0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe
Size

104KB
MD5

88a56ef17a376c36fd13cd53b5d754c9
SHA1

d310e1d542583ce105fe27c387b84b1a626681da
SHA256

0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3
SHA512

6954ad2dc592f5a2e1369556ef91f2cadc8d3ae9f81d197329833887d2fda754169b1a5c0e4a8ce864d8c7cc23d5b6cae3ea73098f44d0bea26b945b173d6858
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8yiCTWn1++PJHJXA/OsIZfzc3/Q8yib:KQSojQSom

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4304) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 55 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2176-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\_RecoveryDrive.lnk.exe	UPX
\Windows\SysWOW64\Zombie.exe	UPX
behavioral1/memory/2300-15-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp	UPX
behavioral1/memory/2176-24-0x00000000002E0000-0x00000000002EA000-memory.dmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp	UPX
C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.exe.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp	UPX
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.tmp	UPX
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.tmp	UPX
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.tmp	UPX
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.tmp	UPX
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.tmp	UPX
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll.exe	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml.tmp	UPX
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST.tmp	UPX
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi.tmp	UPX
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	UPX

Executes dropped EXE 2 IoCs

Processes:

_RecoveryDrive.lnk.exeZombie.exe

pid process

2300 _RecoveryDrive.lnk.exe
2088 Zombie.exe

pid	process
2300	_RecoveryDrive.lnk.exe
2088	Zombie.exe

Loads dropped DLL 4 IoCs

Processes:

0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe

pid	process
2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe
2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe
2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe
2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2176-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_RecoveryDrive.lnk.exe	upx
\Windows\SysWOW64\Zombie.exe	upx
behavioral1/memory/2300-15-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp	upx
behavioral1/memory/2176-24-0x00000000002E0000-0x00000000002EA000-memory.dmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp	upx
C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.exe.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp	upx
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.tmp	upx
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.tmp	upx
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.tmp	upx
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.tmp	upx
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.tmp	upx
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmp	upx
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.tmp	upx
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.tmp	upx
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp	upx
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp	upx
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.tmp	upx
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp	upx
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp	upx
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.tmp	upx
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.tmp	upx
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.tmp	upx
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.tmp	upx
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmp	upx
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp	upx
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp	upx
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp	upx
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp	upx
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.tmp	upx
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmp	upx
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp	upx
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll.exe	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml.tmp	upx
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST.tmp	upx
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi.tmp	upx
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	upx

Drops file in System32 directory 2 IoCs

Processes:

0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe_RecoveryDrive.lnk.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\gadget.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp	_RecoveryDrive.lnk.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Madrid.tmp	_RecoveryDrive.lnk.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui.tmp	_RecoveryDrive.lnk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties.tmp	_RecoveryDrive.lnk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar.exe.tmp	_RecoveryDrive.lnk.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\RSSFeeds.css.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)notConnectedStateIcon.png.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\timeZones.js.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar.tmp	_RecoveryDrive.lnk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmicrodns_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	_RecoveryDrive.lnk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\drag.png.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\flyout.css.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	_RecoveryDrive.lnk.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextService.dll.tmp	Zombie.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	_RecoveryDrive.lnk.exe
File opened for modification	C:\Program Files\ImportSwitch.xlsb.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	Zombie.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnscfg.exe.mui.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp	_RecoveryDrive.lnk.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	_RecoveryDrive.lnk.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe

description	pid	process	target process
PID 2176 wrote to memory of 2300	2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe	_RecoveryDrive.lnk.exe
PID 2176 wrote to memory of 2300	2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe	_RecoveryDrive.lnk.exe
PID 2176 wrote to memory of 2300	2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe	_RecoveryDrive.lnk.exe
PID 2176 wrote to memory of 2300	2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe	_RecoveryDrive.lnk.exe
PID 2176 wrote to memory of 2088	2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe	Zombie.exe
PID 2176 wrote to memory of 2088	2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe	Zombie.exe
PID 2176 wrote to memory of 2088	2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe	Zombie.exe
PID 2176 wrote to memory of 2088	2176	0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe	Zombie.exe

C:\Users\Admin\AppData\Local\Temp\0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe
"C:\Users\Admin\AppData\Local\Temp\0c54ccce23a00bd587143e6e54bac2555efa1bd2e26868f637bec82c79cabac3.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2176

C:\Users\Admin\AppData\Local\Temp\_RecoveryDrive.lnk.exe
"_RecoveryDrive.lnk.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2300

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2088

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.exe.tmp
Filesize
104KB

MD5
e2917f7d4ddf206abe7ced285bd14662

SHA1
9ba41362e701d01fb3709eb6bcb8bffabf260cd8

SHA256
a10abccde1f5ef83f84f99e999e5ddcb8795b1bc09022878b3f4c603a250bf3b

SHA512
0bd16beaf6280bed7007e76d2a8d142dacf04c0151d430a7b1a77596062a525310a4305dda69ffeed8f33ba73f507b5bd29dfa10e12cf436467f157e7cedde9c

Download Submit
C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp
Filesize
53KB

MD5
fab66589c01f36b82bb17abbf64719df

SHA1
af74ebb0d5841107bf455c081b3946f8133f202f

SHA256
5ba36bc9a441d5d36d753147e4eab77b7fc89d1a40fa15b8b85126e7b8ec765e

SHA512
995d881e78386e4d58896af367d43eb265b31f85d17cc8fc5cc6069ebb74a612d7aea00fdf2bd2eedde2e06fdf021320f14807a2e0a6f814fa82b5a291871264

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmp
Filesize
5.5MB

MD5
ec75fb60892f5848e395cab8953d2604

SHA1
7674c7d48743315f4f18077314ea995265e742f6

SHA256
016ddc569301298dde3d91e3908daefb150ddfe1df6776e6ced87af5e1008ad6

SHA512
abfcf04d1485fc7a46cb4d2d7188b978430ed93d476d0dcaaca2dc89b3cdfac8b689d1eba41a3bcb637566342d5d7583b9a5ba0c4b82ab2c76d6bcff68d80579

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp
Filesize
492KB

MD5
24e03160fc6f4d8d825b06f3ac7d69b0

SHA1
50a1abcbfd28beadb65f35c07d3ce752fe33f22d

SHA256
856fb2a3fef968f4f9ef04a9a7ab2c1f925f4db7a1445d7ea3e7e68447eb74dd

SHA512
e5c4166201f9d28df252d75585507ead6592974b3d9b72367aa4ebcdb03f5eef13925b5de68a4bee1936e4f9f9f5d2d32d03d359aaee4c74c0696fd9a46a1987

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp
Filesize
2.9MB

MD5
4aa103b103cd5560110d4bb9d0a894ff

SHA1
b7e5f7615d9ebb6c0d521cadaac326ca39fac5c0

SHA256
073fa2a14c943f2c7cead52fa6e717889b2d3db7c34ec6dcbe4e0de6cd12730d

SHA512
ec3e784e45616987c0235c87610054c84288beb0381762a425e9d60b00d7acca1374698d97dcc1bd1b13fd02d7e646cac08a28b5c199a5314154291009489758

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll.tmp
Filesize
56KB

MD5
7a002cc68fd243bea7ea6316a21348bd

SHA1
2583f55dcbde06dc8235d0c0d0d9a90845ad50c5

SHA256
ecc3d8474266923a5f32cc21c55d8093158484373d4949e199aaa86e19875560

SHA512
e74bd9492e6999b65031d5d9c4f0ce4f7202afef9427cccbf2898c94909fc2009132a4b4ea37c41aa50bf564d0837191b15f1023ea3f6f4341d90c6e314b3e01

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmp
Filesize
56KB

MD5
4ff4eb30efb6c6783c6b4cf2c0bdf321

SHA1
55686f97d9ed58f54261ef30d298da062e742ef9

SHA256
1c04f8f5ddcbb26877a72ea2fef297e397b9bce92e6c704ecac23f26626beb37

SHA512
263801d242624a90d2e3bd08db4ab9d30343109ef21df2304a4859c6741904346abfa70838cc4d3200063dd047b01bd0209ee156a1f0b20e28fe2f352206ffd5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.tmp
Filesize
52KB

MD5
a3c53788cbc69e055b7e996c6b137c9c

SHA1
015c4efb840356ccaaadb4008bad1096bedab832

SHA256
24a28d6f914c7f061819f39b1ab74b38c762a2cad7bb975808d40d0f4ae6f49e

SHA512
de3c7642a50115a63eea746adc9ce73541d7975e3820f1b37516d6b6d2098e49ed1fadfbf3d475253238e7421f32c35db7e1481d91a2c2bfed2b0e4ca33ec22e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe.tmp
Filesize
197KB

MD5
21651989327aed0f22eb516ce1be9320

SHA1
f2fb14576ced625c649c3e8a4204c735e2c72817

SHA256
376709940decaa89e16d6431de88cd5fe454fb33b1d9480a0031d1fdd99fc6dc

SHA512
4159fe8cf7967d1bff2171cf5da780c791c392dcce802ffda4c5e98baeb2a84651e53fb2e84e75f2f392d9dc3e75655268c2134f56eeed736df449cb77bdc454

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.tmp
Filesize
5.6MB

MD5
57cdafe36fa46e9640a5019666e0f256

SHA1
d5bf60990a319a4b17a513b96299673a12f1fbae

SHA256
33cb3d23f1352da17decb1453ad9d3e6f4acd987a88b36ebd793b00fc18200b8

SHA512
32643a6252fb9779b7c59b11394d78f14118dfe9dc0733b6d4be56e6629dc7b037e76c0fc30d52f18f126437f09aa8441050ae610e57390b357f4aee277f5d70

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.tmp
Filesize
52KB

MD5
413468e0c6ad8b0f4743bd4199400a4c

SHA1
baef72ef5049387a5c7035cd4853232d4f81a00c

SHA256
038ead94dee0363031902213f1a9bdb453a6ed3309ca6734df33df0ad56445ea

SHA512
4f1a1fedaa5683a4656bf577c2b03e83d3a5a19af415d7b6c702b01a545fff15080a880ae793fa1476fd766e55e26c937b6fc6247e2f473f9e02942e7b59a29e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp
Filesize
56KB

MD5
e3f91c046bda6312a7f1696b04f5143c

SHA1
011ac41786831e7880a2b30d266490a63b7106c9

SHA256
4443ce6ccc621720c642992bd80824178c50df100f41ff68b6c160ecd2de408f

SHA512
f75d2a893d3b22a89717655f0914234c5a9b0dfb7741d41e3492cd7f56c150a2d7d1a4822a52710363bf15abd4d0d8b99fd9ba9151fe5aabcb078d3771e4e917

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp
Filesize
1.1MB

MD5
b9ab8b79685e8f9cb0315bd923c810fb

SHA1
6305901c656391bc8ab340a9543ee759abd6b864

SHA256
fe9b1e1c6cb474871325598537146428e20e384f683bf20c356476d3bc74ec3f

SHA512
5f00076b6cd80a8df24c9bef3230647e6fd6a894071dbcb82d53c1cbf593b4698ac05c623c8d48bb1fd570bd2c73ff7a8cbbf606f44b870f2930d8f2e16298ba

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.tmp
Filesize
16.2MB

MD5
1f2527346f3d5a418e3bacd463986466

SHA1
0daecfd8bc9417db74397effaf9ed0a1ba31b737

SHA256
45fc86b050cebe0e194816207603851376409c803f2c7078805c93fcb4466c11

SHA512
92886f0c982f2bfa5f501f450a7bc2fb5ec236d7fc70a8ffd3bd49daa8adfa1dbb9cb2ee70d17dd9ace0b29265be4b0ff011b1971ec52c6acb718e1d6cfc49f5

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.tmp
Filesize
1.8MB

MD5
a37e43b7e91b645d6576158ccad8f09b

SHA1
0ec6924f540d3ce98af0cd22817e9a348a09b599

SHA256
33782fd62c086a4295b23b4585e11a85a16a2889926956cd8dcf01360f75c3b3

SHA512
67fe9bee3b232b06cefbadf9dd8b4021c2c3da40223b55a04dc59be0b600e791c35f7d40196ca4efa3c649e90b1a219365c2578f42c08174fd4e8a1a556fa2c8

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.tmp
Filesize
1.8MB

MD5
7503be1b380af0dbab111d8dc1421273

SHA1
815bd28cf31d5ebb2b9bada7c604c17df941b5d8

SHA256
eb186f2f3e5ae492b4abd9816c4c74f0479c8c13e0ce568a52dfe76527a4f215

SHA512
6e035038fecd4680b9f3ef27a7b78880e1fc747a6c98a7d47b84b953a770f3f691b7fd06830760ca4ea5578f0e5eb58b1b6b506360ac0dfd06f3ffd48dce8d87

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.tmp
Filesize
56KB

MD5
801ff6ea3b7f0d1520850df85cbd34b7

SHA1
732b658e961e7bfd2b2c60dc4906e6d7b8edc77d

SHA256
bec233bc888b0df402c4ecd645e485e27491eef0eb797b156cdc6baddb75b984

SHA512
6bb74bdcead6ca7075016b5ce76bbc918899ed171e062dc177fb9dd53ccd2bb7b0ce22799c74ac57a643055d4fa1a0e71bdcf9f364638cb82bbfd435cc3d05a9

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.tmp
Filesize
57KB

MD5
0a16d6d4321409520822a6295eefff88

SHA1
205d56036be3be989a1d0853199dbdffbbe8bbdb

SHA256
c21a904eb0e31f17e372353936ddae0767058a43d40218aa395a85e4fa4c7a58

SHA512
6f9975c4b8b5819a299185ecfdc0015ea6dd8d41445bc1a9e183027eeb7ce60234827e85c311140176dd6c64a99db37e4c593b2de8e69a75fc20680e408689be

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmp
Filesize
56KB

MD5
feae68db7d7f499a97c444ab042068e9

SHA1
c045649e13359acaabfdfdfc245a28cb852bc12b

SHA256
1a65a1686a4d96721cc404a449f26c4b634411f513433407f0f76e3e6afd4798

SHA512
cec65d4bd9d2586f5aa9c05efa137abedca627b81b1a98840f71f9961c89c5e7a1fbce484f906d9f413c1aaee618cfd564257028aca1a663af94f76ad0482392

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.tmp
Filesize
54KB

MD5
704967d773534d312a6ce96c821d1031

SHA1
db8a9181d2dcf77698a084a1adcda83c24aed69b

SHA256
5f1063095ff891b55bb39423e1bb4e017fb89e052ae5aaea678dffaaaf4ef67a

SHA512
212ad7d50226a1b198c9ecb01c212ea39f48dd1516724bcc250531cbe71c2d46e05e3b456486b94b2bbc0c5afab6eb4d71b631f1288283ed725ed3006acda45b

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.tmp
Filesize
56KB

MD5
b12d0052e3a65e680667bb2f230a270b

SHA1
d217d2d0a2192e5db0b3a8e2ef6e0c54ac4ee082

SHA256
d91bafdbf33fcf1063cea7ed04f253e8fe9bfe161bf34e27b497c09c9b8cc668

SHA512
44138f08a12e19e802c6e3a210cb2796eca2db55b487d7a1a5ea5b07ccc32f13a1e25c7d1ebd56085e9e1e77d04ef394dfda2b12e9fd143e0fcbc9ffd824b808

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp
Filesize
56KB

MD5
868b6c573546fce39ef46ea82531ee86

SHA1
c80f8f3b09e3604ca7fb40cdfef3083dfc927d05

SHA256
7eadd0c30d3af10534a412404510dbbbee55606fb083c49afd6ff9a225316490

SHA512
238d9572199c7d4194caaf701ec7dece52a6956e7c504e5e682dbae5ca8802ced86780c64f0a1ef599731573be0a3f1eec2cb79a24382b6df66ac10e5a004788

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp
Filesize
14.2MB

MD5
6d165647c95e90d53ed3c3aa85a577b1

SHA1
8df13b94cb31ac077093b3e5a3d630f74fd02c91

SHA256
cd910936b69aff72c18fcc08e7dfe5bf86a740f5d927e0cfba2e55e55dae4c1c

SHA512
229555243f9ced10c195480d4063ae409f29ef45b53315d9bd252f7a5e36440835ebfe7f2a031dff5963d9c14c51404795018a5a1cc08af565c21a7a52174c00

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.tmp
Filesize
1.8MB

MD5
b69de92ef5b5ecc8af5521973f45e338

SHA1
71556e329a0c18a5dee47b7184e080e070ca7975

SHA256
286f9fc6b462d5e813a3490af1500e5273a04092054740b48a4aa4e84b26fa66

SHA512
2f1cde99f4c377693230bca4e5fab62eba41744c8db8ad7303760fdf3db1290437ed62dc7593826d0611d196893d60300f2ccb150266a99a97bd1008a7565239

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp
Filesize
6.2MB

MD5
2066f44b4144fb84ad2dbd22b41409cb

SHA1
223f009b1186f55f4c1da16a1245650537eb8381

SHA256
fdf8f12fe403c6823c71182db225bb7d9589154d3fb65cc069efab2f585d5e24

SHA512
64508ab3a77341e090b7ce34451490abb74adcc08f72b322c8de324e6302d7f591a1821d2ce24bc513e0b502d0a53d1415bea6b00c0434adf0f3c395f3d0d1e9

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp
Filesize
10.5MB

MD5
f26daaf6fafc9a2894826334d43456dc

SHA1
836d0ab4954142f7bfec30d2702a1ccf41688b19

SHA256
aa06b18ef818e3b7ec42dd12b569cd7b18aab8766cf56bb2238d9228e8dec0a8

SHA512
5df565cf7a7c17e61d6c2d870dc0fdcc5930bfd2fe1489e07b6111b0777dfa02864812ace9ae9195d47dc7d263bfbe5403cfedd31a0167c42ff9fa3203f41925

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.tmp
Filesize
694KB

MD5
f62c07956e26d6cfdd4ab39a703c8a59

SHA1
a6f6420bed339a783fe451a8af95f9fa06dd313f

SHA256
5452cf5e3d5d5c09d7df04459a82d8e9d8dd83bddc1390a283b94b68e75e6b88

SHA512
e2549ed8997317b3446d062dbce231fe2a732532728e406b9b98c38cf0a4682e32e2c096717392dfe7f4cc74f24e94d296f90021e7f1db95106a6c5f1c17bd78

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.tmp
Filesize
56KB

MD5
a2b4a64bfe1852ff0be5125be271148d

SHA1
7cc038feba3ae5d42b01845158dfdb7c55fcc367

SHA256
01943b9ef8bec97518f276241f0b2e8eecd0db5262febed839f17055680caa51

SHA512
5138b6fa376b13ee2c5be8eaf95db6b769d4257e637f62307739d5074f6c038d2b45748151d8d9bfdf551fb076d7cb8e64ca1ab51cbb86526e28b5845554ced5

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.tmp
Filesize
92KB

MD5
25235f695ef161891108e07fec5c5590

SHA1
0a7d12301540543ebddc09d47ea7d50a08b8d88b

SHA256
1c16330d9fdb133ad8029494bc6f05b8d4a39e1510ace901867dd4e1f2f4efde

SHA512
d0fdd16eeba186220cf97d94a9bf551efada7365ed66b0b24a49c2a0b886b7aa221fc11becc70f990b18bc8f36dc0386e357ffc3135c4f9aad3f5a1d590ebbec

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.tmp
Filesize
700KB

MD5
95131e2028bf4c745b4a7d2d1569129a

SHA1
bd3ba68d453dae21faffd39d283787d4b479cbe3

SHA256
8ae4291d0fa7b64f44a59721fd1e8857e0e524f167fce7d50093fb8656cb46ae

SHA512
3e1a7df8c433432b6c591e3004f6c52b5e65c009cd817bced69a18be85b6baa2bd1a38bff2713f1c70ee9783e6e869a8f47299c571d65d43ded8b8f3979db947

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmp
Filesize
1.4MB

MD5
7697f48849f309bfdd7bc8cc6e230e4c

SHA1
82397d038d126db8e29d34632fad939d59452606

SHA256
dd9ca2c180950addefe90c887eb859183985b4266367cf86995a2b75ba012735

SHA512
76bf129b309285f9a6a34174ca2ebcb62afa6cf61ef53e997ddc4b7b8f2aaa90b47a0c95bb24d5bc807a4405e9a1fa8834116e9cdf2793819295603960a4b8f8

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp
Filesize
60KB

MD5
82118a5d6c5d4273d28722fc62d21ed4

SHA1
8261d0456e7c83831f344f258e75e0d456bba41f

SHA256
bfe0ae00165de2df9494f9994a20dadd77478449cb2a0fc3a1b9cba7567f6c34

SHA512
a5ad2a6f192880e662d78ed74981f57526ab9996924f2c1a153e8f2c3b7a70e4c15fcfeb0ec0e2cf75256a6c5085ac9817fd14d06f25656c6f671837f95a79c6

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp
Filesize
15.0MB

MD5
c8f2722b21e9d4ed35eb59ce41527cf2

SHA1
be0909aebc29c41a036b8117ab8811e69c776a11

SHA256
dd11bc794c71b994633359dece667c797c9a0f17b6aa4d6717f3284c1680fa0e

SHA512
352eea3b761d341b34c49fac908697fdaccf632c837ce6dd34e20c337d32616eb464dab92b0c99ff2d31f8b10e157c84386694dc6596dfac92f7cbec83e625fd

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp
Filesize
948KB

MD5
e22fcc19f689f6bb119f37fa2467b01d

SHA1
c260eb6b1fb3f4a21cecd48ce0706f385bff8702

SHA256
076445c0f2f65830e533cfb4eb4002349f9edee07849c3e32565153bd1724086

SHA512
2d12eb94d8f1e9f417f98851548849384819aa21f87629b6fed4e785b91f855f5de53ad7422cfe4f99bf5b696b022305950cd6ccbc3f35b8a71b3737d7033d87

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp
Filesize
2.4MB

MD5
cf5c96d277bb6040233312de1a9013ba

SHA1
79739bbf824274cd62a056870e2ed46e6550cc87

SHA256
de8c6e520d9b99d3d56a133d064e94f77d4249a50d0e0a1b1168c4fa76902fa2

SHA512
950883e6c5c36f25438862e9b771a28eaed82000b4df24f5ef77af7ad79948c4ad67c324d396301045f695ff6fc6e82f2d5330608f2d70b3f9679879c84e3f19

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.tmp
Filesize
1.3MB

MD5
ec0f211e7806d1df30852a257d26ef72

SHA1
90a30e1315eaa2a08bdfefd24508726d396a683b

SHA256
23abbe55fe4b8457887683071d3c2dd82a0ffd926c7ec169051c7a033acf9ee6

SHA512
b32026333d6c37ff45906da4138a0ac7c16cb9c8ef3fb10f8b1e6570d7182e272508d2fb6b15a44a6ef421e0803ffe23086aa179388429631ad32d209639b32b

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmp
Filesize
652KB

MD5
ff472f14b1fb704d5fdf4ffeb8b8e54c

SHA1
ce3889115534333c058d5be1c3385a82fd962ac7

SHA256
8408cd508afd5d35e8cf8c5e2d65a00dea3a2f86c8a874bb8af57cf83107646f

SHA512
a337d7748139273b4175ed180063ca6d392d45b6fdd7a84ce29c7591fe60e4e0921bdd645151c7366710d6684e3dbe49ab2126511d090f62febd4542c7b023d9

Download Submit
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp
Filesize
1.2MB

MD5
25be9d6aa74fc4ee17aab11ff3483989

SHA1
beefef0aab154ebbc630f242beb7e0580acd307a

SHA256
7c9cc75db0314b7e4a883d8b25babf275e85f041b74eec4273ba38a3f3552bbe

SHA512
22982f15b27e8154c2ce4c09b0bb186d9cbe3a8939d1597509284170569a9dc8ab6ea44d6e0951763e7e690353bd0cf46f233350dfa2494ac437a37160c85d0d

Download Submit
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi.tmp
Filesize
1.2MB

MD5
7d83a7d2fd04695bf8e39400c1cfd06a

SHA1
90edd43ade0a0a93ef02507414a938291a9ef474

SHA256
35ea08892dcb8818de137a873dfc3b6b1da2fa8a69f24aa3ec092c136fa55e8d

SHA512
5234542e74d0155d1d434c8e617f13f2fe3a781574e57b0e1db1c996fb273b466fe2dbab5bbd0ff9ec1ef99d620fc0b7975492867a7b23af2adab6a05f131c06

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll.exe
Filesize
158KB

MD5
fa9a3431211a0c96c4a16feb8828c814

SHA1
f32a591e60a8d4b043b14ad9a5c9689812fa5af4

SHA256
c4a95123cbdade9e5689b073ba7fafbbc1481dba3d474a740e8c6e5c557cbad2

SHA512
14f956cd4d37fa56410a7c325996d2ede651f6a3c51e951de74a1e600a96a38b5b584fbb143e2336645bda2789261435b347d8c07dee676322d0e92202d96877

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE.tmp
Filesize
872KB

MD5
1f357a6c6fe2181995bae93203dc54e6

SHA1
752e7cf91c8caa444b1fbab360da20266ce1e7ab

SHA256
95ac3f3633a43cd96893ac632736d1d751e950ce4d1f1c6aa01d0d1c4569d920

SHA512
314c8f50e58368bb684680a75f9f93ca4f1bdc7565d78611dd36ee7b3736d99c81fd6b7d6529001e17b97498fdfe21c2b6a9806f4c2dd9ec28d35b4c21e1ece2

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmp
Filesize
1.5MB

MD5
8f4e451385ee36f0b2ce2ed18f7eb424

SHA1
d9809aac09ec0afa40c3b48cfada83e32f3dd3ea

SHA256
3f75b971d75264f6d446cadc9a3b66ace3f5a66313ad9eb4b890f9b6304f38a9

SHA512
4c8c4b2fa95c03fdbf071aac1745e6aea58f015a009fb64543957b65b124a625092970d64df52ff793279c317574590cd6912b08ebd25f62eccb2460971cfce2

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmp
Filesize
1.8MB

MD5
575bce0da3096b8b03cf8670f9815509

SHA1
798dedb1d600d8131bf73d740148e456d046d841

SHA256
6300693ed14a81dbd2576202fed250c396e5be0baef64e9dfacc4183cf896b1f

SHA512
8393d879a2153ca1fb49b1010236bbaec228063d4cb48dbf32992bdbc16303a4828d0cc41609f492e1c6fb46ca284ebcdb93d500c15b3932db26fb558e15d1bd

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml.tmp
Filesize
62KB

MD5
ae55b440b6185c744b98f62ebc8b8244

SHA1
3aab35369fa7ca7fe6bc6ab34de8ef15b3943148

SHA256
6bde619c1f1de60cb3c0ce4841c313f79e3e11294e941a23a8c311e4f8408ac7

SHA512
16f9e43d911db326c4370b8b4ab10502609383cabe2a94eb9745a3769718cbcd78f223344221f906eac6df01da88ec99f36df597d443617629498301c30effd0

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST.tmp
Filesize
60KB

MD5
add4612488324e63bfd2911e0579b67c

SHA1
edf4d9e4b68cd8083be840a7b01d16d787fbcb39

SHA256
0cacb6139edaff59d8fa458d2b1e8b90d50a39733eae5fb549220b597d97fe67

SHA512
6147c4bf20b0c00ecec18f612ba30924a226bac633cdb65d4d46bd52f0683b754a88db60b7b92d627293f4217058658f663ef01a4daae52193561f0ae19ce109

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml.tmp
Filesize
635KB

MD5
9c23fed64d7acf22a3f204d46f57f9b9

SHA1
79da038201cdd3fe82fb62bdc7f1eaedadab8792

SHA256
b671d00d83605fa728bdfe318bf72507c7caf0144f84fe355a9c070897de3fa8

SHA512
4204902ee49d7a75b32f92e4a71c74267b13143a603e0cd03fcdf5987f2801b0d0fec8b95182b4758664c2e4ee36eae11fe7893692c6fe59ce3b8e33f82a49ee

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll.tmp
Filesize
567KB

MD5
28812688c2a240c6532c17762e7348ee

SHA1
7c822ff6f6e546a4f4a97ab6fc5cd96d4d26db90

SHA256
b9c046ff9380cb141f4e33fab09af4a52044ae489bee3c0de153db42ce91becc

SHA512
54255fb266401255a23cc862bbdb3d982290f28dffdbb244904da62ab05242d2eb146120bc45269a3710300b7a5f94a082ee149ce1187801f540e5857c2d9f3b

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe.tmp
Filesize
560KB

MD5
5bfe44554f48fa825215c1d353cecbc9

SHA1
d2f4b80c1c72b82682fed76efcd549c748b0d871

SHA256
ff8e2032787c6cc550cf90ccbc6dd7836696b3ee1936e0468ca8b0677347bbc1

SHA512
2ad1ac6596df8ffe2b971ea22f60688afc8717989896825ffcc60ff9bef402f4b4aa0aa68d3db24232674625e2d705fb68a3ed266d61497a5de440f178b68e89

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmp
Filesize
693KB

MD5
8cac9b12af775d3d70726170edb33c6d

SHA1
41a4e853851b0ba3a7f6a5ffc066202469c77025

SHA256
6396cc7ba0ce9f713f294f7af615e1c3c7bc0cc8b8f89d4584dcc9e9af486288

SHA512
c16580d19afce116cb429c1764077fa771ea34dcd57bf69db4e9921c6f7a8a67775184cec47b8bb6d64c901d965e7c459dc2e7aa4ef71fd45ed27a85ba4b0213

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm.tmp
Filesize
80KB

MD5
68cb04d7223676d79978cd0b4d455c21

SHA1
611f695ee4a4e2ba1be5031bbcb7b35d399863da

SHA256
8ef07261baa7880a2b3cdef594905c7e108119211872af181b576afa5133be90

SHA512
35510af6c63b7671f4069937fb17538d0704233d6a9378b25280782eeb122e1c41cd11fe380f00943e0d7f3f6e0bbce4f1856a95258a9ec1dd144ed700fa01ae

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm.tmp
Filesize
119KB

MD5
404c2badb66e058293040af6c60ed8d5

SHA1
4e5b89bc5cfcf5d5d2fc4f62de52a25f08bce252

SHA256
2f4013dca7068ecb7c9a4c50e595629ec8894f7fd0086a72500feebbff3cb9ab

SHA512
984c26fcf4ffed44870ed007e06299a44b4401e0ced0efde884cb0e037b68b7bdd56f81af3c7da2968873953799791ad27bc1e0812c43e85a88bba42e4944bd7

Download Submit
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi.tmp
Filesize
56KB

MD5
6d5a43885547621c478ba9c1bf5ffc6f

SHA1
65aded0f2b579c5c8ae47f929bc3427198288cbf

SHA256
3dd48994b60fbc05661f3b070e330b49b39a503307da79d99f0c0e39d9fa43b2

SHA512
d5c7eb6c380a3d1f37b96489532e8e37dda221de0d215fc68e4ee308dd20aee201981a95ab125d70d3d753f6c7e61af5faa4ba9a3b098df246b31d1d5757641f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp
Filesize
57KB

MD5
c376348ad919e85fcc0cbdd7b1fb27d4

SHA1
c740c5b6c79937b96e6681de349caa36564acb8d

SHA256
07ccd07b5bb60b3ca3b044bcd27ea4a4aa5c8f02a5537060275bd35d7ceab9fb

SHA512
6e5e804a339c8f0bba082e4203e8b2cae4a71430496938ab4b829d8d38f5ba477c844d84a5f3492ac3d91ef713c4603e7f9058bbfa9c19d28b11da78a22c25ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_RecoveryDrive.lnk.exe
Filesize
53KB

MD5
0ee7bcacc48f3b457bd5ebca09dde85d

SHA1
e50d4f7c1e18c2343a601bc9dfd9938a6ea4ec20

SHA256
74d6fd5a7d936e2127f4974ea5e362bd7bc32a40219673e076d611d6064044e2

SHA512
bdc9db5c5c3eae4478c1d34215839d86d7fdc27d81557e48000a8b1fea3450b3bd1c363ebbe0f55a8db3514cd51a098a00e379844a5df3d6cc325c90942f3ffc

Download Submit
\Windows\SysWOW64\Zombie.exe
Filesize
51KB

MD5
45b905d08c6f7892d3cab3726582c8bd

SHA1
589b8b70a38926ad11428e4f7b7f21e2cd751d87

SHA256
69d6a0037303257bcd7e3abecaab9e7abcb43f4be04500e6c4cb1a51e532c959

SHA512
2f8914f4ec48036cdbc653b75241d513ac2a8547cb5c4d1262243dbd3d5c511791f7185ff602e28c9c0cd760d32c68994d2c8aeb188785d73e5a7977828e11d2

Download Submit
memory/2176-24-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/2176-14-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/2176-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2176-635-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/2176-1114-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/2300-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads