBackupPrivilege	2944	vssvc.exe
Token: SeRestorePrivilege	2944	vssvc.exe
Token: SeAuditPrivilege	2944	vssvc.exe
Token: SeBackupPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2548	DrvInst.exe
Token: SeLoadDriverPrivilege	2548	DrvInst.exe
Token: SeLoadDriverPrivilege	2548	DrvInst.exe
Token: SeLoadDriverPrivilege	2548	DrvInst.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

2024 msiexec.exe

pid	process
2024	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

msiexec.exeMsiExec.exe

description	pid	process	target process
PID 2344 wrote to memory of 1476	2344	msiexec.exe	MsiExec.exe
PID 2344 wrote to memory of 1476	2344	msiexec.exe	MsiExec.exe
PID 2344 wrote to memory of 1476	2344	msiexec.exe	MsiExec.exe
PID 2344 wrote to memory of 1476	2344	msiexec.exe	MsiExec.exe
PID 2344 wrote to memory of 1476	2344	msiexec.exe	MsiExec.exe
PID 2344 wrote to memory of 1476	2344	msiexec.exe	MsiExec.exe
PID 2344 wrote to memory of 1476	2344	msiexec.exe	MsiExec.exe
PID 1476 wrote to memory of 2304	1476	MsiExec.exe	ICACLS.EXE
PID 1476 wrote to memory of 2304	1476	MsiExec.exe	ICACLS.EXE
PID 1476 wrote to memory of 2304	1476	MsiExec.exe	ICACLS.EXE
PID 1476 wrote to memory of 2304	1476	MsiExec.exe	ICACLS.EXE
PID 1476 wrote to memory of 300	1476	MsiExec.exe	EXPAND.EXE
PID 1476 wrote to memory of 300	1476	MsiExec.exe	EXPAND.EXE
PID 1476 wrote to memory of 300	1476	MsiExec.exe	EXPAND.EXE
PID 1476 wrote to memory of 300	1476	MsiExec.exe	EXPAND.EXE
PID 1476 wrote to memory of 1384	1476	MsiExec.exe	WindowsFormsApp1_original.exe
PID 1476 wrote to memory of 1384	1476	MsiExec.exe	WindowsFormsApp1_original.exe
PID 1476 wrote to memory of 1384	1476	MsiExec.exe	WindowsFormsApp1_original.exe
PID 1476 wrote to memory of 1384	1476	MsiExec.exe	WindowsFormsApp1_original.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chrome.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2024

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 85E1D924C2FC9627174799C9DBE115D7
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e1438e29-25fb-4b23-b3bb-088647172f68\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:2304
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\MW-e1438e29-25fb-4b23-b3bb-088647172f68\files\WindowsFormsApp1_original.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-e1438e29-25fb-4b23-b3bb-088647172f68\files\WindowsFormsApp1_original.exe"
    3⤵
    - Drops desktop.ini file(s)
    - Executes dropped EXE
    PID:1384

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A0" "00000000000005A4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-e1438e29-25fb-4b23-b3bb-088647172f68\files.cab

Filesize
37KB

MD5
b050ee720b47e099ebeb9fb585ddcd80

SHA1
710b83b1c892872623581cc629a22f7f58672651

SHA256
040c3c2ec3e91c3f6d6b7b895017f08ece1998d0fcae1d40d75312fdf3dae5fc

SHA512
86209153e7be31e5dd638f79dbef639fd8c5642d56b01bc9f8a4370553cf71fcedc82141072739625a7cf397096f0e8cacc774a92796d13ca81b83ed5a89a32e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e1438e29-25fb-4b23-b3bb-088647172f68\files\WindowsFormsApp1_original.exe

Filesize
37KB

MD5
fcb4ddf79552dbc16151c4f002e72a81

SHA1
5a6655bf73e42c6e0eb35b58aba5bba91745fb49

SHA256
1e16152df45f8830bc7f5682342fd632dd724cccfd752f9fd1be4cd2c2606179

SHA512
2ef11bf7e3539d812e54a2b6ccd5901fa60e1c873ac19e71e0b1d305090a742f492e2d4ed836b3897f8795335b9181bceb555e2a5c143cff59843ef921e1a4d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e1438e29-25fb-4b23-b3bb-088647172f68\msiwrapper.ini

Filesize
436B

MD5
3c54dfc2686916e6a4670c59be3b0b8e

SHA1
4477effd05a4e165fd9018de4c0f10443bf0491f

SHA256
9db42a09db6a25a07bcd14b39d3f0dcaaa5bc45904a452b83bd798aca1631386

SHA512
773b54e1727436aed941538746a646e0226ac9a9e6f5917dddc30e7c1033ba05ecf6fd66145d8bedbe070ac29dc5b4160287d5659cd4e6dc117be63005f1f373

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e1438e29-25fb-4b23-b3bb-088647172f68\msiwrapper.ini

Filesize
1KB

MD5
efb4ff50901cc46e91262c747ccdeea5

SHA1
5750d25beadcf3c636f7eeb65863a1a8f6c63ab4

SHA256
306ffee0725f53e2c02911e570d3530e250b6c8afe26daeb607e18dfdd6f9595

SHA512
b090ed6e9031edfc24d907cc3bf1dbb2004357bccd04c2a56977875fb53a23ef568b8fc31ab5ef3f2267b3e7191cdda41e43f87f45c81a0395aeb93b54525e4a

Download Submit
C:\Windows\Installer\MSI2F6A.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
memory/1384-71-0x0000000001060000-0x000000000106E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads