Resubmissions
07/05/2024, 16:42
240507-t7tjzaeh9s1007/05/2024, 16:12
240507-tnt2dseb4v1007/05/2024, 16:09
240507-tlvj5sea611Analysis
- max time kernel
419s - max time network
420s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system - submitted
07/05/2024, 16:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
12 signatures
1800 seconds
Behavioral task
behavioral3
Sample
https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe
Resource
win11-20240419-en
windows11-21h2-x64
40 signatures
1800 seconds
Errors
Reason
Machine shutdown
General
- Target https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe
- Sample240507-tnt2dseb4v
Malware Config
Signatures
- Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\Annabelle.exe" Annabelle.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Annabelle.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Annabelle.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (552) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Annabelle.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Annabelle.exe - Disables Task Manager via registry modification
- Disables use of System Restore points 1 TTPs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 6652 NetSh.exe - Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DBGHELP.exe Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksuser.dll\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpg4dmod.dll Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpg4dmod.dll\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usbui.dll Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydocs.dll\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllhost.exe Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\url.dll\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webcheck.dll\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemexplorer.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksuser.dll Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellstyle.dll\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\url.dll Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chkdsk.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cabinet.dll Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usbui.dll\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllhost.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DBGHELP.exe\Debugger = "RIP" Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellstyle.dll Annabelle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webcheck.dll Annabelle.exe - Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta CoronaVirus.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini CoronaVirus.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-59EC5669.[[email protected]].ncov CoronaVirus.exe - Executes dropped EXE 11 IoCs
pid Process 584 Birele.exe 1672 Birele.exe 4560 Birele.exe 2080 Birele.exe 4332 CoronaVirus.exe 11308 CoronaVirus.exe 5524 msedge.exe 5604 msedge.exe 6520 msedge.exe 9144 Annabelle.exe 21280 msedge.exe - Loads dropped DLL 3 IoCs
pid Process 5524 msedge.exe 5604 msedge.exe 6520 msedge.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral3/files/0x001d00000002ac15-245.dat upx behavioral3/memory/584-280-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral3/memory/584-281-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral3/memory/584-283-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral3/memory/1672-336-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral3/memory/2080-357-0x0000000000400000-0x0000000000438000-memory.dmp upx - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe" CoronaVirus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" CoronaVirus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" CoronaVirus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Annabelle.exe" Annabelle.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Annabelle.exe" Annabelle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Annabelle.exe" Annabelle.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Annabelle.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Music\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Pictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Searches\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini CoronaVirus.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2878097196-921257239-309638238-1000\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Videos\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Links\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Desktop\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Libraries\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Documents\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Documents\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Music\desktop.ini CoronaVirus.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2878097196-921257239-309638238-1000\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Downloads\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files (x86)\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Videos\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini CoronaVirus.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 14 raw.githubusercontent.com 30 raw.githubusercontent.com - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\CoronaVirus.exe CoronaVirus.exe File created C:\Windows\System32\Info.hta CoronaVirus.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\SPRING.ELM.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscene_plugin.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nothumbnail_34.svg.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-heap-l1-1-0.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_altform-lightunplated_contrast-black.png CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-white\CameraAppList.targetsize-64.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadMedTile.scale-125.png CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-utility-l1-1-0.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected].[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt CoronaVirus.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.schema.mfl.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_contrast-white.png CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_sent.gif CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-60_altform-unplated.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\customizations\Customizations.js CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\avdevice-58_ms.dll CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\TipsMedTile.scale-200_contrast-white.png CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\UnifiedShare.aapp CoronaVirus.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PaintSmallTile.scale-100.png CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\ui-strings.js CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\ui-strings.js.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\msvcp140_1.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\createTheme.js CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\spacing\DefaultSpacing.js CoronaVirus.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_contrast-black.png CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations_retina.png CoronaVirus.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-100.png CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.id-59EC5669.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Fonts\segxsym.ttf CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.id-59EC5669.[[email protected]].ncov CoronaVirus.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
pid pid_target Process procid_target 4088 584 WerFault.exe 99 912 1672 WerFault.exe 108 3144 4560 WerFault.exe 124 2648 2080 WerFault.exe 127 - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 8008 vssadmin.exe 7920 vssadmin.exe 2528 vssadmin.exe 10692 vssadmin.exe 8024 vssadmin.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "23" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe - Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Key created \REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe - NTFS ADS 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 166394.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Birele.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 197712.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 560018.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Annabelle.exe:Zone.Identifier msedge.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3688 msedge.exe 3688 msedge.exe 2472 msedge.exe 2472 msedge.exe 3480 msedge.exe 3480 msedge.exe 3784 identity_helper.exe 3784 identity_helper.exe 1956 msedge.exe 1956 msedge.exe 1816 msedge.exe 1816 msedge.exe 1816 msedge.exe 1816 msedge.exe 1108 msedge.exe 1108 msedge.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe 4332 CoronaVirus.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeBackupPrivilege 8584 vssvc.exe Token: SeRestorePrivilege 8584 vssvc.exe Token: SeAuditPrivilege 8584 vssvc.exe Token: SeShutdownPrivilege 20964 shutdown.exe Token: SeRemoteShutdownPrivilege 20964 shutdown.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe - Suspicious use of SendNotifyMessage 28 IoCs
pid Process 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe 2472 msedge.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4836 OpenWith.exe 2976 OpenWith.exe 1860 OpenWith.exe 21152 LogonUI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 1192 2472 msedge.exe 80 PID 2472 wrote to memory of 1192 2472 msedge.exe 80 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 1092 2472 msedge.exe 81 PID 2472 wrote to memory of 3688 2472 msedge.exe 82 PID 2472 wrote to memory of 3688 2472 msedge.exe 82 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 PID 2472 wrote to memory of 2972 2472 msedge.exe 83 - System policy modification 1 TTPs 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Annabelle.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System Annabelle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" Annabelle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" Annabelle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Annabelle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1" Annabelle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" Annabelle.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Annabelle.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Annabelle.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff231f3cb8,0x7fff231f3cc8,0x7fff231f3cd82⤵PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:22⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:12⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:12⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:1572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:12⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6292 /prefetch:82⤵PID:240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1956
-
-
C:\Users\Admin\Downloads\Birele.exe"C:\Users\Admin\Downloads\Birele.exe"2⤵
- Executes dropped EXE
PID:584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 2803⤵
- Program crash
PID:4088
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6128 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:12⤵PID:1004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5688 /prefetch:82⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4332 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:396
-
C:\Windows\system32\mode.commode con cp select=12514⤵PID:10456
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2528
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:7912
-
C:\Windows\system32\mode.commode con cp select=12514⤵PID:8000
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:10692
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵PID:7596
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵PID:5920
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5416 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
PID:6520
-
-
C:\Users\Admin\Downloads\Annabelle.exe"C:\Users\Admin\Downloads\Annabelle.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:9144 -
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:8024
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:8008
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:7920
-
-
C:\Windows\SYSTEM32\NetSh.exeNetSh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
PID:6652
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 00 -f3⤵
- Suspicious use of AdjustPrivilegeToken
PID:20964
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951096595234413584,15477513760228851486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:12⤵
- Executes dropped EXE
PID:21280
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1664
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 584 -ip 5841⤵PID:2336
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4144
-
C:\Users\Admin\Downloads\Birele.exe"C:\Users\Admin\Downloads\Birele.exe"1⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 2482⤵
- Program crash
PID:912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1672 -ip 16721⤵PID:4396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:4860
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:4200
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵PID:2248
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4836
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:2976
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1860
-
C:\Users\Admin\Downloads\Birele.exe"C:\Users\Admin\Downloads\Birele.exe"1⤵
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 2522⤵
- Program crash
PID:3144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4560 -ip 45601⤵PID:2280
-
C:\Users\Admin\Downloads\Birele.exe"C:\Users\Admin\Downloads\Birele.exe"1⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 2482⤵
- Program crash
PID:2648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2080 -ip 20801⤵PID:4696
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"1⤵
- Executes dropped EXE
PID:11308
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:8584
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\1c118345af96495c90ab4b4545d9d740 /t 7444 /p 59201⤵PID:6232
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\37b517120c804995b65451a853b78e73 /t 7696 /p 75961⤵PID:5548
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FILES ENCRYPTED.txt1⤵PID:1048
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:13928
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39e1855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:21152
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
AppvIsvSubsystems32.dll.id-59EC5669.[[email protected]].ncov
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-59EC5669.[[email protected]].ncov
- Size 2.7MB
- SHA256 f994d387cc990a2b3f5c4d10e9e6c164a4b71f0cbc14465608f20dcd1b1f6996
- MD5 1b466e5a04a9f7e03d138edb2053037f
- SHA1 5e7ea260e2fd5f15dafb6c7200a5c820042d9cf6
- SHA512 418563cc8bfab7ec8f16bf8b14536f05c9be012affbc988b8d91d4b67c5408fe878159277f2a3c4229dc4dd651adcd8ff78d79bdfc5a686e5aaff177f169149e
- SSDEEP 24576:BTT//fsZc6rBvWSqfmYFYZdiP5dCUEcj1EZ20NQSF643qIhFOzXi819cbm:VIZc6rQSgmYSSrCAJi2b+y9cy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b1fa098c668cdf8092aa096c83328b93e4014df102614aaaf6ab8dc12844bdc0
- MD5 7c16971be0e6f1e01725260be0e299cd
- SHA1 e7dc1882a0fc68087a2d146b3a639ee7392ac5ed
- SHA512 dc76816e756d27eedc2fe7035101f35d90d54ec7d7c724ad6a330b5dd2b1e6d108f3ae44cedb14a02110157be8ddac7d454efae1becebf0efc9931fdc06e953c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 8728752ef08d5b17d7eb77ed69cfdd1fc73b9d6e27200844b0953aeece7a7fdc
- MD5 bdf3e009c72d4fe1aa9a062e409d68f6
- SHA1 7c7cc29a19adb5aa0a44782bb644575340914474
- SHA512 75b85a025733914163d90846af462124db41a40f1ce97e1e0736a05e4f09fe9e78d72316753317dabea28d50906631f634431a39384a332d66fa87352ff497f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 67ae6bc9b7442be144143f3e05b129ec6089cb438823aecb19036c9c4047e4d6
- MD5 363e23fe69788418155724b6472de4a1
- SHA1 aaddb7cb8690973d9eecbd1e3790208d5b401302
- SHA512 40a4720368109ebfacbef5ab5c95208057f6a7807af8b2a357091abc80cef9b18b6b1304b436be5d3e04e04fd123a401adb1b7ff8530659a34c74b05a920cdea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 579B
- SHA256 de4ea8f1d2393892282b2e5ed049c0817630e9350e541f75ac9e9dc832967d41
- MD5 d01be2bc277307bf760669a4f350a984
- SHA1 64859376f5718ae3b4e6979a9f029ceaebf91fe4
- SHA512 a901a5b217e43b9553b2dd6edcafea6a97ad56ea0e94726e578e167409fb8218d7cd5b029788186a5ceacc2ea706f37a6d498ed6915d40e25e662501d02df94f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 496B
- SHA256 3f623f00ff0c445cfdb7d3858755ff615a4b00123b05a364c2ec253621b0eb72
- MD5 5760b7dffb8e58306c53414558155a22
- SHA1 742020b1ba3d0aaea7c0b9767ebca81ee2e7d9cb
- SHA512 c53684e05514b6a8f6b1689429cb25beb82af91e3abd3d72962cd11dd0d4698f47047562087cef2b6c9e4e6134dabc90604ffa75ec8930f7b187f0341de4b842
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c4000fd0e85f34310ec2aa4db6cc8daa2c93d012492325084e8640b8aee7c12c
- MD5 62ee52e6b28c41c844fe923b35e9b43c
- SHA1 8782985e9ad7693428d74d1551ce53999fdb80b3
- SHA512 7764d93c6caa277c8d2f0fb898d5b7a8b675a92604ce822e60256084911da842d31f86c105154d73b11a03e3a753c634e5a2513630e1b5f7cc3ed3406463c7ae
- SSDEEP 96:nqk3w0rqkdmPwSv0MoiVmdHIrJmi0WQyV+VuziX3wI3:nqk3vrqkMPv0MAIF5LM93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 5628c54c935546370853b09120f9cf44cd5456a9403bd438604772c04edd8e6f
- MD5 8ba85ac258c322f657fc76c2f476a169
- SHA1 e33ca99b658047d130801a514c72db9014ecec83
- SHA512 780df6d8bf311f8077688a6d2230fde6a0a915965536dcaed7c737e1d0c14a3ecb07a5e3b2decf4f7d89413502c55f8ec70d7f30ad480f0d4eab0b2cdabbc5b7
- SSDEEP 96:nqk3T0rqkNmPwSv0MoiVmdAug1jIuJmi0WQyV+VpAiX3wI3:nqk3QrqkcPv0MxughIM5Le93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 5fb93198647318f7f21028969b0beaac4b6995602dc26d655ca1aa8d38fc8418
- MD5 f96cb2a82c6a72d7c32dd2bb745abe4e
- SHA1 47e8c128580fe3611202651fe895f4cc43bed7e4
- SHA512 7df7fc9bab5a299f63a96301ea35cba3153d77d6665a092bd9cdb7be8c7a409eb80c6a269ceeb450213093428cb4241322c80e860bda03e8d82d9716870e133b
- SSDEEP 96:nqk3k0rqkNmPwSv0MoiVmdlC7vrkOAFJni0WQyV+VpAiX3wI3:nqk3DrqkcPv0MkC7DkOeiLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 1KB
- SHA256 d53d7da06c04d1ae094c0bcf91b75da95a29980fec78daae574daefc86ac4964
- MD5 ba8416b80a546466a9f74a7833b2a8d4
- SHA1 e3b4bb5e44c08e268f31b4d4351a9434b6da03db
- SHA512 03102b79bba6048f271ff2cde4f247644d33fffef8e9b386d2e048cb9d24b5f6441099a76d8e89110e98262c22d3c7b228c22b419b082b07d23347a183578870
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 874B
- SHA256 5de39ec70a7708954185fdb7fb8157febc232c141633e5df03084d0ce4751c8d
- MD5 ec6c1375c8bad70db03acee94f36f036
- SHA1 2ca6082945933e357f32d268299d7577201b8ab7
- SHA512 080f101f2557cfb0ea8f8e849a10d689d06c0ba704f5e2d1dabc2aa92bd0507a9e0cfcef050b95caa8ad66003a99d9df77b6369ffa2d188e8526d34d6f913fa4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 1KB
- SHA256 13a6e2136350416bd8db1ba06d305e80345891d7027fe0b5457cb5cae2b6c57a
- MD5 e4910557e5637ee5e001ca9072ef49b5
- SHA1 eec972f195ba5a7132ec1b69de7e0db3fdc921c7
- SHA512 ecbd4d1267369f077b2b4b5e36a3a4dfce99c620c6a00cf600d5427938355aa4fa38951bfb0a8243e89f45f19530e72d904ee2aa703af28067769b9fa905b109
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 1KB
- SHA256 b232bc1168c8d618f48ceef83a7cfab8f917bf9845f25d051735446bd6a851f1
- MD5 2904d12ab36ff16a3fd0331da44ac8a7
- SHA1 f41c2abb139b3e13a1b58798d4aa6f6573b89e96
- SHA512 531cc5978bba9a2cb21120dc8c1aaf0f97017cd229bb62e9a1e8e4dbd922ecd232cf9a40082f1f548d21d08a840c2317cb4a0e07b46f572c78b59ca4fc7c8ffe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 1KB
- SHA256 2fff210ab1107bc1b765cc6f44de2686d5c0f7286227ece459cd3d5054006334
- MD5 edcf46e171b8b8c8e33f88c01a70c46e
- SHA1 8b0dee2e7c39fe7fe158d6a46646d689c9bb09ea
- SHA512 634593652f4807e7ea04cd333a10a9d550ef4a62cb54f922b6069c78f51c57ec0f5a3fc49fa084647495d49a6bb8050769e5da891f0384e7ec3579db2f2dddaa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a8af.TMP
- Size 874B
- SHA256 a6a01d44f588213857eba6c87ba1bff7b5bd705dfd99a9da991013f9ac3c1d06
- MD5 48ad1307098bae449251bec92d1845fd
- SHA1 2811dd31e7e98b827a9c93f9bdec49f80fcf5115
- SHA512 d7c1862d20541a67c6a6718b32c9fee096441d04749bb2b342681cd1f4d2c4dbcc7e44e679867feac48a5ff88efb60713361977ba853465aa64ddfc9922e7d95
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 12KB
- SHA256 064511c8b3e2b73fc50afe8e979e4edfd0e3983e0932050f4dadf97b7370d13f
- MD5 3a0a3d6f69e4ce93e8237cc3d8a25d26
- SHA1 e86fb250f83e95225b2ea87053ed4c2f841657df
- SHA512 4fa53e8c34c7733c81ad3448470870ffa17ae421e99fe39627e1f2e05319099cefb171a259fed390093605396e1e8a3e72d99d20b520f5ad54490f3dd5ab136b
- SSDEEP 384:P9iIxuERzA83h09RZxASGHvIyKe0VGzPR6XU1:kIxuERzA83h09RZxbGAFe0U0XU1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 1379ed26bcbb7157356049c994e11e497ce8b9d8f2dbcc0c2899ae894ec98fe8
- MD5 efc6fd1f47238cf157ca5751c1f4d0f4
- SHA1 3d582d03b61afd7488588bffddc3a67ea83a6ba0
- SHA512 508be28d0634cf65d59df0e33d2879659272a3e4b90a61dede433a841317fb454032035a456b24318f8c569395a3f6c7cb42d485cc2820cfd82efb250f4b2407
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG3XGe2RUBXRTZIu32TacHlGz3:M9iIxuERzA83h09RZxASGHII/Iu30VG7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 12KB
- SHA256 36a3137745528ddaa8afb0c52d790ee32c1da0f34874b9bd44e7ac34bf4b8967
- MD5 8ebb5544cce807698f75537ccf421c7a
- SHA1 36c9b9eb3c8bbb934baaf4e694cc185949d0332d
- SHA512 74d340ff6a3f955443d0bb58b75bd9b3a97c8ae9c5971e26a17310d9f6620bf2280820329993ac0ab8eebd29860d98f27fd333c6caf2d0d05c2c6d389cb6a9dd
- SSDEEP 384:P9iIxuERzA83h09RZxASGHvIyKJ0VGzPR6XU1:kIxuERzA83h09RZxbGAFJ0U0XU1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 12KB
- SHA256 1228df8ece4f3eb1486671983d876fd84f477b2433244f3c2fc243791469cecb
- MD5 c7b98311f6e275809436157b3884cb1e
- SHA1 03620e63906e1227391c2701a0fa37dc1d44ede0
- SHA512 fbee6273257f62635b1d75ab4c3f01c96235719926fca140d5ed305b1567949f7d6441ef99ac2eb5f38488a07ea770fdf39562303d6bffbef947248180d6342d
- SSDEEP 384:G9iIxuERzA83h09RZxASGHvIyKJ0VGzPR6XU1:1IxuERzA83h09RZxbGAFJ0U0XU1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 12KB
- SHA256 70051cae7779fb78afc003d9bdefdd39163fac6c819acb5b861049a4cc8f377e
- MD5 71869d188d1f977103bb2d676ebf9066
- SHA1 8ffc806655f7a52a1f30faecb370d8fe90735ad0
- SHA512 38b374d985db6d5dc1f1d4521a84703158f515de4e90ed035b98184caf16b2ac06ad92a18ea460b402266bdac0697dfc87a174d08268d5af6403b180a68570a1
- SSDEEP 384:09iIxuERzA83h09RZxASGHvIyK40VGzPR6XU1:fIxuERzA83h09RZxbGAF40U0XU1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\d4d40a47-cdf6-4f21-bbe3-af2ac611da05.down_data
- Size 555KB
- SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
- MD5 5683c0028832cae4ef93ca39c8ac5029
- SHA1 248755e4e1db552e0b6f8651b04ca6d1b31a86fb
- SHA512 aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
- SSDEEP 6144:m4W6OWkK0An6PtQ3VG7Gz3AW/ZPfMKUPIbs7aGU4toNNQQPi/+sMT/TtpNkppXsb:hW6O/k1zQWZz/QtGo2saBKZIxWoOu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\Birele.exe:Zone.Identifier
- Size 55B
- SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
- MD5 0f98a5550abe0fb880568b1480c96a1c
- SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
- SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\Unconfirmed 166394.crdownload
- Size 116KB
- SHA256 b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23
- MD5 41789c704a0eecfdd0048b4b4193e752
- SHA1 fb1e8385691fa3293b7cbfb9b2656cf09f20e722
- SHA512 76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea
- SSDEEP 3072:pYV/aVHN9ySTn34w33FVTyuGAxsvBLSqAKZqoqrxy031l3y:8adNlltyu3Pa5gr33
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\Unconfirmed 197712.crdownload
- Size 1.0MB
- SHA256 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
- MD5 055d1462f66a350d9886542d4d79bc2b
- SHA1 f1086d2f667d807dbb1aa362a7a809ea119f2565
- SHA512 2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1
- SSDEEP 24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\Unconfirmed 560018.crdownload
- Size 15.9MB
- SHA256 716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac
- MD5 0f743287c9911b4b1c726c7c7edcaf7d
- SHA1 9760579e73095455fcbaddfe1e7e98a2bb28bfe0
- SHA512 2a6dd6288303700ef9cb06ae1efeb1e121c89c97708e5ecd15ed9b2a35d0ecff03d8da58b30daeadad89bd38dc4649521ada149fb457408e5a2bdf1512f88677
- SSDEEP 393216:UMwm0qBknxdEX+LbMUgoSZmWSmh4aaRN22ChHCMNku1y:UMcKX+Lbjgd7W1RNVC9ku1
- MD5 SHA1 SHA512 SSDEEP