Country	Destination	Domain	Proto
US	8.8.8.8:53	75.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	80.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	139.53.16.96.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	29.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	169.117.168.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win7-20231129-en

Max time kernel

119s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240611-en

Max time kernel

89s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-synch-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	80.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

49s

Max time network

53s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-sysinfo-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-sysinfo-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-math-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-math-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	136.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	139.53.16.96.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	25.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win7-20240221-en

Max time kernel

141s

Max time network

143s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description	Indicator	Process	Target
PID 540 created 1196	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Windows\Explorer.EXE

Vidar

stealer vidar

Detect binaries embedding considerable number of MFA browser extension IDs.

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects Windows executables referencing non-Windows User-Agents

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects executables containing potential Windows Defender anti-emulation checks

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects executables manipulated with Fody

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Downloads MZ/PE file

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\ProgramData\CBFCFBFBFB.exe	N/A
N/A	N/A	C:\ProgramData\IJDHCBGHJE.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\cmd.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 540 set thread context of 808	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2968 set thread context of 2180	N/A	C:\ProgramData\IJDHCBGHJE.exe	C:\Windows\SysWOW64\ftp.exe
PID 2412 set thread context of 2752	N/A	C:\ProgramData\CBFCFBFBFB.exe	C:\Windows\SysWOW64\ftp.exe

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Tasks\Watcher Com SH.job	C:\Windows\SysWOW64\ftp.exe	N/A
File created	C:\Windows\Tasks\TWI Cloud Host.job	C:\Windows\SysWOW64\ftp.exe	N/A

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Enumerates processes with tasklist

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\ProgramData\CBFCFBFBFB.exe	N/A
N/A	N/A	C:\ProgramData\IJDHCBGHJE.exe	N/A
N/A	N/A	C:\ProgramData\IJDHCBGHJE.exe	N/A
N/A	N/A	C:\ProgramData\CBFCFBFBFB.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\ProgramData\IJDHCBGHJE.exe	N/A
N/A	N/A	C:\ProgramData\CBFCFBFBFB.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\ftp.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1728 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 1728 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 1728 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 1728 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2824	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2724 wrote to memory of 2824	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2724 wrote to memory of 2824	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2724 wrote to memory of 2824	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2724 wrote to memory of 2832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 2832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 2832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 2832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 1684	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2724 wrote to memory of 1684	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2724 wrote to memory of 1684	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2724 wrote to memory of 1684	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 2724 wrote to memory of 1436	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 1436	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 1436	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 1436	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 1532	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 1532	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 1532	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 1532	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 864	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 864	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 864	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 864	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 2724 wrote to memory of 2632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2632	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 540	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2724 wrote to memory of 540	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2724 wrote to memory of 540	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2724 wrote to memory of 540	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2724 wrote to memory of 1104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 2724 wrote to memory of 1104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 2724 wrote to memory of 1104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 2724 wrote to memory of 1104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 540 wrote to memory of 808	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 540 wrote to memory of 808	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 540 wrote to memory of 808	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 540 wrote to memory of 808	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 540 wrote to memory of 808	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 540 wrote to memory of 808	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 808 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\CBFCFBFBFB.exe
PID 808 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\CBFCFBFBFB.exe
PID 808 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\CBFCFBFBFB.exe
PID 808 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\CBFCFBFBFB.exe
PID 808 wrote to memory of 2968	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\IJDHCBGHJE.exe
PID 808 wrote to memory of 2968	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\IJDHCBGHJE.exe
PID 808 wrote to memory of 2968	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\IJDHCBGHJE.exe
PID 808 wrote to memory of 2968	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\ProgramData\IJDHCBGHJE.exe
PID 2968 wrote to memory of 2180	N/A	C:\ProgramData\IJDHCBGHJE.exe	C:\Windows\SysWOW64\ftp.exe
PID 2968 wrote to memory of 2180	N/A	C:\ProgramData\IJDHCBGHJE.exe	C:\Windows\SysWOW64\ftp.exe
PID 2968 wrote to memory of 2180	N/A	C:\ProgramData\IJDHCBGHJE.exe	C:\Windows\SysWOW64\ftp.exe
PID 2968 wrote to memory of 2180	N/A	C:\ProgramData\IJDHCBGHJE.exe	C:\Windows\SysWOW64\ftp.exe
PID 2412 wrote to memory of 2752	N/A	C:\ProgramData\CBFCFBFBFB.exe	C:\Windows\SysWOW64\ftp.exe
PID 2412 wrote to memory of 2752	N/A	C:\ProgramData\CBFCFBFBFB.exe	C:\Windows\SysWOW64\ftp.exe
PID 2412 wrote to memory of 2752	N/A	C:\ProgramData\CBFCFBFBFB.exe	C:\Windows\SysWOW64\ftp.exe
PID 2412 wrote to memory of 2752	N/A	C:\ProgramData\CBFCFBFBFB.exe	C:\Windows\SysWOW64\ftp.exe
PID 808 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Windows\SysWOW64\cmd.exe
PID 808 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Revenues Revenues.cmd & Revenues.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 366279

C:\Windows\SysWOW64\findstr.exe

findstr /V "RingtoneRentMicrosoftFocuses" Editors

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Isle 366279\m

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

366279\Suspect.pif 366279\m

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\ProgramData\CBFCFBFBFB.exe

"C:\ProgramData\CBFCFBFBFB.exe"

C:\ProgramData\IJDHCBGHJE.exe

"C:\ProgramData\IJDHCBGHJE.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GIJJKFCGDGHD" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	eijWYJUUWJTVUfljdtx.eijWYJUUWJTVUfljdtx	udp
US	8.8.8.8:53	theemir.xyz	udp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	8.8.8.8:53	c.pki.goog	udp
GB	172.217.169.35:80	c.pki.goog	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	8.8.8.8:53	businessdownloads.ltd	udp
US	172.67.212.123:443	businessdownloads.ltd	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	8.8.8.8:53	i.imgur.com	udp
US	199.232.192.193:443	i.imgur.com	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	104.21.81.243:443	theemir.xyz	tcp
US	8.8.8.8:53	proresupdate.com	udp
US	45.152.112.146:80	proresupdate.com	tcp

Files

C:\Users\Admin\AppData\Local\Temp\Revenues

MD5	774a97f2c63a28f5b795e0c7f3a1e797
SHA1	2ab25671bd5a2b253d54594301b765f171aa0cd5
SHA256	a08c17ffca06c08afa2bf6ee98a09c08a2cc22a78596497635cb372d644f140d
SHA512	e6c576edbfc972a9272d4fd969dc4e4f82f5ec61be2c526a1e2686cd4ee0734a649c78673f10efd3e3d9ae7b329a440adcd830fcb6bf3f53d30f678e001518d6

C:\Users\Admin\AppData\Local\Temp\Editors

MD5	c06b582d8286115b48f81ec53f36b383
SHA1	4f925d9b551cebda3f898ad18c62925979bcda7e
SHA256	70290025a0c87bcbd58ea8caf22e2dc0104e726ef3a7f9d9649758869def4189
SHA512	c98e48feca40abf3fc22803dcc80c3f7dc11bc8f3ff6fd03a3d733c1acf438294347169887bcbce82ff20fa9a6cbf0a0d94c76dc15bb5989093d1c2f7903864a

C:\Users\Admin\AppData\Local\Temp\Terminology

MD5	bc54db6ebb67ee3a2e3c127758bc2884
SHA1	4068d9984c207545e62ad464e2134cac265bf9f7
SHA256	8c1e83e582baf2b8232a7ab8e81a751b45d260f4ff01bab2e42783d0e24d6b43
SHA512	a03330c03209d8ef28707854fda4ce7b2b680a374d820d8e699ef980cc6b1e5548eec7c8c86608e3507b3490f38d61f067b25d99d725f10158b9837666aef3cc

C:\Users\Admin\AppData\Local\Temp\Comparisons

MD5	4e292eb85ce9e016ff5a01c719c027c2
SHA1	61b3995398ed8390e8b8dc1a262eb94d55d6b80f
SHA256	6492ab6cd6f8f028f0824e026ed7c5401136f203f7de953bc60f61b32de4b41f
SHA512	9a19f0345059e401fa82e1d90a103438a04b579ccab2667d609f3d7c0764fd91553e6dda65e771fbf3fb059b0e460ad885c22cf39562bacd7e44b4e7bea43ad7

C:\Users\Admin\AppData\Local\Temp\July

MD5	d71ce9af90d20d69dc3de9bc70f9cacd
SHA1	3b5737986225b7358b909f43a201d4872cd3a294
SHA256	fbbc13426ec699ffd56f6c53bc5e5259e25af602205c3d04beac1d4c578f85da
SHA512	85dfe8e9705b97c6a877b0785394171768dc33effa3a37b9969d35ead669172e6e4eb1357d8c231db778a0b37b2d8253b9e6d170e45959ba24a6b2fac868399e

C:\Users\Admin\AppData\Local\Temp\Arg

MD5	d4c42c532dceb34e65d7defc682e77dc
SHA1	7584981bc314640ba1b92da552ffeaedc4ea3a21
SHA256	3e7706b03275975037e49a1a7f29e67bce822086f90630948d9528d9c4b68182
SHA512	67ca5bf547b9bda235c44166681cac7e12515fa49b78ee8d7f564fc094c1509e8fe2f2f029a99ec96ab1fbfb1b9c2d501e4e1d65b4855b75639f2974ac804a4b

C:\Users\Admin\AppData\Local\Temp\Bt

MD5	cf6a6e9c0b825f2b1ced20b4ab200db6
SHA1	8d1987c13c8dc1287f0eb631201ca6eee12b4cd0
SHA256	6e4b33cc9c80b969af96b31b1e95588f9cf79e3670951c63172d60d4e1324f95
SHA512	337bca6e3e8e323821d3767feacc10faefb52b4664968e99c1ab62a72f6770f41bc338bfb672e6602249266b141c4e99d004e48adcd87ea308bdec493674dfdc

C:\Users\Admin\AppData\Local\Temp\Wb

MD5	901d26287ebe3e866d15b610764c49c1
SHA1	13793e6f446a09511642a4f3085cb029a4b853ff
SHA256	c74030e343c6fde4a1f1cf54010c186f9e80b457662bab5500848597c2e19504
SHA512	19ae02941a1a17cbe12c653b3067e10e91e5fe8dd73e0ff2373355eb9ee41af3767ae06885a3fb35bb06e411ec8ac0f291d24e717c01adfcb802539b3cf1f15a

C:\Users\Admin\AppData\Local\Temp\Choose

MD5	fb2cc8e690d82366990f2f20a4a5ab75
SHA1	5556232996e954f981144129298e298c75f8c2fe
SHA256	51982155baed7d5006ebc4446a417f320f8d754ec99911fcfa97ee5d37ce7756
SHA512	e8ae811d270bd2de39d0578e84b0001bffaf34969a1fabaedbe804d96eb79919c13578f41af339ce9af26f5cb6cb107bd6d79c1af9aee8a9e359b4b885fde823

C:\Users\Admin\AppData\Local\Temp\Ns

MD5	67546d73dfe4d66538a7ac7dc030238f
SHA1	1a3450f06ac594739db273e3eb0155018fccc88e
SHA256	71f45ed46fbd47494a7ecb9b31c07214d99133e35b974f5cf2beceabb639217d
SHA512	f3ceb864801ddb2d7f8298950dd76a0738ab4586796d16290c1c8c11579b9017a9b14c94341c24ac024f89a38e402c81903fcabaa2dddd21ca681af173bf5bb3

C:\Users\Admin\AppData\Local\Temp\Objects

MD5	f2f3a8cb98474080fdcca6a39b6b3915
SHA1	49f7327ca65d969203be51ccbf9f4033579923d0
SHA256	ca682c8dcdca30548120b6d3194eebf36a9208bef0e9b611da828bd912a38260
SHA512	cde92ed6e3ad806f0acd220990b46168862511222ae3667c62084f93622cc7ba2e91ed3b1e489f5721b8eeba9fc25b5a718febe3718c1afb74fcc6b4f8c0b1b9

C:\Users\Admin\AppData\Local\Temp\Gc

MD5	f446974fde635cadfcc03c9a25fd3780
SHA1	b59e1202f13139f21db4274d65ac51d2a0f8b856
SHA256	5bc7072917151653d7c40e272d8a95a86bbe7ad027eb30a811331a6f7df7ba51
SHA512	cc1a13562df99e2e2a240ad8d8e8d948846c6c5be0c995d87785e3cf73b54824ee7318c423972ea362dafbaac986f19d0117bc7e5192af5a2ff9fc8430bcc1e7

C:\Users\Admin\AppData\Local\Temp\Marcus

MD5	16fcba5d9aed0ef000c886f56cba85ee
SHA1	22584f6b7227ea3e0898233325be3ecb3c7bef6a
SHA256	35d270b74aa68781c8e0bc3cd008718ce362fe9fd32c9ba1ad52b82fe37d07aa
SHA512	7beb4a5207087b0e37f16df84702e4cac8699f951f6a92c7185bc83582766a43ef18bc93af24827793951f2417dd39bdf0717876f75f32feacec93fdfb2896f7

C:\Users\Admin\AppData\Local\Temp\Thus

MD5	08c077a34051a75c2b915a517c5d7d54
SHA1	ecb5cef32ca27ea5542b7416bc550601721f4a32
SHA256	3ed1a12fde96bc80c62d54a0647000dff23a63b987fe8c3faa9e11b4357321a0
SHA512	8746dae03892cee35b1a4463a7765399f2d1d1d989c53d0881043991c4187f7b4b1765376c435ff13722ec6dff2da98287efca0b335508f24d6f1805034e0f70

C:\Users\Admin\AppData\Local\Temp\Broadway

MD5	abfa29a29931ff6299126aed8dd08859
SHA1	c436e000edcc042f7f7889950a610c94d590d36c
SHA256	dd57cfa1ec84ac01cd4aab6dd18046b3a49daf0445ae29d6695c4a25c0bcd59d
SHA512	c0941a5de5fe072ba81b41b555ffdb59c6e0d2b9bed66a0cbb899699c38792cda0bb9857ab0752dbe0b3c966688ccb523989677803bf637675ec435a8c12406e

C:\Users\Admin\AppData\Local\Temp\Shares

MD5	8715208e25afa7a73918e84ee8b27f50
SHA1	61935bc176db5586053d1d5a22dae8092e6a3f7e
SHA256	f0eba5c2f4c9998b0a491a7ec4fc953e601235709b3536ba1a928e8d5021d3f1
SHA512	461d9e809ede59c71cd7fd9aa90a8ad991c5c9504d5c9c53659604e7e0e25b02d2135fbc0b2c4ab0e4a60bd43c38fa1109559d5f19f58a387dbe8e03424230c8

C:\Users\Admin\AppData\Local\Temp\Pda

MD5	0766c0db71d9a82456e72ca071518676
SHA1	be36286b20cc0aeff00bdca079dfa9f4047e1ac0
SHA256	5553cf5ed1753ab9749bb7f3057f0db8cb9f19b8f673fa977b038ca0fef8b3d1
SHA512	032dad0b91b5482d5d1e558ba9e4dfea6f16c71725d21865f411f888fe631628f7a16a3e9fc367d88c02fde7f6ef7fd56a717c23feb45eb1ff5968605fb7fb77

C:\Users\Admin\AppData\Local\Temp\Talk

MD5	bb769ef1b8aa0b58d0b94c4804bcd418
SHA1	e6f4dc5a736038e5604e282046d1234ccabebf68
SHA256	ae766919ddefe1340cea9b4ae3acfc041e8d079baa7fcf7dca59dfa3330c2d59
SHA512	2d0e600f59a545b1d19f299a8b756bab334b02be8e9f6e1ff2d3f64c18362bcb60239b0786358023728be88c8e033219e9df500d30b3121921d356055c60bb05

C:\Users\Admin\AppData\Local\Temp\Atlanta

MD5	05bf6c32a8d3cb1025a4e8baca686fc5
SHA1	e32584b21803cf8bed34367c8e4f34ff6104d6c4
SHA256	61460bebb1a3ada4d197a869a8d9637eaf03656b32509e5a4606240d06ab3361
SHA512	c93b4c23daf481e9ebcb8d19d1381e3a7ab49b1708e0340a9455a11fc26b3209577cc831e7610d212a0e677b8f6217855038b1cf0b2379f397549b92cbf89b03

C:\Users\Admin\AppData\Local\Temp\Roy

MD5	6310218145bc5ec965e5953fb0305d19
SHA1	b6043e6b47ea99b13efea5b2b7c523248379f6af
SHA256	ae7d0d86b3505a9c5c40bce3fd2554102e4f7d21aa5bdcc10451ce1019606629
SHA512	ae82e5721644c9f51852c5973dec9e250b83593b4079c7d3360e55700c75e43f9cac36de508654831c37e4d4ffdfcc8aabe8d681bcfd7a3a72d8d3f3df0fe6ec

C:\Users\Admin\AppData\Local\Temp\Gis

MD5	e5e509038d8029cc95879ae96199093c
SHA1	18fceacd1cf5c57c6c2f1dc59a05906b740323a0
SHA256	bfa2b066ea73af4b0296b130a7c1927a4723864502ec646809aca415677844a6
SHA512	359d9dc6751abf5dbbede201409e77652f595f40148f987272aacb50e320c43562f93db179727d05120c7bb8edb45c3fb81c30aebc91422f33ca7c70466b34b1

C:\Users\Admin\AppData\Local\Temp\Russian

MD5	91be5c23d6db4ea3e47b0259475cdd4b
SHA1	07cee20085effe581fddb260a65473c130e88e21
SHA256	8e6d9c7c4069ed6ea1fa346238ce48cf4479df04d1871e874f8c31e8ffede898
SHA512	e4f536a4f9b60098abd7212f82cacf6d9729a89c207a74a7dfcf8b9069a64eb024d60f0d506c1a50726d60c267222d200a50a6cc3a31a06ea1ef9ab3fce887e3

C:\Users\Admin\AppData\Local\Temp\Serving

MD5	d0fa08b94bca138551c4b274ade27a75
SHA1	acaa349e9d6f03d622c2f0280247a43fbc078f3a
SHA256	4e9de0fd78447786652a61ab8339253c2ec4c671d3a9dd956d3aca384a7ee4a1
SHA512	bc17fd7b4b79f96d7adbf35c96919c49ace59ac0e2807fb31e7e88871218b5f0ad6f9183087c451675c16f24a16ed278fa78b325a3b631068e2fee16b3a84622

C:\Users\Admin\AppData\Local\Temp\Wallpaper

MD5	98d91341d4e754f361bbedeb35242a36
SHA1	4718235cf9242f7250700af2a3411357d2a2525c
SHA256	42d670d3dd28bc4597b71a9373763029451d0da5efe1288c774f6b512fae9f0e
SHA512	1e877510d91e6f62790b7f15c7ffa00c31e18f24bc3ec72dcd63e9c2b0031817bbf87e1f9d3359f50dd25f1d6e53eeea61fc9331ebc58f88361fcd2353e32fa9

C:\Users\Admin\AppData\Local\Temp\Tomorrow

MD5	b348e7db88d0e52cfb6c7adb43628390
SHA1	5daa60ea78be614a992e88a60b655601cb45ebb6
SHA256	fa61763479671d7aa59798ccd20a2ae48102e24f2fdbc11e753c2141b3e0d135
SHA512	9d3018d203bad94e6a6efb2f5c5dfb55b14d5a6e1885cc60a34f0c647771cede2626e448f2fc194e3d17795c97ebb0bf283cb2a24a7db71f5e7fd15bdab01eff

C:\Users\Admin\AppData\Local\Temp\Pct

MD5	5021070dbffa36d9053699bee3f88806
SHA1	00ce3f117ffe45372c27af5f920ebacdeac92f93
SHA256	41757cf277d0f40e48e2bfc6d963db78308fdfe0b054f67685e2a6473e25327b
SHA512	628268ba6d7c30f1d03f84ff3955782ed23f426645fb8a914b83514f1de9ef23b5060f57e8c6f38dc8071adf063971f050989cab5eb2ef300072ccb58bd7183a

C:\Users\Admin\AppData\Local\Temp\Shaft

MD5	4a29dcfa87b47e37e8b4447b840ccd91
SHA1	cd56012f27e7ece5545b6b07172f8f0169a852f5
SHA256	dbf049319595a1a9faf8c8dbc70814c4562c4b9dd10f18e56b0cb83e37cdce5c
SHA512	79b69684e7a72eb7fa24f36745f42370acc6655e44fbbd93dda679ed676c010a38a530b3b210196b6962e36ca1756fedb4341f867bdeb2e86c6ded23b7dde91f

C:\Users\Admin\AppData\Local\Temp\Word

MD5	ca2ac61ab298e06c4d8f07792708705c
SHA1	35547141d3593d89746a4de38e809388de7b224f
SHA256	cabef77014cb90d5e896c046830742852edb20adcd1da71f88f8f8805d476607
SHA512	c6f0fccfaa08ef6f4d17698eb07cf27fa116b94bab2a25afe392acb2fecb1fb9d58301288e80839dadf834245a614846d72d1243693b40a56d7be45745f90218

C:\Users\Admin\AppData\Local\Temp\Colleagues

MD5	8a6af62b964e899f2fdb5b08bb70fe1d
SHA1	74d97553398f4952fc7244db53a54c5c9418680b
SHA256	621b098f227833dd3d62d4b181bf751e76d9688237ae27ba4475947863775103
SHA512	be082ccae47ebb4bb28f9d9fc9ffb089e081ab95d41232be5bd998fdfcb6995816141e46289f7fb15acf890bc97ce77fb413c8a56424a411dcce03354d093186

C:\Users\Admin\AppData\Local\Temp\Isle

MD5	c7edd1b120ffd89a03bb13f43248c03f
SHA1	70cdf64d0b1f9ddeed567599ed2b4ea6c0fad204
SHA256	84e53bfccccd03c162214a5b47741945c029afd23ec7ca307f1a66bc292ff3f8
SHA512	9d760c5455f7daa4ee1aeb3070d33cc43ec933f843333ae9d89f15d62f3840939bb83ad39420bf3fc9f800c8dcdde3f39085e7fcdfbedeeb999382ac1f9e75e2

\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

MD5	b06e67f9767e5023892d9698703ad098
SHA1	acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256	8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512	7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

memory/808-583-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-584-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-586-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-602-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-603-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-604-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/808-620-0x00000000009C0000-0x000000000110A000-memory.dmp

\ProgramData\GIJJKFCGDGHD\nss3.dll

MD5	1cc453cdf74f31e4d913ff9c10acdde2
SHA1	6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256	ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512	dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\GIJJKFCGDGHD\mozglue.dll

MD5	c8fd9be83bc728cc04beffafc2907fe9
SHA1	95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256	ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512	fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/808-621-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-644-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-645-0x00000000009C0000-0x000000000110A000-memory.dmp

\ProgramData\CBFCFBFBFB.exe

MD5	6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1	424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256	376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512	d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/2412-671-0x0000000000400000-0x0000000000913000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	8886fe9f85102a888c11e56c791d3de4
SHA1	a78cee5b29a8250f6f52d82ac1fd251b180103e6
SHA256	60c3821bdb39d7a0b30c4a09de8b5a38df511c6bb5e6366c65cdb51796daa913
SHA512	b433674de8936f0d1ff2e7924998b95cdc5971e131b0410415f0810e518a0ff60695ccc08e569d3333483054e3d6737702f6f837ac996ad25a61f69c202ed3a9

C:\Users\Admin\AppData\Local\Temp\Cab85A.tmp

MD5	ac05d27423a85adc1622c714f2cb6184
SHA1	b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256	c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512	6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

\ProgramData\IJDHCBGHJE.exe

MD5	daaff76b0baf0a1f9cec253560c5db20
SHA1	0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256	5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512	987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/2968-695-0x0000000000400000-0x0000000000648000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	49aebf8cbd62d92ac215b2923fb1b9f5
SHA1	1723be06719828dda65ad804298d0431f6aff976
SHA256	b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512	bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\7471121

MD5	c62f812e250409fbd3c78141984270f2
SHA1	9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256	d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512	7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

C:\Users\Admin\AppData\Local\Temp\TarCF3.tmp

MD5	4ea6026cf93ec6338144661bf1202cd1
SHA1	a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256	8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512	6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/2968-732-0x00000000738A0000-0x0000000073A14000-memory.dmp

memory/2968-733-0x00000000776D0000-0x0000000077879000-memory.dmp

memory/2412-743-0x00000000776D0000-0x0000000077879000-memory.dmp

memory/2412-742-0x00000000738A0000-0x0000000073A14000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\13da591f

MD5	8d443e7cb87cacf0f589ce55599e008f
SHA1	c7ff0475a3978271e0a8417ac4a826089c083772
SHA256	e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512	c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/808-747-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-748-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-752-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-753-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-757-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/808-758-0x00000000009C0000-0x000000000110A000-memory.dmp

memory/2968-768-0x00000000738A0000-0x0000000073A14000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d860933

MD5	f2b95a04ad134dbf956821903428b6a1
SHA1	6106e2425a95e052264ffd1f4babf36a559478a2
SHA256	3b258b45cdc63e5a93d9a4ec9bfb4b62ef0d831a6436b9bcf2f92d158f691bfb
SHA512	825fb3c8ee727aad20ba1f262d490e38b8e1aa558fd1f6d0f7246bf6da2113ced21413ec646a8acefe4ccd3da2bc71fff5bc470057c1d30f7ec42340be39727d

memory/2412-771-0x00000000738A0000-0x0000000073A14000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\15c9dbff

MD5	43fd7539abee20c7ff8e91f623174129
SHA1	45fa3285610a3cecf62b50646a908d9cae73328b
SHA256	90ffe94eb456030d89a9aefb9655e0d6b16bb4c31f9ec80b18b65ffa16bda7bf
SHA512	c4ed3da83734a7cc22a06ef33ae667646c938a96433a28589214ee71ac7659d4ad8006edfe8fbf63841ac0e3b1a16c0cb63d0ee90597891f83c6d31dd42a166f

memory/2180-774-0x00000000776D0000-0x0000000077879000-memory.dmp

memory/2752-775-0x00000000776D0000-0x0000000077879000-memory.dmp

memory/2180-776-0x00000000738A0000-0x0000000073A14000-memory.dmp

C:\ProgramData\GIJJKFCGDGHD\msvcp140.dll

MD5	5ff1fca37c466d6723ec67be93b51442
SHA1	34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256	5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512	4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

C:\ProgramData\GIJJKFCGDGHD\softokn3.dll

MD5	4e52d739c324db8225bd9ab2695f262f
SHA1	71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256	74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512	2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\GIJJKFCGDGHD\VCRUNT~1.DLL

MD5	a37ee36b536409056a86f50e67777dd7
SHA1	1cafa159292aa736fc595fc04e16325b27cd6750
SHA256	8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512	3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

memory/2752-791-0x00000000738A0000-0x0000000073A14000-memory.dmp

memory/1908-795-0x00000000776D0000-0x0000000077879000-memory.dmp

memory/1908-796-0x0000000000400000-0x0000000000471000-memory.dmp

memory/1908-798-0x0000000000400000-0x0000000000471000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:24

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

175s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-synch-l1-2-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-synch-l1-2-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	142.250.200.42:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	42.200.250.142.in-addr.arpa	udp
US	8.8.8.8:53	95.16.208.104.in-addr.arpa	udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

163s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-environment-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-environment-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	67.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
IE	52.111.236.22:443		tcp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	169.117.168.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

48s

Max time network

54s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-process-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-process-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

66s

Max time network

71s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description	Indicator	Process	Target
PID 380 created 3600	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Windows\Explorer.EXE

Vidar

stealer vidar

Detects Windows executables referencing non-Windows User-Agents

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Detects executables containing potential Windows Defender anti-emulation checks

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 380 set thread context of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Enumerates processes with tasklist

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\tasklist.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1604 wrote to memory of 1580	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 1604 wrote to memory of 1580	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 1604 wrote to memory of 1580	N/A	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe	C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 1324	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 1580 wrote to memory of 1324	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 1580 wrote to memory of 1324	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 1580 wrote to memory of 672	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1580 wrote to memory of 672	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1580 wrote to memory of 672	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1580 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 1580 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 1580 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\tasklist.exe
PID 1580 wrote to memory of 5072	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1580 wrote to memory of 5072	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1580 wrote to memory of 5072	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1580 wrote to memory of 1452	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 1452	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 1452	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 3856	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1580 wrote to memory of 3856	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1580 wrote to memory of 3856	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1580 wrote to memory of 1028	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 1028	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 1028	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 380	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 1580 wrote to memory of 380	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 1580 wrote to memory of 380	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 1580 wrote to memory of 3292	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 1580 wrote to memory of 3292	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 1580 wrote to memory of 3292	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 380 wrote to memory of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 380 wrote to memory of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 380 wrote to memory of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 380 wrote to memory of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 380 wrote to memory of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 3852 wrote to memory of 420	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Windows\SysWOW64\cmd.exe
PID 3852 wrote to memory of 420	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Windows\SysWOW64\cmd.exe
PID 3852 wrote to memory of 420	N/A	C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif	C:\Windows\SysWOW64\cmd.exe
PID 420 wrote to memory of 988	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 420 wrote to memory of 988	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe
PID 420 wrote to memory of 988	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\timeout.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Revenues Revenues.cmd & Revenues.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 366279

C:\Windows\SysWOW64\findstr.exe

findstr /V "RingtoneRentMicrosoftFocuses" Editors

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Isle 366279\m

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

366279\Suspect.pif 366279\m

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif" & rd /s /q "C:\ProgramData\FHIDBKFCAAEB" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	eijWYJUUWJTVUfljdtx.eijWYJUUWJTVUfljdtx	udp
US	8.8.8.8:53	theemir.xyz	udp

Files

C:\Users\Admin\AppData\Local\Temp\Revenues

MD5	774a97f2c63a28f5b795e0c7f3a1e797
SHA1	2ab25671bd5a2b253d54594301b765f171aa0cd5
SHA256	a08c17ffca06c08afa2bf6ee98a09c08a2cc22a78596497635cb372d644f140d
SHA512	e6c576edbfc972a9272d4fd969dc4e4f82f5ec61be2c526a1e2686cd4ee0734a649c78673f10efd3e3d9ae7b329a440adcd830fcb6bf3f53d30f678e001518d6

C:\Users\Admin\AppData\Local\Temp\Editors

MD5	c06b582d8286115b48f81ec53f36b383
SHA1	4f925d9b551cebda3f898ad18c62925979bcda7e
SHA256	70290025a0c87bcbd58ea8caf22e2dc0104e726ef3a7f9d9649758869def4189
SHA512	c98e48feca40abf3fc22803dcc80c3f7dc11bc8f3ff6fd03a3d733c1acf438294347169887bcbce82ff20fa9a6cbf0a0d94c76dc15bb5989093d1c2f7903864a

C:\Users\Admin\AppData\Local\Temp\Comparisons

MD5	4e292eb85ce9e016ff5a01c719c027c2
SHA1	61b3995398ed8390e8b8dc1a262eb94d55d6b80f
SHA256	6492ab6cd6f8f028f0824e026ed7c5401136f203f7de953bc60f61b32de4b41f
SHA512	9a19f0345059e401fa82e1d90a103438a04b579ccab2667d609f3d7c0764fd91553e6dda65e771fbf3fb059b0e460ad885c22cf39562bacd7e44b4e7bea43ad7

C:\Users\Admin\AppData\Local\Temp\Terminology

MD5	bc54db6ebb67ee3a2e3c127758bc2884
SHA1	4068d9984c207545e62ad464e2134cac265bf9f7
SHA256	8c1e83e582baf2b8232a7ab8e81a751b45d260f4ff01bab2e42783d0e24d6b43
SHA512	a03330c03209d8ef28707854fda4ce7b2b680a374d820d8e699ef980cc6b1e5548eec7c8c86608e3507b3490f38d61f067b25d99d725f10158b9837666aef3cc

C:\Users\Admin\AppData\Local\Temp\July

MD5	d71ce9af90d20d69dc3de9bc70f9cacd
SHA1	3b5737986225b7358b909f43a201d4872cd3a294
SHA256	fbbc13426ec699ffd56f6c53bc5e5259e25af602205c3d04beac1d4c578f85da
SHA512	85dfe8e9705b97c6a877b0785394171768dc33effa3a37b9969d35ead669172e6e4eb1357d8c231db778a0b37b2d8253b9e6d170e45959ba24a6b2fac868399e

C:\Users\Admin\AppData\Local\Temp\Bt

MD5	cf6a6e9c0b825f2b1ced20b4ab200db6
SHA1	8d1987c13c8dc1287f0eb631201ca6eee12b4cd0
SHA256	6e4b33cc9c80b969af96b31b1e95588f9cf79e3670951c63172d60d4e1324f95
SHA512	337bca6e3e8e323821d3767feacc10faefb52b4664968e99c1ab62a72f6770f41bc338bfb672e6602249266b141c4e99d004e48adcd87ea308bdec493674dfdc

C:\Users\Admin\AppData\Local\Temp\Ns

MD5	67546d73dfe4d66538a7ac7dc030238f
SHA1	1a3450f06ac594739db273e3eb0155018fccc88e
SHA256	71f45ed46fbd47494a7ecb9b31c07214d99133e35b974f5cf2beceabb639217d
SHA512	f3ceb864801ddb2d7f8298950dd76a0738ab4586796d16290c1c8c11579b9017a9b14c94341c24ac024f89a38e402c81903fcabaa2dddd21ca681af173bf5bb3

C:\Users\Admin\AppData\Local\Temp\Russian

MD5	91be5c23d6db4ea3e47b0259475cdd4b
SHA1	07cee20085effe581fddb260a65473c130e88e21
SHA256	8e6d9c7c4069ed6ea1fa346238ce48cf4479df04d1871e874f8c31e8ffede898
SHA512	e4f536a4f9b60098abd7212f82cacf6d9729a89c207a74a7dfcf8b9069a64eb024d60f0d506c1a50726d60c267222d200a50a6cc3a31a06ea1ef9ab3fce887e3

C:\Users\Admin\AppData\Local\Temp\Gis

MD5	e5e509038d8029cc95879ae96199093c
SHA1	18fceacd1cf5c57c6c2f1dc59a05906b740323a0
SHA256	bfa2b066ea73af4b0296b130a7c1927a4723864502ec646809aca415677844a6
SHA512	359d9dc6751abf5dbbede201409e77652f595f40148f987272aacb50e320c43562f93db179727d05120c7bb8edb45c3fb81c30aebc91422f33ca7c70466b34b1

C:\Users\Admin\AppData\Local\Temp\Wallpaper

MD5	98d91341d4e754f361bbedeb35242a36
SHA1	4718235cf9242f7250700af2a3411357d2a2525c
SHA256	42d670d3dd28bc4597b71a9373763029451d0da5efe1288c774f6b512fae9f0e
SHA512	1e877510d91e6f62790b7f15c7ffa00c31e18f24bc3ec72dcd63e9c2b0031817bbf87e1f9d3359f50dd25f1d6e53eeea61fc9331ebc58f88361fcd2353e32fa9

C:\Users\Admin\AppData\Local\Temp\Atlanta

MD5	05bf6c32a8d3cb1025a4e8baca686fc5
SHA1	e32584b21803cf8bed34367c8e4f34ff6104d6c4
SHA256	61460bebb1a3ada4d197a869a8d9637eaf03656b32509e5a4606240d06ab3361
SHA512	c93b4c23daf481e9ebcb8d19d1381e3a7ab49b1708e0340a9455a11fc26b3209577cc831e7610d212a0e677b8f6217855038b1cf0b2379f397549b92cbf89b03

C:\Users\Admin\AppData\Local\Temp\Roy

MD5	6310218145bc5ec965e5953fb0305d19
SHA1	b6043e6b47ea99b13efea5b2b7c523248379f6af
SHA256	ae7d0d86b3505a9c5c40bce3fd2554102e4f7d21aa5bdcc10451ce1019606629
SHA512	ae82e5721644c9f51852c5973dec9e250b83593b4079c7d3360e55700c75e43f9cac36de508654831c37e4d4ffdfcc8aabe8d681bcfd7a3a72d8d3f3df0fe6ec

C:\Users\Admin\AppData\Local\Temp\Pda

MD5	0766c0db71d9a82456e72ca071518676
SHA1	be36286b20cc0aeff00bdca079dfa9f4047e1ac0
SHA256	5553cf5ed1753ab9749bb7f3057f0db8cb9f19b8f673fa977b038ca0fef8b3d1
SHA512	032dad0b91b5482d5d1e558ba9e4dfea6f16c71725d21865f411f888fe631628f7a16a3e9fc367d88c02fde7f6ef7fd56a717c23feb45eb1ff5968605fb7fb77

C:\Users\Admin\AppData\Local\Temp\Pct

MD5	5021070dbffa36d9053699bee3f88806
SHA1	00ce3f117ffe45372c27af5f920ebacdeac92f93
SHA256	41757cf277d0f40e48e2bfc6d963db78308fdfe0b054f67685e2a6473e25327b
SHA512	628268ba6d7c30f1d03f84ff3955782ed23f426645fb8a914b83514f1de9ef23b5060f57e8c6f38dc8071adf063971f050989cab5eb2ef300072ccb58bd7183a

C:\Users\Admin\AppData\Local\Temp\Colleagues

MD5	8a6af62b964e899f2fdb5b08bb70fe1d
SHA1	74d97553398f4952fc7244db53a54c5c9418680b
SHA256	621b098f227833dd3d62d4b181bf751e76d9688237ae27ba4475947863775103
SHA512	be082ccae47ebb4bb28f9d9fc9ffb089e081ab95d41232be5bd998fdfcb6995816141e46289f7fb15acf890bc97ce77fb413c8a56424a411dcce03354d093186

C:\Users\Admin\AppData\Local\Temp\Shaft

MD5	4a29dcfa87b47e37e8b4447b840ccd91
SHA1	cd56012f27e7ece5545b6b07172f8f0169a852f5
SHA256	dbf049319595a1a9faf8c8dbc70814c4562c4b9dd10f18e56b0cb83e37cdce5c
SHA512	79b69684e7a72eb7fa24f36745f42370acc6655e44fbbd93dda679ed676c010a38a530b3b210196b6962e36ca1756fedb4341f867bdeb2e86c6ded23b7dde91f

C:\Users\Admin\AppData\Local\Temp\Word

MD5	ca2ac61ab298e06c4d8f07792708705c
SHA1	35547141d3593d89746a4de38e809388de7b224f
SHA256	cabef77014cb90d5e896c046830742852edb20adcd1da71f88f8f8805d476607
SHA512	c6f0fccfaa08ef6f4d17698eb07cf27fa116b94bab2a25afe392acb2fecb1fb9d58301288e80839dadf834245a614846d72d1243693b40a56d7be45745f90218

C:\Users\Admin\AppData\Local\Temp\Tomorrow

MD5	b348e7db88d0e52cfb6c7adb43628390
SHA1	5daa60ea78be614a992e88a60b655601cb45ebb6
SHA256	fa61763479671d7aa59798ccd20a2ae48102e24f2fdbc11e753c2141b3e0d135
SHA512	9d3018d203bad94e6a6efb2f5c5dfb55b14d5a6e1885cc60a34f0c647771cede2626e448f2fc194e3d17795c97ebb0bf283cb2a24a7db71f5e7fd15bdab01eff

C:\Users\Admin\AppData\Local\Temp\Serving

MD5	d0fa08b94bca138551c4b274ade27a75
SHA1	acaa349e9d6f03d622c2f0280247a43fbc078f3a
SHA256	4e9de0fd78447786652a61ab8339253c2ec4c671d3a9dd956d3aca384a7ee4a1
SHA512	bc17fd7b4b79f96d7adbf35c96919c49ace59ac0e2807fb31e7e88871218b5f0ad6f9183087c451675c16f24a16ed278fa78b325a3b631068e2fee16b3a84622

C:\Users\Admin\AppData\Local\Temp\Talk

MD5	bb769ef1b8aa0b58d0b94c4804bcd418
SHA1	e6f4dc5a736038e5604e282046d1234ccabebf68
SHA256	ae766919ddefe1340cea9b4ae3acfc041e8d079baa7fcf7dca59dfa3330c2d59
SHA512	2d0e600f59a545b1d19f299a8b756bab334b02be8e9f6e1ff2d3f64c18362bcb60239b0786358023728be88c8e033219e9df500d30b3121921d356055c60bb05

C:\Users\Admin\AppData\Local\Temp\Shares

MD5	8715208e25afa7a73918e84ee8b27f50
SHA1	61935bc176db5586053d1d5a22dae8092e6a3f7e
SHA256	f0eba5c2f4c9998b0a491a7ec4fc953e601235709b3536ba1a928e8d5021d3f1
SHA512	461d9e809ede59c71cd7fd9aa90a8ad991c5c9504d5c9c53659604e7e0e25b02d2135fbc0b2c4ab0e4a60bd43c38fa1109559d5f19f58a387dbe8e03424230c8

C:\Users\Admin\AppData\Local\Temp\Broadway

MD5	abfa29a29931ff6299126aed8dd08859
SHA1	c436e000edcc042f7f7889950a610c94d590d36c
SHA256	dd57cfa1ec84ac01cd4aab6dd18046b3a49daf0445ae29d6695c4a25c0bcd59d
SHA512	c0941a5de5fe072ba81b41b555ffdb59c6e0d2b9bed66a0cbb899699c38792cda0bb9857ab0752dbe0b3c966688ccb523989677803bf637675ec435a8c12406e

C:\Users\Admin\AppData\Local\Temp\Thus

MD5	08c077a34051a75c2b915a517c5d7d54
SHA1	ecb5cef32ca27ea5542b7416bc550601721f4a32
SHA256	3ed1a12fde96bc80c62d54a0647000dff23a63b987fe8c3faa9e11b4357321a0
SHA512	8746dae03892cee35b1a4463a7765399f2d1d1d989c53d0881043991c4187f7b4b1765376c435ff13722ec6dff2da98287efca0b335508f24d6f1805034e0f70

C:\Users\Admin\AppData\Local\Temp\Marcus

MD5	16fcba5d9aed0ef000c886f56cba85ee
SHA1	22584f6b7227ea3e0898233325be3ecb3c7bef6a
SHA256	35d270b74aa68781c8e0bc3cd008718ce362fe9fd32c9ba1ad52b82fe37d07aa
SHA512	7beb4a5207087b0e37f16df84702e4cac8699f951f6a92c7185bc83582766a43ef18bc93af24827793951f2417dd39bdf0717876f75f32feacec93fdfb2896f7

C:\Users\Admin\AppData\Local\Temp\Objects

MD5	f2f3a8cb98474080fdcca6a39b6b3915
SHA1	49f7327ca65d969203be51ccbf9f4033579923d0
SHA256	ca682c8dcdca30548120b6d3194eebf36a9208bef0e9b611da828bd912a38260
SHA512	cde92ed6e3ad806f0acd220990b46168862511222ae3667c62084f93622cc7ba2e91ed3b1e489f5721b8eeba9fc25b5a718febe3718c1afb74fcc6b4f8c0b1b9

C:\Users\Admin\AppData\Local\Temp\Gc

MD5	f446974fde635cadfcc03c9a25fd3780
SHA1	b59e1202f13139f21db4274d65ac51d2a0f8b856
SHA256	5bc7072917151653d7c40e272d8a95a86bbe7ad027eb30a811331a6f7df7ba51
SHA512	cc1a13562df99e2e2a240ad8d8e8d948846c6c5be0c995d87785e3cf73b54824ee7318c423972ea362dafbaac986f19d0117bc7e5192af5a2ff9fc8430bcc1e7

C:\Users\Admin\AppData\Local\Temp\Wb

MD5	901d26287ebe3e866d15b610764c49c1
SHA1	13793e6f446a09511642a4f3085cb029a4b853ff
SHA256	c74030e343c6fde4a1f1cf54010c186f9e80b457662bab5500848597c2e19504
SHA512	19ae02941a1a17cbe12c653b3067e10e91e5fe8dd73e0ff2373355eb9ee41af3767ae06885a3fb35bb06e411ec8ac0f291d24e717c01adfcb802539b3cf1f15a

C:\Users\Admin\AppData\Local\Temp\Choose

MD5	fb2cc8e690d82366990f2f20a4a5ab75
SHA1	5556232996e954f981144129298e298c75f8c2fe
SHA256	51982155baed7d5006ebc4446a417f320f8d754ec99911fcfa97ee5d37ce7756
SHA512	e8ae811d270bd2de39d0578e84b0001bffaf34969a1fabaedbe804d96eb79919c13578f41af339ce9af26f5cb6cb107bd6d79c1af9aee8a9e359b4b885fde823

C:\Users\Admin\AppData\Local\Temp\Arg

MD5	d4c42c532dceb34e65d7defc682e77dc
SHA1	7584981bc314640ba1b92da552ffeaedc4ea3a21
SHA256	3e7706b03275975037e49a1a7f29e67bce822086f90630948d9528d9c4b68182
SHA512	67ca5bf547b9bda235c44166681cac7e12515fa49b78ee8d7f564fc094c1509e8fe2f2f029a99ec96ab1fbfb1b9c2d501e4e1d65b4855b75639f2974ac804a4b

C:\Users\Admin\AppData\Local\Temp\Isle

MD5	c7edd1b120ffd89a03bb13f43248c03f
SHA1	70cdf64d0b1f9ddeed567599ed2b4ea6c0fad204
SHA256	84e53bfccccd03c162214a5b47741945c029afd23ec7ca307f1a66bc292ff3f8
SHA512	9d760c5455f7daa4ee1aeb3070d33cc43ec933f843333ae9d89f15d62f3840939bb83ad39420bf3fc9f800c8dcdde3f39085e7fcdfbedeeb999382ac1f9e75e2

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

MD5	b06e67f9767e5023892d9698703ad098
SHA1	acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256	8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512	7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

memory/3852-580-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/3852-581-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/3852-583-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/3852-584-0x0000000001400000-0x0000000001B4A000-memory.dmp

memory/3852-586-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/3852-585-0x0000000001400000-0x0000000001B4A000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

49s

Max time network

59s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-timezone-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-timezone-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4080,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

48s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe"

Network

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-heap-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-heap-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240611-en

Max time kernel

147s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-multibyte-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-multibyte-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	72.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	169.117.168.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-processthreads-l1-1-1.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3644,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

49s

Max time network

55s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-util-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-util-l1-1-0.dll,#1

Network

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240611-en

Max time kernel

90s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-convert-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-convert-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	68.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:24

Platform

win10v2004-20240226-en

Max time kernel

131s

Max time network

173s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-private-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-private-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	172.217.169.74:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	74.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	95.16.208.104.in-addr.arpa	udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win7-20240508-en

Max time kernel

119s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\HDHelper_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

49s

Max time network

51s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1092 wrote to memory of 1492	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1092 wrote to memory of 1492	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1092 wrote to memory of 1492	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1492 -ip 1492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 600

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:24

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

175s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3384 wrote to memory of 2680	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3384 wrote to memory of 2680	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3384 wrote to memory of 2680	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2680 -ip 2680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
GB	172.217.169.74:443		tcp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	13.107.253.64:443		tcp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	27.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240611-en

Max time kernel

122s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\NvStereoUtilityOGL_[1MB]_[1].exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3384 -ip 3384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3384 -ip 3384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3704,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
NL	52.111.243.30:443		tcp
US	8.8.8.8:53	29.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win7-20240221-en

Max time kernel

117s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe

"C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\VSLauncher_[0MB]_[1].exe"

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240611-en

Max time kernel

91s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-core-profile-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	139.53.16.96.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240508-en

Max time kernel

76s

Max time network

106s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-locale-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-locale-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	52.111.229.43:443		tcp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:24

Platform

win7-20240611-en

Max time kernel

117s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2784 wrote to memory of 1728	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2784 wrote to memory of 1728	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2784 wrote to memory of 1728	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2784 wrote to memory of 1728	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2784 wrote to memory of 1728	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2784 wrote to memory of 1728	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2784 wrote to memory of 1728	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1728 wrote to memory of 2184	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1728 wrote to memory of 2184	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1728 wrote to memory of 2184	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1728 wrote to memory of 2184	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140_app.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 224

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-conio-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-conio-l1-1-0.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	136.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	66.112.168.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win10v2004-20240611-en

Max time kernel

143s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-filesystem-l1-1-0.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\x86\api-ms-win-crt-filesystem-l1-1-0.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4172,i,8447163055677043976,7218082390179600880,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	13.107.42.16:443		tcp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	139.53.16.96.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-16 01:20

Reported

2024-06-16 01:23

Platform

win7-20240220-en

Max time kernel

120s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3048 wrote to memory of 1028	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3048 wrote to memory of 1028	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3048 wrote to memory of 1028	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3048 wrote to memory of 1028	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3048 wrote to memory of 1028	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3048 wrote to memory of 1028	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3048 wrote to memory of 1028	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1028 wrote to memory of 1284	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1028 wrote to memory of 1284	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1028 wrote to memory of 1284	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1028 wrote to memory of 1284	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\@^NewFile_PCSetup_99553__________^$\vcruntime140.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 220

Network

N/A

Files

N/A

Sample ID	240616-bp7prstbph
Target	9bcb71d1d6693753c79d1635b5caaa7cf4d189828397434a4799c2de9b454d34.zip
SHA256	9bcb71d1d6693753c79d1635b5caaa7cf4d189828397434a4799c2de9b454d34
Tags	amadey stealc vidar ffb1b9 discovery spyware stealer trojan

Malware Analysis Report

2024-09-11 16:07

Table of Contents