Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 06:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe
Resource
win7-20240221-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe
- Size 130KB
- Sample240605-gxddsagh77
- SHA256 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd
- MD5 f2e0c9cb37375804884367aa1e41c3f4
- SHA1 17b37c227099089d459cb3cb31e564c020b70ba7
- SHA512 67f26c6668cddf194b17be72589580bfd12d66c5c821f83014a9072a1d2ca3584d54c88fa8ae6bfd8b561c1e7fa4c7456a145ae9b09d3c58565e4c1f2adbf4f3
- SSDEEP 3072:eGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:J1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\\VNT6G3M.exe\"" system.exe - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system.exe - Detects executables built or packed with MPress PE compressor 39 IoCs
resource yara_rule behavioral2/memory/3188-0-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002340d-21.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002340f-71.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002340c-67.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/5040-73-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-91-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002340b-92.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/2408-89-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002340d-179.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002340e-185.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023416-223.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/3188-288-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023414-300.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023412-298.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023413-278.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023431-272.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023430-262.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023432-261.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/944-308-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023415-197.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/5064-309-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-312-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2408-311-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5040-310-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2408-330-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-335-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-336-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/944-337-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2408-346-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-348-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-354-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2408-360-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-362-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-368-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2408-372-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-374-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-380-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2408-384-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5024-386-0x0000000000400000-0x0000000000477000-memory.dmp INDICATOR_EXE_Packed_MPress - UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral2/memory/3188-288-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/944-308-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5064-309-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5024-312-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/2408-311-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5040-310-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/2408-330-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5024-335-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5024-336-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/944-337-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/2408-346-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5024-348-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5024-354-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/2408-360-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5024-362-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5024-368-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/2408-372-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5024-374-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5024-380-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/2408-384-0x0000000000400000-0x0000000000477000-memory.dmp UPX behavioral2/memory/5024-386-0x0000000000400000-0x0000000000477000-memory.dmp UPX - Disables use of System Restore points 1 TTPs
- Sets file execution options in registry 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe" system.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023404-146.dat acprotect - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation lsass.exe - Executes dropped EXE 5 IoCs
pid Process 5064 service.exe 5040 smss.exe 2408 system.exe 5024 winlogon.exe 944 lsass.exe - Loads dropped DLL 1 IoCs
pid Process 2408 system.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" system.exe -
resource yara_rule behavioral2/files/0x0007000000023404-146.dat upx behavioral2/memory/2408-319-0x0000000010000000-0x0000000010075000-memory.dmp upx behavioral2/memory/2408-334-0x0000000010000000-0x0000000010075000-memory.dmp upx - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0G3MYK = "C:\\Windows\\OQD6L0R.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sRX6L0R0 = "C:\\Windows\\system32\\XSQ3X8STYK1G1E.exe" system.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: service.exe File opened (read-only) \??\H: service.exe File opened (read-only) \??\K: service.exe File opened (read-only) \??\O: service.exe File opened (read-only) \??\R: service.exe File opened (read-only) \??\T: service.exe File opened (read-only) \??\U: service.exe File opened (read-only) \??\E: service.exe File opened (read-only) \??\J: service.exe File opened (read-only) \??\M: service.exe File opened (read-only) \??\V: service.exe File opened (read-only) \??\Z: service.exe File opened (read-only) \??\X: service.exe File opened (read-only) \??\G: service.exe File opened (read-only) \??\I: service.exe File opened (read-only) \??\N: service.exe File opened (read-only) \??\P: service.exe File opened (read-only) \??\S: service.exe File opened (read-only) \??\W: service.exe File opened (read-only) \??\L: service.exe File opened (read-only) \??\Q: service.exe - Drops file in System32 directory 42 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\GFI7O6Y.exe system.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V\XSQ3X8S.cmd service.exe File opened for modification C:\Windows\SysWOW64\GFI7O6Y.exe service.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\SysWOW64\regedit.exe system.exe File opened for modification C:\Windows\SysWOW64\XSQ3X8STYK1G1E.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V\XSQ3X8S.cmd smss.exe File opened for modification C:\Windows\SysWOW64\systear.dll service.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V\XSQ3X8S.cmd lsass.exe File opened for modification C:\Windows\SysWOW64\GFI7O6Y.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\systear.dll winlogon.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V\XSQ3X8S.cmd system.exe File opened for modification C:\Windows\SysWOW64\XSQ3X8STYK1G1E.exe system.exe File opened for modification C:\Windows\SysWOW64\systear.dll system.exe File opened for modification C:\Windows\SysWOW64\regedit.exe fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V\XSQ3X8S.cmd winlogon.exe File opened for modification C:\Windows\SysWOW64\XSQ3X8STYK1G1E.exe service.exe File opened for modification C:\Windows\SysWOW64\regedit.exe lsass.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V lsass.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V winlogon.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll winlogon.exe File opened for modification C:\Windows\SysWOW64\regedit.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\regedit.exe smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll service.exe File opened for modification C:\Windows\SysWOW64\GFI7O6Y.exe smss.exe File opened for modification C:\Windows\SysWOW64\XSQ3X8STYK1G1E.exe lsass.exe File opened for modification C:\Windows\SysWOW64\systear.dll lsass.exe File opened for modification C:\Windows\SysWOW64\XSQ3X8STYK1G1E.exe smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll lsass.exe File opened for modification C:\Windows\SysWOW64\systear.dll fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V smss.exe File opened for modification C:\Windows\SysWOW64\systear.dll smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system.exe File opened for modification C:\Windows\SysWOW64\regedit.exe service.exe File opened for modification C:\Windows\SysWOW64\GFI7O6Y.exe lsass.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V\XSQ3X8S.cmd fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\SysWOW64\XSQ3X8STYK1G1E.exe fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\SysWOW64\GFI7O6Y.exe fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\SysWOW64\PHI7M8V system.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E} service.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\LOL7O5I.com winlogon.exe File opened for modification C:\Windows\moonlight.dll fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\cypreg.dll fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\onceinabluemoon.mid smss.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E} system.exe File opened for modification C:\Windows\moonlight.dll service.exe File opened for modification C:\Windows\onceinabluemoon.mid service.exe File opened for modification C:\Windows\TYK1G1E.exe system.exe File opened for modification C:\Windows\onceinabluemoon.mid lsass.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip system.exe File opened for modification C:\Windows\OQD6L0R.exe smss.exe File created C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip system.exe File opened for modification C:\Windows\onceinabluemoon.mid fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\system\msvbvm60.dll fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe winlogon.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe smss.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe service.exe File opened for modification C:\Windows\system\msvbvm60.dll service.exe File opened for modification C:\Windows\lsass.exe system.exe File opened for modification C:\Windows\TYK1G1E.exe service.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\OQD6L0R.exe fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E} smss.exe File opened for modification C:\Windows\system\msvbvm60.dll system.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe smss.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe winlogon.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\LOL7O5I.com smss.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\LOL7O5I.com service.exe File opened for modification C:\Windows\system\msvbvm60.dll lsass.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd lsass.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E} fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\moonlight.dll winlogon.exe File opened for modification C:\Windows\system\msvbvm60.dll winlogon.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd winlogon.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\LOL7O5I.com lsass.exe File created C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\zia01264 system.exe File opened for modification C:\Windows\lsass.exe fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe system.exe File opened for modification C:\Windows\cypreg.dll service.exe File opened for modification C:\Windows\TYK1G1E.exe winlogon.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd service.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe service.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe system.exe File opened for modification C:\Windows\lsass.exe lsass.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\VNT6G3M.exe lsass.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\VNT6G3M.exe fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe smss.exe File opened for modification C:\Windows\lsass.exe service.exe File opened for modification C:\Windows\TYK1G1E.exe fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\cypreg.dll winlogon.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe service.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd smss.exe File created C:\Windows\MooNlight.R.txt smss.exe File opened for modification C:\Windows\64enc.en system.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe lsass.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe lsass.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\LOL7O5I.com fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe File opened for modification C:\Windows\moonlight.dll smss.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe winlogon.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\VNT6G3M.exe winlogon.exe File opened for modification C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E} lsass.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" system.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeBackupPrivilege 2408 system.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 5040 smss.exe 5064 service.exe 5024 winlogon.exe 2408 system.exe 944 lsass.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3188 wrote to memory of 5064 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 83 PID 3188 wrote to memory of 5064 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 83 PID 3188 wrote to memory of 5064 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 83 PID 3188 wrote to memory of 5040 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 84 PID 3188 wrote to memory of 5040 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 84 PID 3188 wrote to memory of 5040 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 84 PID 3188 wrote to memory of 2408 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 85 PID 3188 wrote to memory of 2408 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 85 PID 3188 wrote to memory of 2408 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 85 PID 3188 wrote to memory of 5024 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 86 PID 3188 wrote to memory of 5024 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 86 PID 3188 wrote to memory of 5024 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 86 PID 3188 wrote to memory of 944 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 87 PID 3188 wrote to memory of 944 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 87 PID 3188 wrote to memory of 944 3188 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe"C:\Users\Admin\AppData\Local\Temp\fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5064
-
-
C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5040
-
-
C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2408
-
-
C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe"C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5024
-
-
C:\Windows\lsass.exe"C:\Windows\lsass.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:944
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\LOL7O5I.com
- Size 130KB
- SHA256 dcfc98520eee6ea6cb575b5d24447e920a00d861477fecbb948621856734ee15
- MD5 058e7e7cc85f65d3183ccbf9545246c1
- SHA1 b2291803d81e5fd098f9b5ca99bda11590a35433
- SHA512 77bd69534b4ca237f12deae3d217b10a6015838f90dcd664ba12b9d68b2b9ee6658ca66cc1ff81d471fa148368ba2fbac8124eb3fe9ca17e60a8d8475bf65082
- SSDEEP 3072:hGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:21b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\VNT6G3M.exe
- Size 130KB
- SHA256 70559cd73a37baecc34a168112939b4f0c67c2236e3c0308c97b656c5e7dd142
- MD5 8b1c61c9590265f6f157c97fa1d145d4
- SHA1 e85990e05b24f2edc67ec06b14b84e99e36fd158
- SHA512 618aad19b1db94a216eb51f4cd0d68107fdee30334f98a0f453014fd9b45d6b038555ce88cf0f00eb08003c81e8b098ac3e5759aee020e68f0af72d8714c8fa6
- SSDEEP 3072:VGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:C1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\VNT6G3M.exe
- Size 130KB
- SHA256 e1f8a7e15385279472c0b74702d99ed2f437baefa35fb118966013c066e700d1
- MD5 c8a85993c1e64ef2fddfa13aabe438c0
- SHA1 f9d7360f829e795cfe109944d9c2841ea8833940
- SHA512 179fcf4c0d0550d5f1476e66e419ab2119404961d50c6401883bae13547860405f419534ee2ec6c8c4daceace45eae3b4269f72261615ddeffd02700c6a1de22
- SSDEEP 3072:EGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:X1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd
- Size 130KB
- SHA256 2a1a9203edb32c305a58a80734039164acf9833df2437fb56580704cae59bc9e
- MD5 038cc894c2c5c59894673fefeffb5e80
- SHA1 67b45a17522351e4104bd1b97bb5777e905acb62
- SHA512 4c750880931f4cc7b5a6c8778bb8587958e37e2125ee306d3c8c8e4b8c5e3c86193c74482b87838e3e8a7e47cfacb56ce85155cbd06b67c6964b2f3b3a5fcdbe
- SSDEEP 3072:tGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:61b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd
- Size 130KB
- SHA256 c73e10d9c2fdbfd3fcab1f1cedb7000c56a7b8c2ea2d90b667222d0ba602b5e2
- MD5 719fa460c2d1009f1fe517cf4d24f1d9
- SHA1 c6be67493395963244f3cc2e2fe4ca60991604f8
- SHA512 75e11ef337d3313c6553e90bcc2bf094122068fbcb41abbba4062173595505c10e83200ded2f30604b9c955916675a139cd7d7e522caa8f5daa62a411be24c0e
- SSDEEP 3072:LGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:I1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
- Size 130KB
- SHA256 1f9f1584e4a9a307e5fbe26084b5c1ebf05934450694f49893d7baacfa3e0f21
- MD5 013ee05db0992656b316227ba3abcd4c
- SHA1 be928ab114f8de01ad66923ce458a28e8cda8a87
- SHA512 b9f2c7ca15d0749665b23378e6017dd5ccb36968b3069cad02fa25e35b8b4945925e107d01b780620b75f6989f50e5d6396ffecdc0fd235c857beb16a046fd87
- SSDEEP 3072:CGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:11b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
- Size 130KB
- SHA256 cafcbcf59d7d4c1401306f8b607bfab59a8ac4d2dfc133382c362dbe068be32b
- MD5 6c9e772f2c3565a5d51124a33d8bd0fd
- SHA1 514edd132ca3f66fc45c444b2f751122dc1d03dc
- SHA512 642ba1488aa05b4175b32859e6624146cc8077147b382d01e429970eda3fc997bf062298cf3c9b06ecab3620ffef3eb4defc0e7e3a23bc91f34668e7db74e1f6
- SSDEEP 3072:qGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:91b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\MRX3Y6M.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
- Size 130KB
- SHA256 2622b5f4f330f310fa8b8e1f4c40f56b01c87faaa842e5f74518eb06f5a26caa
- MD5 7eda8c3d3a1ec5e37ef15fe1ca7a0f43
- SHA1 203b1fd85cf06bd772fd63f74985d6ed24b47ca0
- SHA512 f8300a9fc8569484660c077a4c154b608690e60812256e4091fc418ac939cafed18c438d01de37aa5c5d69daaa71a45eeb20418ce20bfe9ad7323e421772c867
- SSDEEP 3072:AGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:L1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\GFI7O6Y.exe
- Size 130KB
- SHA256 ebb56bc43c9c073e5081fce641258b57574b917ea21ec4a4cbdff29ce511d3d3
- MD5 6fc52e59d4b5c2feaf31b2655085d3c0
- SHA1 9934ce0e47f67dd470e3680d9552f00ae0ed3b5e
- SHA512 40d43764f2ece2a9f9d00f33d63e26542a48411e2d4f9858a57e80ecbd1f9c4ba4c95eacdfc1f21981c1a2630060fc914d100acd35d63e0dee1deadc3b71147d
- SSDEEP 3072:oGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:T1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\PHI7M8V\XSQ3X8S.cmd
- Size 130KB
- SHA256 9f08ce1c8e2de75f642f7516149b9132b492ee560530edd0774153e6c11aa545
- MD5 cecef4c97978f993554f41077fcf8738
- SHA1 c32788606269c16953bf7352c04be0e8caf5ab2d
- SHA512 5078f6d3432daf27e919e8f41d87e0c02e603c9d770d7812cace1da975c8a1d0f5219f572fa14ea1cc222e8ea435b7620cb8408030ef84068c78baf0ae868157
- SSDEEP 3072:QGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:71b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\XSQ3X8STYK1G1E.exe
- Size 130KB
- SHA256 70f4e75ca4fe5b4cff0dfd753eef0d6064b7ca4529955a247700d4852e31209a
- MD5 439dc783495adcc31337fc348444be38
- SHA1 f8e7c8d8cf9d8a6746ddb3b92888442c94d4bb4c
- SHA512 f2965e7e0064f34f071d49585d503867eb5e75ecb415e26cb6f458fb32d37424a7e83170a3e289d83585c5d8c76cd827c699dc1e8d9a447b9e91074c8db48156
- SSDEEP 3072:xGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:m1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\systear.dll
- Size 127B
- SHA256 2cc712208909f42880988f6d5d872f7c6bd1a70c201e0230baf35e4e6fd36f1e
- MD5 d33158b6e1cab34c4ce386383799fbe1
- SHA1 9ccfc9e302e266007f7c7d40fff7a844614b3c74
- SHA512 4e237a969dc56e2b606b5a57ae589c08b98751ea057a34bdad033102e50e24ca0e3c062445c437a5a4af019e741872d88df0f8bdcf93edfbe729ade35d368eff
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\systear.dll
- Size 141B
- SHA256 9d66646fa76da9e68bcd2c88164b95a9f2c2db6b756b935de4053d2b76a399b4
- MD5 1f9fcae58d3f797834bec3f4b2191fd8
- SHA1 4f0e522234942a8aa792e1d16fa543beb23cc225
- SHA512 6ae6ce46812c4be0b51112477cd9e5068293c283c8e203048696c8c499f7ec1fab6ca28d517cd86c7074d784d5271fd359fab4d1b464c548a78a48df6f0b8ff7
- MD5 SHA1 SHA512
- Path C:\Windows\TYK1G1E.exe
- Size 130KB
- SHA256 716821e24c5579b050e8deae3a3658ae8f8b85750dffccf115bd14ac561a67de
- MD5 efe1579d6bcbc2a9bdc1fcdd6545c40d
- SHA1 2e3d02c8bfc60452b9db179cb2b04cb14e827031
- SHA512 419e4d7a8be3f097001816c8c84db4134ae4efeb4077a7bf81fd6d57204c58acf0172a27b61a1367ca3c1257206b610c0e04abaa38d5464516aa143a9d4d5a9b
- SSDEEP 3072:WGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:h1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\cypreg.dll
- Size 361KB
- SHA256 0dfa598f510d68b0a393a3c3afbc8c743cbe6d56a22761ce46b0712f81df382e
- MD5 71004378b0f33f3896c33c49bff4b92c
- SHA1 1fc600fb35b9999ae5fa53f3996a2e6a5cc1941c
- SHA512 e392e980248ed91a20a6d427635a73c8e475350fa31d5a4881225e814edfe5c817c6f319595a7051d3fa262318a0394f233508401eb02d97e444dd62433df6d3
- SSDEEP 6144:A8sKRApdUu4oMD/AMv2KBiKQRZ66z+n4VZbd8g79pgrXNgRnVLjyzhbkidNN2:LsIOdYD9+KnQRZ66z24VZbdrpgrXN2LS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\cypreg.dll
- Size 361KB
- SHA256 94ca13a7007fb2c1db881f79c436a1b392e7a41ff8e126f5d3b4f32cfe2183c9
- MD5 1e1e0ba48fa72dc5e7b482afd9d3a7e0
- SHA1 2a930121ef6839a0905d253ddeae565b45a95782
- SHA512 70e0886004a164817cad5829d588fda560527579842d4fed654a2bfbe2999e473aebd8f67ac733362c107c5c40245cbf58906e7934e6138e43ce630c850fcc7d
- SSDEEP 6144:98sKRApdUu4oMD/AMv2KBiKQRZ66z+n4VZbd8g79pgrXNgRnVLjyzhbkidNN2:SsIOdYD9+KnQRZ66z24VZbdrpgrXN2LS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\lsass.exe
- Size 130KB
- SHA256 948f323b2558696fea89de32f3242dc8af5590ebd166ed0f760498b9fa10e340
- MD5 e5120d6141e22efee2f96599c823d12d
- SHA1 3bd9446141cd292d8e32f73c4887ef73715ea9ad
- SHA512 b0e657033236c4330698799e1510b2feadd52ef00002f0965a88bc40d6ec396f6abafe3667ad82a01e9eecede33faa49704c83eeb99b3360bbd0a29bd2b322fd
- SSDEEP 3072:XGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:c1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\lsass.exe
- Size 130KB
- SHA256 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd
- MD5 f2e0c9cb37375804884367aa1e41c3f4
- SHA1 17b37c227099089d459cb3cb31e564c020b70ba7
- SHA512 67f26c6668cddf194b17be72589580bfd12d66c5c821f83014a9072a1d2ca3584d54c88fa8ae6bfd8b561c1e7fa4c7456a145ae9b09d3c58565e4c1f2adbf4f3
- SSDEEP 3072:eGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:J1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\moonlight.dll
- Size 65KB
- SHA256 4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc
- MD5 c55534452c57efa04f4109310f71ccca
- SHA1 b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61
- SHA512 ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a
- SSDEEP 1536:i3C8wUcw1dwm8qlwn4iEv72oIY6bGkPwTufpXeTVZR3AWgCuNjC2WL2Ro:o0UXEfhEYbzPCTVZR3AWijGLMo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\onceinabluemoon.mid
- Size 8KB
- SHA256 c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae
- MD5 0e528d000aad58b255c1cf8fd0bb1089
- SHA1 2445d2cc0921aea9ae53b8920d048d6537940ec6
- SHA512 89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116
- SSDEEP 192:aw5g2v7GlPpvri75iBj2hE0E7D8B+QUTvjkf:aw59Dytri75iBSLAQ7UTvIf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system\msvbvm60.dll
- Size 1.4MB
- SHA256 2160e45f6bb10d3e3a8765ffc01b42dd6a68159abf14c1a8dea2602365bb002d
- MD5 d93921be0a8cc54b2914d59edda504ff
- SHA1 61699b7bf5b7b3903ed8a99623367054f57a934a
- SHA512 6dc0088e685920d63b7898a413d1351b37c5c431d02ffd04c3db42527ec09178641a94abefdaa2dd2a70792240d1caf25f943fe04ca4eb9556a52f9ed17e4a36
- SSDEEP 24576:KNqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:KNQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system\msvbvm60.dll
- Size 1.4MB
- SHA256 a0971629b884006036919ac4d076303a24ae0fff9e0d5d22f3e309f344bc5cc9
- MD5 1f7ae8bd1269304b9677a1e8b458c273
- SHA1 914c035fcd8fc2d26276175240326923e439a2d8
- SHA512 c298313cf76eb5db48de59025e60f02eccbb48d7cf1d71c71facbb97fb0112ccab129adfb80db6e23d3c7e50a530d554c25ff4c01555dc217b9e01bc078d6c99
- SSDEEP 24576:tNqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:tNQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP