Overview
overview
10Static
static
3e1b2e96bb5...c6.exe
windows7-x64
10e1b2e96bb5...c6.exe
windows10-2004-x64
10$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
- max time kernel
22s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 04:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe
Resource
win7-20240508-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe
- Size 332KB
- Sample240611-evdknavbpp
- SHA256 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6
- MD5 2569981f3c1ed36a7b1ed6f215e739a2
- SHA1 de12426615e9d6d26ac67babcaca82351fdd7a54
- SHA512 93b26b7a164ca9b0e22ac192eda7266b9904f5ba762b96f6128185b496808a728b5ce11584a5dca2e87df56b3401afdab4f2264ffd0db704a32f0c2b84930dc0
- SSDEEP 6144:mN/IaoYuk96kADp70jutbFs6XDVsK+/OVtK4cj9K1+2BoUz6jJQPI:aLWYjutacDVsAVMJKcmoUzaaPI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Au_.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 36 IoCs
resource yara_rule behavioral2/memory/2584-1-0x00000000026C0000-0x000000000377A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2584-4-0x00000000026C0000-0x000000000377A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2584-6-0x00000000026C0000-0x000000000377A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2584-7-0x00000000026C0000-0x000000000377A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2584-16-0x00000000026C0000-0x000000000377A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2584-17-0x00000000026C0000-0x000000000377A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2584-20-0x00000000026C0000-0x000000000377A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2584-21-0x00000000026C0000-0x000000000377A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2584-8-0x00000000026C0000-0x000000000377A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2584-3-0x00000000026C0000-0x000000000377A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-77-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-76-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-60-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-79-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-72-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-71-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-64-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-62-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-65-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-63-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-82-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-81-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-83-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-85-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-84-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-87-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-88-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-89-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-91-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-92-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-94-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-97-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-100-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-102-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-104-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1408-135-0x00000000056C0000-0x000000000677A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 40 IoCs
resource yara_rule behavioral2/memory/2584-1-0x00000000026C0000-0x000000000377A000-memory.dmp UPX behavioral2/memory/2584-4-0x00000000026C0000-0x000000000377A000-memory.dmp UPX behavioral2/memory/2584-6-0x00000000026C0000-0x000000000377A000-memory.dmp UPX behavioral2/memory/2584-7-0x00000000026C0000-0x000000000377A000-memory.dmp UPX behavioral2/memory/2584-16-0x00000000026C0000-0x000000000377A000-memory.dmp UPX behavioral2/memory/2584-17-0x00000000026C0000-0x000000000377A000-memory.dmp UPX behavioral2/memory/2584-20-0x00000000026C0000-0x000000000377A000-memory.dmp UPX behavioral2/memory/1408-42-0x0000000000400000-0x0000000000480000-memory.dmp UPX behavioral2/memory/2584-21-0x00000000026C0000-0x000000000377A000-memory.dmp UPX behavioral2/memory/2584-45-0x0000000000400000-0x0000000000480000-memory.dmp UPX behavioral2/memory/2584-8-0x00000000026C0000-0x000000000377A000-memory.dmp UPX behavioral2/memory/2584-3-0x00000000026C0000-0x000000000377A000-memory.dmp UPX behavioral2/memory/1408-59-0x0000000000400000-0x0000000000480000-memory.dmp UPX behavioral2/memory/1408-77-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-76-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-60-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-79-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-72-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-71-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-64-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-62-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-65-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-63-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-82-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-81-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-83-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-85-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-84-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-87-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-88-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-89-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-91-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-92-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-94-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-96-0x0000000000400000-0x0000000000480000-memory.dmp UPX behavioral2/memory/1408-97-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-100-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-102-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-104-0x00000000056C0000-0x000000000677A000-memory.dmp UPX behavioral2/memory/1408-135-0x00000000056C0000-0x000000000677A000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 1408 Au_.exe - Loads dropped DLL 2 IoCs
pid Process 1408 Au_.exe 1408 Au_.exe -
resource yara_rule behavioral2/memory/2584-1-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral2/memory/2584-4-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral2/memory/2584-6-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral2/memory/2584-7-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral2/memory/2584-16-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral2/memory/2584-17-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral2/memory/2584-20-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral2/memory/2584-21-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral2/memory/2584-8-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral2/memory/2584-3-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral2/memory/1408-77-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-76-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-60-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-79-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-72-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-71-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-64-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-62-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-65-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-63-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-82-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-81-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-83-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-85-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-84-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-87-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-88-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-89-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-91-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-92-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-94-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-97-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-100-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-102-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-104-0x00000000056C0000-0x000000000677A000-memory.dmp upx behavioral2/memory/1408-135-0x00000000056C0000-0x000000000677A000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe - Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Au_.exe File opened (read-only) \??\G: Au_.exe File opened (read-only) \??\H: Au_.exe File opened (read-only) \??\I: Au_.exe File opened (read-only) \??\J: Au_.exe File opened (read-only) \??\K: Au_.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e576d31 Au_.exe File created C:\Windows\e574297 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe File opened for modification C:\Windows\SYSTEM.INI e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x00070000000233f5-29.dat nsis_installer_2 behavioral2/files/0x00080000000233f3-47.dat nsis_installer_2 - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 1408 Au_.exe 1408 Au_.exe 1408 Au_.exe 1408 Au_.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Token: SeDebugPrivilege 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2584 wrote to memory of 764 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 8 PID 2584 wrote to memory of 768 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 9 PID 2584 wrote to memory of 1020 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 13 PID 2584 wrote to memory of 2540 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 44 PID 2584 wrote to memory of 2572 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 45 PID 2584 wrote to memory of 2692 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 47 PID 2584 wrote to memory of 3488 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 56 PID 2584 wrote to memory of 3588 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 57 PID 2584 wrote to memory of 3796 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 58 PID 2584 wrote to memory of 3884 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 59 PID 2584 wrote to memory of 3952 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 60 PID 2584 wrote to memory of 4032 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 61 PID 2584 wrote to memory of 824 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 62 PID 2584 wrote to memory of 1952 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 73 PID 2584 wrote to memory of 4860 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 74 PID 2584 wrote to memory of 4072 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 75 PID 2584 wrote to memory of 2956 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 80 PID 2584 wrote to memory of 1408 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 82 PID 2584 wrote to memory of 1408 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 82 PID 2584 wrote to memory of 1408 2584 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe 82 PID 1408 wrote to memory of 764 1408 Au_.exe 8 PID 1408 wrote to memory of 768 1408 Au_.exe 9 PID 1408 wrote to memory of 1020 1408 Au_.exe 13 PID 1408 wrote to memory of 2540 1408 Au_.exe 44 PID 1408 wrote to memory of 2572 1408 Au_.exe 45 PID 1408 wrote to memory of 2692 1408 Au_.exe 47 PID 1408 wrote to memory of 3488 1408 Au_.exe 56 PID 1408 wrote to memory of 3588 1408 Au_.exe 57 PID 1408 wrote to memory of 3796 1408 Au_.exe 58 PID 1408 wrote to memory of 3884 1408 Au_.exe 59 PID 1408 wrote to memory of 3952 1408 Au_.exe 60 PID 1408 wrote to memory of 4032 1408 Au_.exe 61 PID 1408 wrote to memory of 824 1408 Au_.exe 62 PID 1408 wrote to memory of 1952 1408 Au_.exe 73 PID 1408 wrote to memory of 4860 1408 Au_.exe 74 PID 1408 wrote to memory of 4072 1408 Au_.exe 75 PID 1408 wrote to memory of 2168 1408 Au_.exe 84 PID 1408 wrote to memory of 764 1408 Au_.exe 8 PID 1408 wrote to memory of 768 1408 Au_.exe 9 PID 1408 wrote to memory of 1020 1408 Au_.exe 13 PID 1408 wrote to memory of 2540 1408 Au_.exe 44 PID 1408 wrote to memory of 2572 1408 Au_.exe 45 PID 1408 wrote to memory of 2692 1408 Au_.exe 47 PID 1408 wrote to memory of 3488 1408 Au_.exe 56 PID 1408 wrote to memory of 3588 1408 Au_.exe 57 PID 1408 wrote to memory of 3796 1408 Au_.exe 58 PID 1408 wrote to memory of 3884 1408 Au_.exe 59 PID 1408 wrote to memory of 3952 1408 Au_.exe 60 PID 1408 wrote to memory of 4032 1408 Au_.exe 61 PID 1408 wrote to memory of 824 1408 Au_.exe 62 PID 1408 wrote to memory of 1952 1408 Au_.exe 73 PID 1408 wrote to memory of 4860 1408 Au_.exe 74 PID 1408 wrote to memory of 4072 1408 Au_.exe 75 PID 1408 wrote to memory of 2168 1408 Au_.exe 84 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2572
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2692
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe"C:\Users\Admin\AppData\Local\Temp\e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1408
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3588
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3796
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3884
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3952
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4032
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:824
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1952
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4860
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4072
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2956
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2168
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E57474A_Rar\Au_.exe
- Size 256KB
- SHA256 1825160a506ec596c02ab9869493671bd5c00118e602afc4a3c254a378c024c5
- MD5 a6a6ec93d611f8247a8198acbdead370
- SHA1 bbb7c81157fff69d94f6122ea96f58bf01067bc0
- SHA512 b5fb1f27733e0817190c503e94fbbed5c20f986460141f9ca079326250df7adcfd1946e330fa28c703e88a81861312423af136914466d622920ce1092ccfe802
- SSDEEP 6144:yN/IaoYuk96kADpyOVtK4cj9K1+2BoUz6jJQPI:eLW7VMJKcmoUzaaPI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsf476B.tmp\LangDLL.dll
- Size 7KB
- SHA256 32487e83679c88f63f35a9989e58ef3a3084bd70b6ebe76cda459c92ebf2c066
- MD5 ccb909b48488ac50078b994947cf855c
- SHA1 08ef6ff2b4df6de0bdc443611815a8db619b6c70
- SHA512 ebe5dece02bd459d8d28457fe082bc759c21c0bb641ed31a848e2b521bfd9d2544585b0acbb1dfd08a5a9b91a91bba5aa5339c0f736fd153f852af17144caac8
- SSDEEP 96:X80Gzrjk9CYIh6SnCQ5ygkSoZrtjlPVng1/GsoJoiB:DGbeINnC4oZrjPdIOjqi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsf476B.tmp\UAC.dll
- Size 36KB
- SHA256 07ad34100502d7aebd8c19cf6fabda31814312984ae25d26b081ddebf3926077
- MD5 e6ab90ea8f9454d4a8aed70eb924bb4a
- SHA1 22d7c541e93e3d5520756047e3af0324af7640e5
- SHA512 23953f4163afe3a2ebadbba03e7bec5bab10c8c112ab093e3893ec11d6d4232a526014f02db995b60f63b7cc8e49f2883a6e2112092176ccfa28a45f2397527a
- SSDEEP 768:4mlFrRNxK9CxHpR2fYw4G3ridSzSH7YHJ2I5:4kFrFJpR2AhGcYB5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
- Size 332KB
- SHA256 e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6
- MD5 2569981f3c1ed36a7b1ed6f215e739a2
- SHA1 de12426615e9d6d26ac67babcaca82351fdd7a54
- SHA512 93b26b7a164ca9b0e22ac192eda7266b9904f5ba762b96f6128185b496808a728b5ce11584a5dca2e87df56b3401afdab4f2264ffd0db704a32f0c2b84930dc0
- SSDEEP 6144:mN/IaoYuk96kADp70jutbFs6XDVsK+/OVtK4cj9K1+2BoUz6jJQPI:aLWYjutacDVsAVMJKcmoUzaaPI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 2473a94475bcbbe596e68b5200140a5a55cbbcd6371bf9d29ef2e0fcba3faaf7
- MD5 c9c057671b5d097892c2971a35d69081
- SHA1 c4ddda64e2a4c8b56d30de539ccc6074706d5876
- SHA512 6748cdc7f49c78f6a75a8e27973debc287d81a0e85c2308d809ed67992c94259d7ba4c4cdf32b8bf5d3b912f5b0eeb2e6116a0d56c68528283b1433053f4abaa
- MD5 SHA1 SHA512
- Path C:\apvyp.pif
- Size 97KB
- SHA256 f6487ed50319212417b9f4867bbbc3994093c2e9fafbae2919d12656fbe07925
- MD5 8531d1568a80550d6381a335cce9be54
- SHA1 3da01594efc5acad03d7e830c31f0c825a8d542c
- SHA512 2b8b6f696cf950275d25323ae3fa7f5224636601ed5d14351b05c16cf7a992b25fd35f12815f712cba851e8e712dabaaff09724fc98092ca4db2cc9aba119e09
- SSDEEP 1536:Aqrpv0uvMUU46CVcGdShirftfGrZaUsKaLKXajP:A6pv0uv9UWFdJ5fGrZaU2LKXM
- MD5 SHA1 SHA512 SSDEEP