Overview

overview

10

Static

static

10

68f371a221...fe.exe

windows7-x64

10

68f371a221...fe.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 22:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    68f371a2212916672baa4d535d19620a6abf5ec7afc6ea400c854d34481bb4fe.exe

  • Size

    64KB

  • MD5

    4f9dd562449c7964589a8047e57b7b9e

  • SHA1

    5b9dc26e8bdc0b847f89aaa13c531653c4e082e2

  • SHA256

    68f371a2212916672baa4d535d19620a6abf5ec7afc6ea400c854d34481bb4fe

  • SHA512

    6a6183225350be29600768a353755c3cef8c82d34bf0c11d7329376f8ceb7bdce17e4be77e82de81a1c0f81c8cb7d9da9ae3ddcb6bc5a56da56f4d3a3ac6bc56

  • SSDEEP

    1536:9a8jroAbRB+XWCQLZeIdSwkoa8jroAbRB+XWCQLw:LFRBLJSOFRBLw

Score
10/10
aspackv2evasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Detects executables packed with ASPack 64 IoCs
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • ASPack v2.12-2.42 19 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 38 IoCs
  • Drops file in Windows directory 24 IoCs
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\68f371a2212916672baa4d535d19620a6abf5ec7afc6ea400c854d34481bb4fe.exe
    "C:\Users\Admin\AppData\Local\Temp\68f371a2212916672baa4d535d19620a6abf5ec7afc6ea400c854d34481bb4fe.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2196
    • C:\Windows\babon.exe
      C:\Windows\babon.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3200
      • C:\Windows\Notepad.exe
        Notepad.exe C:\wangsit.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1768
      • C:\Windows\babon.exe
        C:\Windows\babon.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4852
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:3476
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:5088
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3512
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1272
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1168
      • C:\Windows\babon.exe
        C:\Windows\babon.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3172
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1236
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1432
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3896
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2196
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3736
      • C:\Windows\babon.exe
        C:\Windows\babon.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3460
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4488
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4564
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1244
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1428
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3756
      • C:\Windows\babon.exe
        C:\Windows\babon.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:5028
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2144
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:748
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2632
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3764
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4560
      • C:\Windows\babon.exe
        C:\Windows\babon.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3724
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:3700
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:964
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2260
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\csrss.exe
    Filesize

    64KB

    MD5

    5fa7f50413cbbc744264970ad08236a0

    SHA1

    d7c339db2a9270cdf06586ec759828ed828bb8aa

    SHA256

    5ed05a854c0dfd02035b912494e7f9195059a4273d9f6e8cb25c957bc4e12974

    SHA512

    ba6ad6a7da3192aa9547219820c37011cbca0d0b5321b7e35feb188482c85e0ed495cfdd9522268b447d15d079a8649dbf3f9cd86809a763d17b33d4095f4c8f

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    64KB

    MD5

    d3015c7ec22d48be916ed715abe6e652

    SHA1

    a11af836cacfe4329220cf433fab5f4ac911a0af

    SHA256

    6788dde2d29034e91a286853c78b6d4233c84bc9b09b52767ef1c04c57426566

    SHA512

    9dc97b0785d0be619a4b755e340fd8fd6e0afffc930176adf9791b62c481dac541f5b774a116e8b5fa52dba9d64b4d9463c28be64d77e874d72edb7f4c12af26

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    64KB

    MD5

    2bc1078fe060b1572d0a51580445e022

    SHA1

    860f213274996a49e33f38bbf0de0bc788dec7f4

    SHA256

    adf6e6305f9da4d454f5e2abb7ba955c5bfc7006a4c57e2fb1f2f9f67f535b16

    SHA512

    8d11db3e9f63a74c860b1ce377ad3a3aaeba0f5435a8f0ea79875647567a83fae4fcbecb161a377c98842adbb92cab1d84278b8bbf086d67d176d3d7c9bf1b7a

    Download Submit

  • C:\Users\Admin\AppData\Local\winlogon.exe
    Filesize

    64KB

    MD5

    4f9dd562449c7964589a8047e57b7b9e

    SHA1

    5b9dc26e8bdc0b847f89aaa13c531653c4e082e2

    SHA256

    68f371a2212916672baa4d535d19620a6abf5ec7afc6ea400c854d34481bb4fe

    SHA512

    6a6183225350be29600768a353755c3cef8c82d34bf0c11d7329376f8ceb7bdce17e4be77e82de81a1c0f81c8cb7d9da9ae3ddcb6bc5a56da56f4d3a3ac6bc56

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe
    Filesize

    64KB

    MD5

    7d4c14fb0ba4397af280f54247aeab6a

    SHA1

    990eb657daf5cb723e4338292e89476a7af09533

    SHA256

    a76825bca3c1a967295dba2dc225f14458e7c5343193d1c5933872645ab195ec

    SHA512

    cec15e15a158eee82a11417d54524348c48cf6e1f5843e55db2fe1b60962c76271dc021d2ce42663594ae19d718b089189191527e024390c1d12b73dcf93697c

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe
    Filesize

    64KB

    MD5

    1b3966f9757ab71b6fbd338e9620f076

    SHA1

    79e178c4047bd799e01c8f87a598096a44ab798b

    SHA256

    8ca09d918c41c734413b8c298802741455ee0f73de0c9fbc2255d68913ff08e5

    SHA512

    2f7a36f2187f3cd5bd4790858489cd2ea467aaf3db30a67297d0b74f47efaca90be2cbdb0cd04c62b4359110ba610cf7f368a2ea7c0c878c36c90dca077075d1

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe
    Filesize

    64KB

    MD5

    0883d9ef6fde1e33cf8dd5630c1b3f5d

    SHA1

    1d2ea30d9f462e0b40ccb87a851523cb445872a5

    SHA256

    1ea2e3739ffbdc18451a9aa403cd5848f9f0d281df8cb49f11150ff108378d0a

    SHA512

    8458aa9953476ced26c7785a81422d31da53f0b2d0c988830cc21886e55dada441481efe9ce4be803d89ecbbb348702a547c947feb5fc882e0a063dc499749e9

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe
    Filesize

    64KB

    MD5

    2bdf109195ce44a8b31a440127494b73

    SHA1

    2ac362ccffd8f714844f3c83fe97a93232ede9d3

    SHA256

    609435202064102d151c5d8fc06370a26222b3aac3bd1496d4795344b5aeb9c3

    SHA512

    e51cc78f201ee7518b47d947c090f2072a8e07401e36fcdedaca9da6a8538105485e45bf129068c20fe539cf847252b1fd64e4f8c268965bf22b333f9896d3d3

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    ceef0e9fd55a8650b00f33118f17e678

    SHA1

    def39c26c7a23f52171b839e8949131580571148

    SHA256

    1f9c7df3672550c0ba6c8d7df4faf45383140c7cbe54560d8c9f87b803ca3757

    SHA512

    3bfacf48ab08ddf88fd21de27bd0b33862b2ab530ca99fccc7424072fbda0784a008ce79a74027fbce15fdb790fc51a551b9a225cc42e39043afaab4055dcd3e

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    ff290f78b24d1fb1e77a05a149d53491

    SHA1

    aa9da421325e65aefed36184638848871d66e4e6

    SHA256

    9c8ce875692cb6de9ec8d706a2a2dd8058b704ba294dc512e99f2004e831a820

    SHA512

    69150939e32d28967adf6ea058df94b273d33c32ceacd9156788ebb1880e34fda57fa2ef88b09bc85b9ec662bea686ea5836a014b46f2b8ce9a02d0241613f57

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    64KB

    MD5

    c53bcbc166ef10bdca643cc68ef7d6a8

    SHA1

    f19df5882f57a177c68a12839ed911ba68598602

    SHA256

    539f0a3c8ab590072690c6af310d5501c0cb2d7b638c00af660ac8623c8832c2

    SHA512

    6292cc8a926c0a103719c638aaa7d425422bf380f3fe915657716546aa8657f9faaac57187151567180649e06f7a642e8cde08c2d6b9e761c1d33ca2e6223944

    Download Submit

  • C:\Windows\SysWOW64\babon.scr
    Filesize

    64KB

    MD5

    93ded941c1b7670bc0f933d6de92ae24

    SHA1

    fba40fb183f133be7c3e8162e1724058667f8f22

    SHA256

    4bec74fb5de22f466bc64eca2661105dc45d4a5f7c9204a119feedb6334edd4b

    SHA512

    ebce47aa7d242e9b4513f4fcf0168f0974f273ca26fb10d3c67b4a190bbc56d2953ec1dbc182359c828b68b9431c335c2a0423f75d2319546cd2050f2a914564

    Download Submit

  • C:\Windows\SysWOW64\babon.scr
    Filesize

    64KB

    MD5

    62c645cd33a1b19355fbb9b3fc4d7de8

    SHA1

    9262d9b729465746dcfb4f1a87a957d1e8d012e3

    SHA256

    5d4b13bd7546ecf0c4e1cd87ac73559bf9e3b83d6807305de6db9cb4a08fa8d4

    SHA512

    13dfea43dedeced93d81ea968e33d0111fd44f63be1d303f2730c5c2b4ed4db11bc39852020b25ec89afa4ef597db9fde683aa4ee469b5e71ed58974b3119035

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    b197a6f2cc96e511240f90b158470ddd

    SHA1

    4763ce8aafcd7d14c4b96c7eb9be7187e78261fe

    SHA256

    fc2828cf9041dcd09c4cd792031f8a65e70b76593a4fff817c89b941dc7ebc93

    SHA512

    edf9a85dda2b1d734c7d320dd1fc360c79ee6af6e36db48dc7ab67da2aab0c0ace41e362ba4e824b294523812cf5ecb567ef604fb74f6315bb02ad80744baadf

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    b5932aa369f02a9955ceecde54669201

    SHA1

    283be65a7939c58031a4f0b277661e15161a876d

    SHA256

    369552abaebb609689bdeaa8a2e14a67d1cd58e164651d896b797467b14a83bc

    SHA512

    0ddf40eae5615eeb588bc11aaa630952ce4709ae4293aed91eafbc38ae11124940e70d9ad8c5500187ce654138e9fb4ff3503466253c37ed98587a3969ca9065

    Download Submit

  • C:\Windows\babon.exe
    Filesize

    64KB

    MD5

    0471ca7342ac9dcc6f1533811417790d

    SHA1

    c90610c5e4fbf7294fa9a85d3eaf5924c1853b03

    SHA256

    5781e4518ff34890d0c282d85ecc1c47e3d2fcb620faff48daeed9e7bb3eb9d7

    SHA512

    8177586da04de80f7527581e5817e2a931a0c96303505da195da57cdb5af41407478105ec44d754c9b1bba594c7316c6ea713680279844354bd7ea6f0680b2e1

    Download Submit

  • C:\Windows\msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\babon.exe
    Filesize

    64KB

    MD5

    fb515328b3000b2ecfb9de3028477d51

    SHA1

    3c086cdb4400f80ee6be1b3ff65a30cc5b7f992d

    SHA256

    d20e405e06ae92efd048cbfedb9954ef240744a44666a6a18ecec5179fd3e70a

    SHA512

    9213756dcde81ddf259295377e43d711d8c30dc2a993c6f212dffd48a85963d2331fc4806beac4829f8f953803b165ef5027486c657c29a45e38970868b5e7cd

    Download Submit

  • C:\babon.exe
    Filesize

    64KB

    MD5

    6a094a7dfb1b2c8a34a63d49fa1a0863

    SHA1

    ededb0ae7b58e9eeab057a32515560e4b6ba9c59

    SHA256

    f3d9503e3d29b5792ee3c9dd5c97e0c46ed172baa68fc6f95c11460b2c688823

    SHA512

    d65cace6b4d6009fd53905c5c6c9c8698e4ff0dc7d89e3c57a092d169d2b3bdf5a5f6064e11e12db194d7b69832551bb909b110f712dac1fdc6fd9ded6763cb0

    Download Submit

  • C:\babon.exe
    Filesize

    64KB

    MD5

    29677e28471f2b71d62a3e5a1037a29e

    SHA1

    17aa94339c7f3403c31a07f69651a56131cf39eb

    SHA256

    5d3a967e192f9448fe079147167e4a67275cfe562bc57d234cbc2ba4534ed8ee

    SHA512

    c2a8479338d97e486e780d643c87d7c22a884f96dd57905930884388f9ba66b0e22a7d50b69f88667bb90fad60acbae12c8fb47283322114d159fed6eafe4bc6

    Download Submit

  • C:\wangsit.txt
    Filesize

    416B

    MD5

    8c460e27a1949370d14f20942ef964c3

    SHA1

    fb1f75839903c83911b45b49956792d27db56185

    SHA256

    2c001b5c9684baf861870ffbaf0bec9df22560cdf3cd5a719a78a882e3122f8d

    SHA512

    ad4299385bd91f7157f4d4b01025664333423f15f796a9a70e3f5df251842cdef3ad8f1158dc3c8b51c8ea4d082d62d56a6b57fade7b563fb953f8b511a17bcd

    Download Submit

  • F:\autorun.inf
    Filesize

    41B

    MD5

    097661e74e667ec2329bc274acb87b0d

    SHA1

    91c68a6089af2f61035e2e5f2a8da8c908dc93ed

    SHA256

    aab4cf640f2520966a0aac31af8d1b819eea28736c6b103db16b07c3188ec6c0

    SHA512

    e90e678526270cd9388538246793534411c478b082ab914bfe2756b18771229f146c731c0f9c94ed59d8689b2ef77d25f7b22d3d6b8c2d439e5b3437f8dc649e

    Download Submit

  • memory/748-363-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/964-368-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/964-375-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1168-108-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1168-405-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1236-340-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1272-214-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1428-393-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1428-388-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1432-346-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1432-353-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1988-403-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/2144-351-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/2196-395-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/2196-133-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/2196-0-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/2260-390-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/2632-384-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3172-275-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3172-215-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3200-404-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3200-101-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3460-321-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3476-169-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3476-173-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3512-190-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3512-178-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3700-365-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3724-333-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3724-349-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3736-406-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3736-117-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3756-407-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3756-123-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3764-402-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3764-396-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3896-379-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/3896-369-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/4488-344-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/4560-128-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/4560-408-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/4564-361-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/4852-167-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/4852-163-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/5028-336-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/5028-296-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/5088-177-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download