7eda4a7aad48e8c17fcc5f06f4977fe541af3bac0a666835323873e6a06cec51

Analysis

max time kernel
14s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
Size 936KB
Sample240613-p3zg7stdkn
SHA256 4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906
MD5 6cdd7ca85e3828897d6e39b1ab93e6a2
SHA1 b3879d8d6f937d0aabf4660be207e9aabe965397
SHA512 8df354a2024b2a047de5fe50437a6842066626953a0740ad1810b10f619266de1fece6d431a0cbb7ecfa300cc4529dd98da77e8a11d0aceedba67d1294a31984
SSDEEP 24576:NAHnh+eWsN3skA4RV1Hom2KXMmHabZNIgY5:sh+ZkldoPK8YabZg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence ransomware spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crytoMSG = "C:\\Users\\Admin\\ReadmeCrypto.txt"	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe

Drops desktop.ini file(s) 38 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\h:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\i:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\m:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\n:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\s:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\v:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\a:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\l:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\r:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\u:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\w:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\x:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\g:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\j:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\k:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\t:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\z:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\b:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\o:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\p:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\q:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
File opened (read-only)	\??\y:	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\pl.bmp"	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "120"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1128	shutdown.exe
Token: SeRemoteShutdownPrivilege	1128	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1236	1848	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe	86
PID 1848 wrote to memory of 1236	1848	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe	86
PID 1848 wrote to memory of 1236	1848	4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe	86
PID 1236 wrote to memory of 1128	1236	cmd.exe	88
PID 1236 wrote to memory of 1128	1236	cmd.exe	88
PID 1236 wrote to memory of 1128	1236	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe
"C:\Users\Admin\AppData\Local\Temp\4f4dbd505348c33b9435351252aeddba1199df72011e4f83a643790d02231906.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown /r /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1128

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3944055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

000003.log

Path C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\000003.log
Size 16B
SHA256 59948c55acdec15e2b9292f6fc8b6d37987a3fe761c7d6494169de9d13ee785a
MD5 7e0aec911b11f73ea3539207c564eb4b
SHA1 896a49ca8e601f6f2236ed05e55d25eaa4d59273
SHA512 7d8c52a09d852c92d5ba85e9ffcb885ac8377e4f12470db4d5fb7f6e831ebd2356418cc41aff72f74ff538d97bcbf9f91ca31b43552027ae2c3e04534a260e26
MD5 SHA1 SHA512

Submit Download

USStmp.jtx

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx
Size 3.0MB
SHA256 f51e08ab4c4951d9f81a5cd78f48c1b717fcd92e272ba3b21412292e0024f404
MD5 511bab122986dce531daa0c8c19e3e2b
SHA1 78aa989f1b351bbc48ca6856dc7918f30fdedc54
SHA512 f7edb140352655a9b7c4f169bc6f1eacea05ca4a172bf6b8df021b0ace29a73f9a799054d3ee2263428fcbd872f96952d37781f68de3b46607260063eebb344c
SSDEEP 48:DWJiT5BcnUSg6OtGS53YGYRU6rzpBwzswi:DHBnSgPtH53qU6rv0
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index
Size 32B
SHA256 dab66ee5d7af591447e94c8b5023a121d449493c99a99e52292b8febdf74260b
MD5 167a68964d9a90686a2cc2de3fff7744
SHA1 05ddd8de57e0aba2e5e4c2bd0572688a2012a9d2
SHA512 69154c199f004d0ef870403681f0d82dc0beb2cb49e3669d361792f07f1923c9004dd0932637f3e67fbc909b546251dfc34041b7df12466c18ce9e12ad548876
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0
Size 8KB
SHA256 f04ccd5116f3984fd9346120327622e1d393d67d624cfd6a073a0db5695ea5a2
MD5 6e3a482699e187fb1e1983b19583f7a0
SHA1 ebf04d4ec9270e192f4baf594ce73d71ad9df5b4
SHA512 b523aacf28d41698e82ae90271fc982c3f611a93e81b997e5c53c67dcfe29c105bf9bb9b7c0d05b6e50661042431436d1d48bd909f1c28ed4e3fdd8bdde16865
SSDEEP 48:5xxTZuHaHRp8OzrQT6I3V3HKLBWNy4XxokcDD:BVuOfQTHlQBMzvcDD
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 f5d6486fdac4cf482d47447c6b80c248c8a882f1184eed9b4a40082b9af160d1
MD5 f71a7fc9e23ee295b4ef85ea1d9b9776
SHA1 9a52940957f4c0b8faecd84f11d0053ead6b23bc
SHA512 885780f489513390120adfd1b205799c423feba73262fe82475ed9c7ecd62aaa00ad600076ca29895514da08f41e1959490e8a1dc40391f572481dca8e4cc9b5
SSDEEP 48:7CrH0gs2mEbrQa82TkzhJld6rW1sklQQkZC0RqBZNeW8Am:GIXDE8RznT6K1PuQeCzXTjm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2
Size 8KB
SHA256 a705dd8d6503b45c9c5f2abd972b6fce67a68b0762cdc4892508ccab1fd9691c
MD5 bfcf90eae3f0521ba179d1c00c53477e
SHA1 039766878b230861d917943db9808cbd80852120
SHA512 fea9e3acb45e1be6a45888af617ac2f40955370f2d917cf013023b9df45718eb038a2fffb69dca147231031a31d4f07caf0f43c9c5292103afc4841a6c607f55
SSDEEP 48:7YYafsFLvGOh0B7SmnAHqsVAoMeR7aokv5oC9i:7HafsFDhGSmngqs2+chBf
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3
Size 8KB
SHA256 53e11e630f1c60e5e1f6aeeeeb9bae59726ab4de6616dc159b2c45861e79a26d
MD5 8e1c7e4bdd41ab0afba5175f06047c90
SHA1 e102b9ed805367acff57a34276c2d1a8da0f0006
SHA512 58c8e7fc6ed922a1428e6b14ff87652b44e903045e61a9a89262ce4c7b5e65c781daedec8b9521483d0c6500f2639796e35afc7037264d97879f5b2df60625b0
SSDEEP 48:9j6L7m0cH3l/aj4DRhOmrOI5HBjfSUjd8rWSLZ:9+LeXs0bOo5h+UjdYZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Size 32B
SHA256 dce591834be14a90ff16605676a32a34cd6277f10b21d2b40c20c10e092c1393
MD5 e43f3b3b8a1e3cd8a49f82378ab4edfe
SHA1 2e738acc5c145f62bc154c5ed9108363e08147f9
SHA512 7c3dbfd4e9ffb591487cf33769f36f1559159fd2f54ffb7beb33baa06aba1d14276d26c69ddab8728fe3e7ce6dd65bc9b9380b2f80d351c43ad0985ac0fb617e
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Size 48B
SHA256 6dd8f9a4f45286150003f5e4edc6fbc293fc64300a5f88e2684b13e9fe653915
MD5 406761fe252d7e881dbeb3c721792747
SHA1 2c249cacd5cee160cba3d02d051abefb3dfdab08
SHA512 0086c4c87a1962bb601ea031f9e142218844e326f610925a5d944d768c5db7aee45e76e634c9566bed73f06e67d6ddde6f47f14878d1b7dac009e3261ac0c8cc
MD5 SHA1 SHA512

Submit Download

PreSignInSettingsConfig[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\PreSignInSettingsConfig[1].json
Size 63KB
SHA256 14a25a81b67bacdf9134c904e46500b2bf2bee1c61beed65cb34cb3cc1a8a146
MD5 881e98406ddbc22dd1f5aa72daeda78e
SHA1 4416e45ac5cee3bffbd7ef0ef8ec72004a3e3376
SHA512 78f254150b9d025244a78f0b6553d8d4dc0c112aef33c872cd7c4489269e560a9ededd1c34d54b9f41058cf250f15a716c224386de15b4cd2cc5da298a06870f
SSDEEP 768:YpTYryF7U9mCzHS7vu/xV2iP56vcDR+P0h:2TYuZUQwSb46vcwC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}
Size 36KB
SHA256 97e5bfae1d53b861a359605abf69616b30f3e44810501e995149d71c9f79010d
MD5 4aab024831a174831e72684b97270561
SHA1 9412780753d956b3ef518de859b4ddae01351a66
SHA512 0f3e21d83f8f6e445a96d6665a416cbfc5add7e140fbf0729048f60d2baebcaf9b2788087091ce82a8ca2783d535d8b6957a8e0ddf710f6d3f95593b9532927b
SSDEEP 768:6lQVmmmmmmmmmmmmmmmmmmmydiXjPJdKQ7ai3ZigbmY9//JD9UZ99tS0FVGn4YEc:6Kig1
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc
Size 36KB
SHA256 b6727ad2bdebc02ec7df1326f5bd52c030c3c5e94f5e3b2fb01df5e90a808c8d
MD5 b74d6d7ad7b515540312c9943ad8ea4a
SHA1 15442d3f5ac89a13860dc92b14691a9534b37a5e
SHA512 50315342053ed563f18319f74ff376f97887a147964e7625a5aa2762c0b89321271e17dd4260d1f673c85fe14d7a21d807a5973899980bd56b9ece4d330d969b
SSDEEP 384:m5pFPa3Nt+jJBEiqnYcnXYGiExSUGrEoikM2vVetvNSvnazbqJ:m5pyaJmiqFnXH+UGYoikR4ayzbq
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat
Size 8KB
SHA256 136c078ac21a0ddadcd717b7ba1b856852e2278ebd80030af28a767820f08777
MD5 93930997ded63bfdacbf67adb8149aa2
SHA1 c394e77abc81e7924d453352e469513b525d1e21
SHA512 e3e0171a847e6603ab603ed50d3203dc76bf694ccbdee84f7bcb7dc5d29e7ec163740b686def2cbfb6cbb9a2d529c30a71a80370e92d07fc54e0fec702955a63
SSDEEP 48:pqGAAWVbzakTS9l9RM33wZRaZ7PM5RwL7YqCbT4K1dM87d37J:UGAAub3S9l9RM33MsPMrwL7Yl4I31
MD5 SHA1 SHA512 SSDEEP

Submit Download

3561288849sdhlie.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Size 48KB
SHA256 2dac1c676cb9b5b1add73f3283d6c9d4945074a4db1e77cd4b8290e7f6590012
MD5 e82c282538547ab445abfc43cdbbb4f9
SHA1 54ff08a85c847d9c4e0cfeb44fc2658ca01c129a
SHA512 cb4b80c4e810a574151d1457e693f8d9c5c65c29416d272d6bb4085a307da4f1f6e84794e84ef974538655af6adbe2cfa92af2e6a8e713ecdb39510b679f8727
SSDEEP 96:wYyWEAuZut1NwCnv/i01l0xV+2xVeU7X2B0b7s:2WEAuZk151AWA7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads