mimic | 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca

Analysis

max time kernel
149s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
Size

2.6MB
MD5

88d00427a014f1fdb88383a6a8ab97a5
SHA1

d8c5d3ab8e11aa9dd5236625b610837b5cbbfd27
SHA256

1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca
SHA512

764319cdf3423a0c38f9050694bd936f2081d1ae34580aa055171ac84ae4b77d488422a68a5e607d2df6ba2627835990fba93a8a405d29cd88c1cde828ce3531
SSDEEP

49152:wgwR0ifu1DBgutBPNw6m+sqFrDCcTeL7dzXVeH0Bl1nzBJ6GDaJP:wgwR0vguPPK6GkDC7hv1zeP

Score

10^/10

mimic evasion execution persistence ransomware spyware stealer trojan

Malware Config

Signatures

Detects Mimic ransomware 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe	family_mimic

Mimic
Ransomware family was first exploited in the wild in 2022.
ransomware mimic
Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

DC.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3" DC.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3"	DC.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

YOURDATA.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	YOURDATA.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1976 bcdedit.exe
2340 bcdedit.exe
Renames multiple (6255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes System State backups 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1268 wbadmin.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

888 wbadmin.exe

pid	process
1976	bcdedit.exe
2340	bcdedit.exe

pid	process
1268	wbadmin.exe

pid	process
888	wbadmin.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

YOURDATA.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangeis.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iisadmin.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangesa.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe	YOURDATA.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2308 cmd.exe

pid	process
2308	cmd.exe

Executes dropped EXE 10 IoCs

Processes:

7za.exe7za.exe5koto.exeYOURDATA.exeDC.exeYOURDATA.exeYOURDATA.exeYOURDATA.exeEverything.exeEverything.exe

pid	process
2552	7za.exe
2684	7za.exe
2536	5koto.exe
240	YOURDATA.exe
2812	DC.exe
1992	YOURDATA.exe
1980	YOURDATA.exe
1252	YOURDATA.exe
2300	Everything.exe
1368	Everything.exe

Loads dropped DLL 19 IoCs

Processes:

1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe5koto.exeYOURDATA.execmd.exeYOURDATA.exeYOURDATA.exeYOURDATA.exe

pid	process
1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
2536	5koto.exe
2536	5koto.exe
240	YOURDATA.exe
1020	cmd.exe
1992	YOURDATA.exe
1980	YOURDATA.exe
1252	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

5koto.exeYOURDATA.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	5koto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	5koto.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	YOURDATA.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell\open\command	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	5koto.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell\open\command	5koto.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell	5koto.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell\open	5koto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	YOURDATA.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

DC.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection DC.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	DC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5koto.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YOURDATA = "\"C:\\Users\\Admin\\AppData\\Local\\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\\YOURDATA.exe\" "	5koto.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

YOURDATA.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	YOURDATA.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Everything.exeEverything.exe

description	ioc	process
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe

Drops file in System32 directory 2 IoCs

Processes:

DC.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	DC.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	DC.exe

Drops file in Program Files directory 64 IoCs

Processes:

YOURDATA.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous.png.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jre7\lib\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png.getmydata@tutamail.com.5000USD	YOURDATA.exe

Drops file in Windows directory 3 IoCs

Processes:

wbadmin.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2220 powershell.exe
2960 powershell.exe
700 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2220	powershell.exe
2960	powershell.exe
700	powershell.exe

Modifies registry class 19 IoCs

Processes:

5koto.exeYOURDATA.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell\open	5koto.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell\open\command	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\----Read-Me-----.txt\""	YOURDATA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	5koto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	5koto.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell	YOURDATA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.5000USD	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.5000USD\ = "mimicfile"	YOURDATA.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell	5koto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	YOURDATA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	5koto.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	YOURDATA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	YOURDATA.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile\shell\open\command	5koto.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\exefile	5koto.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DC.exeYOURDATA.exeYOURDATA.exeYOURDATA.exepowershell.exepowershell.exepowershell.exe

pid	process
2812	DC.exe
2812	DC.exe
2812	DC.exe
2812	DC.exe
1980	YOURDATA.exe
1252	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
240	YOURDATA.exe
2220	powershell.exe
700	powershell.exe
2960	powershell.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe
1980	YOURDATA.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7za.exe7za.exe5koto.exeYOURDATA.exeDC.exeYOURDATA.exe

description	pid	process
Token: SeRestorePrivilege	2552	7za.exe
Token: 35	2552	7za.exe
Token: SeRestorePrivilege	2684	7za.exe
Token: 35	2684	7za.exe
Token: SeSecurityPrivilege	2684	7za.exe
Token: SeSecurityPrivilege	2684	7za.exe
Token: SeIncreaseQuotaPrivilege	2536	5koto.exe
Token: SeSecurityPrivilege	2536	5koto.exe
Token: SeTakeOwnershipPrivilege	2536	5koto.exe
Token: SeLoadDriverPrivilege	2536	5koto.exe
Token: SeSystemProfilePrivilege	2536	5koto.exe
Token: SeSystemtimePrivilege	2536	5koto.exe
Token: SeProfSingleProcessPrivilege	2536	5koto.exe
Token: SeIncBasePriorityPrivilege	2536	5koto.exe
Token: SeCreatePagefilePrivilege	2536	5koto.exe
Token: SeBackupPrivilege	2536	5koto.exe
Token: SeRestorePrivilege	2536	5koto.exe
Token: SeShutdownPrivilege	2536	5koto.exe
Token: SeDebugPrivilege	2536	5koto.exe
Token: SeSystemEnvironmentPrivilege	2536	5koto.exe
Token: SeChangeNotifyPrivilege	2536	5koto.exe
Token: SeRemoteShutdownPrivilege	2536	5koto.exe
Token: SeUndockPrivilege	2536	5koto.exe
Token: SeManageVolumePrivilege	2536	5koto.exe
Token: SeImpersonatePrivilege	2536	5koto.exe
Token: SeCreateGlobalPrivilege	2536	5koto.exe
Token: 33	2536	5koto.exe
Token: 34	2536	5koto.exe
Token: 35	2536	5koto.exe
Token: SeIncreaseQuotaPrivilege	240	YOURDATA.exe
Token: SeSecurityPrivilege	240	YOURDATA.exe
Token: SeTakeOwnershipPrivilege	240	YOURDATA.exe
Token: SeLoadDriverPrivilege	240	YOURDATA.exe
Token: SeSystemProfilePrivilege	240	YOURDATA.exe
Token: SeSystemtimePrivilege	240	YOURDATA.exe
Token: SeProfSingleProcessPrivilege	240	YOURDATA.exe
Token: SeIncBasePriorityPrivilege	240	YOURDATA.exe
Token: SeCreatePagefilePrivilege	240	YOURDATA.exe
Token: SeBackupPrivilege	240	YOURDATA.exe
Token: SeRestorePrivilege	240	YOURDATA.exe
Token: SeShutdownPrivilege	240	YOURDATA.exe
Token: SeDebugPrivilege	240	YOURDATA.exe
Token: SeSystemEnvironmentPrivilege	240	YOURDATA.exe
Token: SeChangeNotifyPrivilege	240	YOURDATA.exe
Token: SeRemoteShutdownPrivilege	240	YOURDATA.exe
Token: SeUndockPrivilege	240	YOURDATA.exe
Token: SeManageVolumePrivilege	240	YOURDATA.exe
Token: SeImpersonatePrivilege	240	YOURDATA.exe
Token: SeCreateGlobalPrivilege	240	YOURDATA.exe
Token: 33	240	YOURDATA.exe
Token: 34	240	YOURDATA.exe
Token: 35	240	YOURDATA.exe
Token: SeDebugPrivilege	2812	DC.exe
Token: SeAssignPrimaryTokenPrivilege	2812	DC.exe
Token: SeIncreaseQuotaPrivilege	2812	DC.exe
Token: 0	2812	DC.exe
Token: SeIncreaseQuotaPrivilege	1992	YOURDATA.exe
Token: SeSecurityPrivilege	1992	YOURDATA.exe
Token: SeTakeOwnershipPrivilege	1992	YOURDATA.exe
Token: SeLoadDriverPrivilege	1992	YOURDATA.exe
Token: SeSystemProfilePrivilege	1992	YOURDATA.exe
Token: SeSystemtimePrivilege	1992	YOURDATA.exe
Token: SeProfSingleProcessPrivilege	1992	YOURDATA.exe
Token: SeIncBasePriorityPrivilege	1992	YOURDATA.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Everything.exeEverything.exe

pid process

2300 Everything.exe
1368 Everything.exe

pid	process
2300	Everything.exe
1368	Everything.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe5koto.exeYOURDATA.execmd.exe

description	pid	process	target process
PID 1704 wrote to memory of 2552	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 1704 wrote to memory of 2552	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 1704 wrote to memory of 2552	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 1704 wrote to memory of 2552	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 1704 wrote to memory of 2684	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 1704 wrote to memory of 2684	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 1704 wrote to memory of 2684	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 1704 wrote to memory of 2684	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 1704 wrote to memory of 2536	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	5koto.exe
PID 1704 wrote to memory of 2536	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	5koto.exe
PID 1704 wrote to memory of 2536	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	5koto.exe
PID 1704 wrote to memory of 2536	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	5koto.exe
PID 2536 wrote to memory of 240	2536	5koto.exe	YOURDATA.exe
PID 2536 wrote to memory of 240	2536	5koto.exe	YOURDATA.exe
PID 2536 wrote to memory of 240	2536	5koto.exe	YOURDATA.exe
PID 2536 wrote to memory of 240	2536	5koto.exe	YOURDATA.exe
PID 240 wrote to memory of 1020	240	YOURDATA.exe	cmd.exe
PID 240 wrote to memory of 1020	240	YOURDATA.exe	cmd.exe
PID 240 wrote to memory of 1020	240	YOURDATA.exe	cmd.exe
PID 240 wrote to memory of 1020	240	YOURDATA.exe	cmd.exe
PID 1020 wrote to memory of 2812	1020	cmd.exe	DC.exe
PID 1020 wrote to memory of 2812	1020	cmd.exe	DC.exe
PID 1020 wrote to memory of 2812	1020	cmd.exe	DC.exe
PID 1020 wrote to memory of 2812	1020	cmd.exe	DC.exe
PID 240 wrote to memory of 1992	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1992	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1992	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1992	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1980	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1980	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1980	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1980	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1252	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1252	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1252	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 1252	240	YOURDATA.exe	YOURDATA.exe
PID 240 wrote to memory of 2300	240	YOURDATA.exe	Everything.exe
PID 240 wrote to memory of 2300	240	YOURDATA.exe	Everything.exe
PID 240 wrote to memory of 2300	240	YOURDATA.exe	Everything.exe
PID 240 wrote to memory of 2300	240	YOURDATA.exe	Everything.exe
PID 1704 wrote to memory of 2308	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	cmd.exe
PID 1704 wrote to memory of 2308	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	cmd.exe
PID 1704 wrote to memory of 2308	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	cmd.exe
PID 1704 wrote to memory of 2308	1704	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	cmd.exe
PID 240 wrote to memory of 2368	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 2368	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 2368	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 2368	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1800	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1800	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1800	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1800	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1984	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1984	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1984	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1984	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 2776	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 2776	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 2776	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 2776	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1384	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1384	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1384	240	YOURDATA.exe	powercfg.exe
PID 240 wrote to memory of 1384	240	YOURDATA.exe	powercfg.exe

System policy modification 1 TTPs 11 IoCs

evasion

Modify Registry

T1112

Processes:

YOURDATA.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	YOURDATA.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
"C:\Users\Admin\AppData\Local\Temp\1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p5056156942493511584 Everything64.dll
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe
    "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"
    3⤵
    - UAC bypass
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:240
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c DC.exe /D
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\DC.exe
        
        DC.exe /D
        5⤵
        Modifies security service
        Executes dropped EXE
        Windows security modification
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
  - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe
      "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e watch -pid 240 -!
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1992
  - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe
      "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e ul1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1980
  - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe
      "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e ul2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1252
  - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe
      "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:2300
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -H off
      4⤵
      PID:2368
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:1800
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:1984
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:2776
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:1384
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:1644
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:1060
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:976
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:1972
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:2168
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:1940
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:1820
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:608
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      PID:1204
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
      4⤵
      PID:2892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2220
  - - C:\Windows\system32\bcdedit.exe
      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1976
  - - C:\Windows\system32\bcdedit.exe
      bcdedit.exe /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2340
  - - C:\Windows\system32\wbadmin.exe
      wbadmin.exe DELETE SYSTEMSTATEBACKUP
      4⤵
      Deletes System State backups
      Drops file in Windows directory
      PID:1268
  - - C:\Windows\system32\wbadmin.exe
      wbadmin.exe delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:888
  - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe
      "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Deletes itself
  PID:2308

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2776

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1140

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2420

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\----Read-Me-----.txt

Filesize
1KB

MD5
6a8672a3a9c1180fadde722959302e08

SHA1
37d1c75637d66bf32d952ed6ac6755fedd723633

SHA256
4c901b0d54f2f838a742a4af2790dede4f46a580898702f70d0cae1d2d2e949c

SHA512
d9b9581afa6dddb8f2ab7aa20749f50ab0be0db52d6dfd53dac49eef2769de84b6e4970c9e2374fd56a4cf2085de53b3ad76ceae919b0b710c34440ac0349882

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
300B

MD5
5807dbdb0aa9156ab44cd310c0c60428

SHA1
bd144bf252b3e8595881467eeb049271a4535bb5

SHA256
81b0b200867139dad232e22131799ab5836cd7ee429f179b9c767c6ed2e0b0d3

SHA512
497d73bbf28f1ee251acc24b6a0a2089b8a6940767dd3972128e347578c019063ccfdc9d077ae70192d12fb0f38e10e583f08e56e2f524acc9e521ce2af915fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe

Filesize
2.3MB

MD5
68d90c681c9748e8489f3f9fc622301d

SHA1
931ebcaec96692ba2054379a489a4af0451bf630

SHA256
cfbcf827900a5dc36d1d2ba4b4879ce703a429b1952e6e9616f498a9bde68c91

SHA512
4dcd84246dec0522787dff8fb1ff90e418e1ed47496f9e35e56e5c5c26dcc8a2283a0478bcbd44d61a763ea46b050675aca1d93a6ff628d39f7f51e254fbdd80

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini

Filesize
548B

MD5
742c2400f2de964d0cce4a8dabadd708

SHA1
c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

SHA256
2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

SHA512
63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini

Filesize
550B

MD5
51014c0c06acdd80f9ae4469e7d30a9e

SHA1
204e6a57c44242fad874377851b13099dfe60176

SHA256
89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

SHA512
79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll

Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll

Filesize
1.7MB

MD5
1538b51a67fde66f3b41b5ac47f4ac1b

SHA1
296956729df307b32e8fd9fd4388e6f2dbfb5298

SHA256
0053300049b43fe839eb1c630b42157f5dd7dfddb49e9ee77a5ce317f925727a

SHA512
9f6507d23f7c2be73fc3b43de3e90fb80c76d0aae618deb73658e8c225357e9d9a2d54111e306f3d9caed177a0a8e8c5c162c91cdef3502c45e050c168c5c8f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\xdel.exe

Filesize
350KB

MD5
803df907d936e08fbbd06020c411be93

SHA1
4aa4b498ae037a2b0479659374a5c3af5f6b8d97

SHA256
e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

SHA512
5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

Download Submit
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.db

Filesize
9.3MB

MD5
f2c6f35789e388f9b0cf07dba41797c7

SHA1
ba2814c9352e80650775b3ac87d2638a1c884765

SHA256
e5c1f68f5dfaba8d539becd640a90f4ed66c04eba88a71c264851d3cbbda8ebc

SHA512
deb8959febe31d1c6434548a9304f94229b09d2d49ae379f26bbbb7f4e4300677c12249f03eae62aa4d32271c6b1d0a8e3a99d3737619a311f834eeece82ad65

Download Submit
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.ini

Filesize
20KB

MD5
45641ddce41d25c2b335507ce68000b1

SHA1
ab7b694266dd1b8ce949c320b623384ab4160565

SHA256
9b1b793868f2093c0cfa404b1e9d99bd3bcad2c8b69eb6ce1785516cb66ea149

SHA512
7255b6f947d99b60a2b393093803a1c681ca7b1c8485041ab70e1c8bc7e554e19e23fb5700af2764cdd9a2b6e5a4cb4830245254e93ec4963771d264af8f2598

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6f791b9de5bc66b35adecf6cb2a1a65e

SHA1
408eb9eae6d1ea32e975480dc74545e8c7367138

SHA256
f5a140f79fe3499f30e9a7013625076601dcb27090aa6ba0ac5eff98ddfc3925

SHA512
1f1fb144ccc996fd081f389a55ebf179b02e2e4111efab9fa824d9eaefe2cfaeaea94fa59e616cc4fae8f52bd8fa2b923894a9ff0cd654e4bed5526e83d7c219

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
233B

MD5
cd4326a6fd01cd3ca77cfd8d0f53821b

SHA1
a1030414d1f8e5d5a6e89d5a309921b8920856f9

SHA256
1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c

SHA512
29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67

Download Submit
C:\temp\MIMIC_LOG.txt

Filesize
31KB

MD5
5ee779318ff47899d764dcdd574f3db6

SHA1
6cd3ef5ce4742a4e73d790e846407bf01632d60b

SHA256
802a79b1033605c3bb3872171868dba874cb56971d3bd0840227143ca1099f95

SHA512
a0e0f5f86d1ea5135b541bfd9ef2d517f69af7c5ca3058abfd323a52730e394be9209df46959bd60fb10eadd650a989dea2380b4f9943a3ec6ec9a1beec83e8b

Download Submit
C:\temp\MIMIC_LOG.txt

Filesize
32KB

MD5
eeb62700d0b2b68c460b35bf7825eb60

SHA1
42185597cc3e8a1b52ce071ea567a448dc73ecb0

SHA256
8a0d44bcb3a52e2542c981ecc9d37fd27d5fe02e215abf4f86bffb68254b6e8e

SHA512
96384e4c4650627522a078521ddd8ea13e33044b2b592316f659419dd47bb746313eda220060e1dd392a191b422f3be35be416d9ccdfc711aaa395f4f117db8b

Download Submit
C:\temp\session.tmp

Filesize
32B

MD5
ac9f9cf8c867e5c73cf84fa95fbcdca0

SHA1
ccf805a277c566c526feb00833993bdf0c1ebd36

SHA256
7558bd6ff8a97013707b8783cce370ad03964269a4ce46a1cf69db893cc6da80

SHA512
5c9b883255079f0228480aa739f04c3f978682772253afecb5aa2186f7ab60c8434719a5c335211e07d83dcbfa1f8f5dd55289b243cbad37ffa0ad54a50465b1

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe

Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
memory/2220-140-0x0000000001D30000-0x0000000001D38000-memory.dmp

Filesize
32KB

Download
memory/2960-139-0x000000001B270000-0x000000001B552000-memory.dmp

Filesize
2.9MB

Download