Analysis
- max time kernel
290s - max time network
276s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 17:27
Static task
static1
General
- Target #!!SetUp_4474_PassW0rd$$.rar
- Size 8.5MB
- Sample240529-v1devacg26
- SHA256 de4d037006caf6985e2c60ac6e158b951cdd8cd860f1deb0a2ea35c1a618e6d9
- MD5 5baf1039bcab1685962e151ea38cddfe
- SHA1 c25f051c72849e57080fb1eaefdc9d2896e3ac64
- SHA512 bc3c51e76b5d11412e373c520d7871a4b8b792d95ad399c0bbf4302d5be8043ca2315115047d9f53c013a231ece7ebd8b84cce1d2fdf43cb35ceae2a7a1a60c1
- SSDEEP 196608:gHc2nOhin7bjPVjUvt6088r8oMCJ1PwKl5vubMFDoAYttOGV:lKmIVw1AQ8mJZz5v9hctOG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
lumma
C2
-
https://ensureclackexcatwi.shop/api
-
https://horsedwollfedrwos.shop/api
-
https://patternapplauderw.shop/api
-
https://understanndtytonyguw.shop/api
-
https://considerrycurrentyws.shop/api
-
https://messtimetabledkolvk.shop/api
-
https://detailbaconroollyws.shop/api
-
https://deprivedrinkyfaiir.shop/api
-
https://relaxtionflouwerwi.shop/api
Signatures
- Executes dropped EXE 6 IoCs
pid Process 560 Setup.exe 4348 Setup.exe 2224 Setup.exe 2212 Setup.exe 5080 Setup.exe 2380 Setup.exe - Loads dropped DLL 20 IoCs
pid Process 560 Setup.exe 560 Setup.exe 560 Setup.exe 560 Setup.exe 560 Setup.exe 560 Setup.exe 4348 Setup.exe 4348 Setup.exe 4348 Setup.exe 4348 Setup.exe 4348 Setup.exe 4664 Kufa.au3 5104 Kufa.au3 2212 Setup.exe 5080 Setup.exe 2380 Setup.exe 2380 Setup.exe 2380 Setup.exe 2380 Setup.exe 2380 Setup.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 560 set thread context of 1196 560 Setup.exe 99 PID 4348 set thread context of 3348 4348 Setup.exe 104 PID 2380 set thread context of 3776 2380 Setup.exe 123 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 perfmon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz perfmon.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 560 Setup.exe 560 Setup.exe 1196 comp.exe 1196 comp.exe 4348 Setup.exe 4348 Setup.exe 3348 comp.exe 3348 comp.exe 2212 Setup.exe 5080 Setup.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 1928 perfmon.exe 1928 perfmon.exe 1928 perfmon.exe 1928 perfmon.exe 1928 perfmon.exe 1928 perfmon.exe 1928 perfmon.exe 1928 perfmon.exe 1928 perfmon.exe 1928 perfmon.exe 1928 perfmon.exe 1928 perfmon.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1928 perfmon.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 560 Setup.exe 1196 comp.exe 4348 Setup.exe 3348 comp.exe 2380 Setup.exe 3776 comp.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeRestorePrivilege 116 7zG.exe Token: 35 116 7zG.exe Token: SeSecurityPrivilege 116 7zG.exe Token: SeSecurityPrivilege 116 7zG.exe Token: SeDebugPrivilege 4376 taskmgr.exe Token: SeSystemProfilePrivilege 4376 taskmgr.exe Token: SeCreateGlobalPrivilege 4376 taskmgr.exe Token: SeDebugPrivilege 1928 perfmon.exe Token: SeSystemProfilePrivilege 1928 perfmon.exe Token: SeCreateGlobalPrivilege 1928 perfmon.exe Token: 33 4376 taskmgr.exe Token: SeIncBasePriorityPrivilege 4376 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 116 7zG.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe 4376 taskmgr.exe - Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 560 wrote to memory of 1196 560 Setup.exe 99 PID 560 wrote to memory of 1196 560 Setup.exe 99 PID 560 wrote to memory of 1196 560 Setup.exe 99 PID 560 wrote to memory of 1196 560 Setup.exe 99 PID 1196 wrote to memory of 4664 1196 comp.exe 102 PID 1196 wrote to memory of 4664 1196 comp.exe 102 PID 1196 wrote to memory of 4664 1196 comp.exe 102 PID 4348 wrote to memory of 3348 4348 Setup.exe 104 PID 4348 wrote to memory of 3348 4348 Setup.exe 104 PID 4348 wrote to memory of 3348 4348 Setup.exe 104 PID 1196 wrote to memory of 4664 1196 comp.exe 102 PID 1196 wrote to memory of 4664 1196 comp.exe 102 PID 4348 wrote to memory of 3348 4348 Setup.exe 104 PID 3348 wrote to memory of 5104 3348 comp.exe 108 PID 3348 wrote to memory of 5104 3348 comp.exe 108 PID 3348 wrote to memory of 5104 3348 comp.exe 108 PID 3348 wrote to memory of 5104 3348 comp.exe 108 PID 3348 wrote to memory of 5104 3348 comp.exe 108 PID 4376 wrote to memory of 1828 4376 taskmgr.exe 119 PID 4376 wrote to memory of 1828 4376 taskmgr.exe 119 PID 1828 wrote to memory of 1928 1828 resmon.exe 120 PID 1828 wrote to memory of 1928 1828 resmon.exe 120 PID 2380 wrote to memory of 3776 2380 Setup.exe 123 PID 2380 wrote to memory of 3776 2380 Setup.exe 123 PID 2380 wrote to memory of 3776 2380 Setup.exe 123 PID 2380 wrote to memory of 3776 2380 Setup.exe 123 PID 3776 wrote to memory of 4444 3776 comp.exe 125 PID 3776 wrote to memory of 4444 3776 comp.exe 125 PID 3776 wrote to memory of 4444 3776 comp.exe 125 PID 3776 wrote to memory of 4444 3776 comp.exe 125 PID 3776 wrote to memory of 4444 3776 comp.exe 125
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$.rar1⤵
- Modifies registry class
PID:2680
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1276
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4588
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\" -spe -an -ai#7zMap9776:128:7zEvent8681⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:116
-
C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\comp.exeC:\Windows\SysWOW64\comp.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\Kufa.au3C:\Users\Admin\AppData\Local\Temp\Kufa.au33⤵
- Loads dropped DLL
PID:4664
-
-
-
C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\comp.exeC:\Windows\SysWOW64\comp.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\Kufa.au3C:\Users\Admin\AppData\Local\Temp\Kufa.au33⤵
- Loads dropped DLL
PID:5104
-
-
-
C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"1⤵
- Executes dropped EXE
PID:2224
-
C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2212
-
C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\system32\resmon.exe"C:\Windows\system32\resmon.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\System32\perfmon.exe"C:\Windows\System32\perfmon.exe" /res3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
-
C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\comp.exeC:\Windows\SysWOW64\comp.exe2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\Kufa.au3C:\Users\Admin\AppData\Local\Temp\Kufa.au33⤵PID:4444
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\PassCode.txt
- Size 7.0MB
- SHA256 c01f9214230554e54533e2a5fa2843631a0574fcfdf912ecd2c28244a473df1b
- MD5 e074c3b125e05cd279204b6b01d8e325
- SHA1 38fda2d46756cbe1b5e3de9e3e3dfb2a217243cb
- SHA512 cea45c8f5cfe46ef90389885943d885427b2ebf930d9c5b950790c89bb13dde93d85ca8070187c17449e6beae66ee7e49c61c4a0cf91122c636b8f8e6a50dd2b
- SSDEEP 6:jR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8IR8U:T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\Setup.exe
- Size 282KB
- SHA256 4a7930a7130fe7c3c9822d90517e873e3e477c9a6978d096f740dc5b03770365
- MD5 37668418edb0f30c6f38d08c5ef319b7
- SHA1 72d173273dfc9a5cf0661ece8e6d90c602679ba2
- SHA512 9c5c0c3a095824c51c349487c2366e4dcd1f3602082627296ac06569b72e28ef1d976f8b3ef8df30a81d4483c3220cbb6ee429f7ad4633d8692b9bf3f4104fd9
- SSDEEP 6144:eVrX3+AlBg06nMIDzNU5/CSYeK+gqWpMed:m7+k/pkQC/eKXqWqed
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
- MD5 cf0a1c4776ffe23ada5e570fc36e39fe
- SHA1 2050fadecc11550ad9bde0b542bcf87e19d37f1a
- SHA512 d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168
- SSDEEP 768:a0Q4HUcGJZekJSam1BbuBSYcCZbiLzlSHji9z4GwZHji9znwT:afnDex5izbiLzlE+z4Gwl+zwT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\artefact.dat
- Size 34KB
- SHA256 2193ecc14ab3f1a088a95e8063dd6e27ec14913ee5b0cb432e0b2fbaf77b53e8
- MD5 31eb474e546e24c603061f90b0fed6cf
- SHA1 e4a69102467497457a5eb25c1e0dfd5187618da1
- SHA512 842be47b0b286107c3f6e427a5c2f8bbae8d311c8f93a0766777d369a48f336af8394a5ba73d225bc3064bdc1230981d248be6857253b7fe7b840560da990033
- SSDEEP 768:AXt07BoiUUFkWJ7RHrEiuFByXVfSVDury+AaoRrDi8s9U0TCqgRR7oG:A90SjPgrVhQVh+ZEddoG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\groundspeed.m4a
- Size 1.3MB
- SHA256 c0a5381cbc2b16badf0dc7cedba39120365060f1dfbeaa8016c1e8e151a98545
- MD5 abffa8db1641bf8e01d6f7e13111c16c
- SHA1 ef76a1c52076c793d6a37177c5f7fa6aaabd7261
- SHA512 d411de77fd98b6dcf0974fcb01c271b33e25f56ed7973e340d606db1846b64e0aed2e1ff178d759175e9b78a86ff12c0d6fd46d1d66334e2c33869fd5ca8e0ba
- SSDEEP 24576:6rWFPM63HH/NTnVx+jd4ZFWKJXauEWiCk3cJmgHzUjFuE6/:66N3HH/NTVx+jd4ZFWGXaLWX34gHzQG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\mozglue.dll
- Size 834KB
- SHA256 15dc1ad35d62df7912745f37bf2f12e4a0cb3459c718d10b181535c5790ec808
- MD5 66e1290d75c7430c59f1fa02617d8cc8
- SHA1 133880ea1730b3042a1658e26ddf230e92593858
- SHA512 814904add881fbe2a998e826888ba0ed7889693353d6da4583fa2832cc92c2e1827110f78d05a860d42029232d36876ef75a6c18531c061936bc7ba51b333bcd
- SSDEEP 24576:98qkvzI6uUjqK+Zb0bo+fxG1VnUCprT1ROU1:Tkk+jqK+Zio+JG1hUCprT1ROo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\msvcp140.dll
- Size 564KB
- SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
- MD5 1ba6d1cf0508775096f9e121a24e5863
- SHA1 df552810d779476610da3c8b956cc921ed6c91ae
- SHA512 9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af
- SSDEEP 12288:RBSNvy11qsslnxU/1ceqHiNHlOp/2M+UHHZpDLO+r2VhQEKZm+jWodEEVAdm:RBSDOFQEKZm+jWodEE2dm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\#!!SetUp_4474_PassW0rd$$\vcruntime140.dll
- Size 106KB
- SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
- MD5 49c96cecda5c6c660a107d378fdfc3d4
- SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
- SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
- SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7663de45
- Size 1.8MB
- SHA256 01374cb3ec19a12294d8783e9b5697cb441a07880fb284ab126fc76a835427fc
- MD5 0980ebdbf69f2d9c5bcaa7950abf9717
- SHA1 44d0444d96b9dd314e45bc4924ce0fc126dc5c50
- SHA512 6b5e147d4d24e69265473840dcb9891062396fb4569ef03bc4e6e03c7ed41187f4537cbdd9c7504256d9a0c3dd2bb7f5a45ed86a55e785f6d9efdfcb04b700c1
- SSDEEP 49152:xSAy+HCi/KvV4qJYDMnGII4yGa60HZ9Hv9+8:++B/KvV4qJYIGII4yGa60nHv95
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8f0e366
- Size 1.8MB
- SHA256 2dfbbcf312ab5862a0e5f98c1aa170d1ebbfad713cf9735ce020011ea1710003
- MD5 c0553e4207328e48cab4392a7e72fe4e
- SHA1 08b1200cd38b2f5159dff3948e85499656c116e8
- SHA512 9b2b9b0c476e53c0700d42907bb41e11e9f29ff8bd3ce598c11d5b2689be27bf468470880ea1631bd522eb5583edf9f9838fd68096a74c5cc16676da175cc2d6
- SSDEEP 49152:ASAy+HCi/KvV4qJYDMnGII4yGa60HZ9Hv9+8:v+B/KvV4qJYIGII4yGa60nHv95
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Kufa.au3
- Size 872KB
- SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- MD5 c56b5f0201a3b3de53e561fe76912bfd
- SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cd7d5416
- Size 1.8MB
- SHA256 cb913643c61f3a9b8ec0205304edca274f7163a85f23983444a5cfbf39d4c139
- MD5 93d3c368655c9ec3e09e5c60a2fe3b40
- SHA1 b73f08c3abd9f6d89469014f7662deb7d515af7c
- SHA512 410bd184e03cd0b62b8eb5eee8149df0a2d0a9862f68e7c37cb29717a1412d742eb5a1873f6189518a0b2b936586dd26c32f08376dbb76a99a925cbdb00e0a90
- SSDEEP 49152:fSAy+HCi/KvV4qJYDMnGII4yGa60HZ9Hv9+8:Q+B/KvV4qJYIGII4yGa60nHv95
- MD5 SHA1 SHA512 SSDEEP