1dfe3f83136031270e0d10047557c532b49a874b77bc455d6c93d356349545c7

Analysis

max time kernel
298s
max time network
300s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RedEngine_Cracked_V5_1.rar
Size

1.4MB
MD5

134689ca0917e44a74d51a1a3c2a89f2
SHA1

43538701963c2366b7de676b1a13ea3580517a3c
SHA256

1dfe3f83136031270e0d10047557c532b49a874b77bc455d6c93d356349545c7
SHA512

4cfd9f93f64d93df43e15e5d0d47ac0f42c0ce832fe1745c7ad0e60809b39cb532040ffd19dd1fdb772fcb9147d8f2f215233ab1fe88c9608314c2d1131fc6a9
SSDEEP

24576:+KC9fMa6jR1ENRM9gzLxJKojLOVHbe+Aw7Oev+PKSXUMI+aWFNF2/f+tNy:+KCaDORX336VHbuqvxSpayF2/f+tg

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
380	winrar-x64-701.exe
1640	uninstall.exe
2676	WinRAR.exe

Loads dropped DLL 15 IoCs

pid	Process
2956	firefox.exe
1088	Process not Found
380	winrar-x64-701.exe
1088	Process not Found
1640	uninstall.exe
1640	uninstall.exe
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found
1088	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_259569455	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	winrar-x64-701.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WinRAR.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR"	uninstall.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	WinRAR.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	WinRAR.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2712	7zFM.exe
2676	WinRAR.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeRestorePrivilege	2712	7zFM.exe
Token: 35	2712	7zFM.exe
Token: SeSecurityPrivilege	2712	7zFM.exe
Token: SeDebugPrivilege	2956	firefox.exe
Token: SeDebugPrivilege	2956	firefox.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe
Token: SeDebugPrivilege	1640	uninstall.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2712	7zFM.exe
2712	7zFM.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2676	WinRAR.exe
2676	WinRAR.exe
2676	WinRAR.exe
2676	WinRAR.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
380	winrar-x64-701.exe
380	winrar-x64-701.exe
2676	WinRAR.exe
2676	WinRAR.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2712	2192	cmd.exe	29
PID 2192 wrote to memory of 2712	2192	cmd.exe	29
PID 2192 wrote to memory of 2712	2192	cmd.exe	29
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 1532 wrote to memory of 2956	1532	firefox.exe	35
PID 2956 wrote to memory of 2396	2956	firefox.exe	36
PID 2956 wrote to memory of 2396	2956	firefox.exe	36
PID 2956 wrote to memory of 2396	2956	firefox.exe	36
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 2928	2956	firefox.exe	37
PID 2956 wrote to memory of 1412	2956	firefox.exe	38
PID 2956 wrote to memory of 1412	2956	firefox.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RedEngine_Cracked_V5_1.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RedEngine_Cracked_V5_1.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.0.331519223\910377818" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9015ed86-98bd-4cf0-9d8b-a1fb7b820159} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 1264 111d9c58 gpu
    3⤵
    PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.1.1533606436\1479659975" -parentBuildID 20221007134813 -prefsHandle 1476 -prefMapHandle 1472 -prefsLen 20830 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8378e288-d9ef-4e8e-9d15-d1d9e8f260db} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 1488 e72858 socket
    3⤵
    PID:2928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.2.662760966\60831812" -childID 1 -isForBrowser -prefsHandle 1112 -prefMapHandle 1756 -prefsLen 20868 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ed892ce-8a5e-412f-aa46-9722d0314635} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 1940 1115f458 tab
    3⤵
    PID:1412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.3.759792027\438747466" -childID 2 -isForBrowser -prefsHandle 584 -prefMapHandle 1664 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bdda947-fb69-4d0e-892c-4391a1723c95} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 2404 e6ab58 tab
    3⤵
    PID:1756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.4.855144958\447465854" -childID 3 -isForBrowser -prefsHandle 2828 -prefMapHandle 2816 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45539e25-03ba-4d40-bb27-407ca0a3595d} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 2840 1b2d0f58 tab
    3⤵
    PID:2160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.5.1559865008\1826895939" -childID 4 -isForBrowser -prefsHandle 3752 -prefMapHandle 3712 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06b10941-5042-4aa4-b076-3b39c0cb8c80} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 3744 1ec1e558 tab
    3⤵
    PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.6.2052920654\2060793312" -childID 5 -isForBrowser -prefsHandle 3884 -prefMapHandle 3888 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {65bcfc19-cbbb-4c23-9094-513b417a6ac0} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 3872 1ec20058 tab
    3⤵
    PID:1840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.7.237089880\1474807008" -childID 6 -isForBrowser -prefsHandle 4064 -prefMapHandle 4068 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {851dccb9-9e43-44be-b895-b6bd19435210} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 4056 1ec1fd58 tab
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.8.845767644\1529688351" -childID 7 -isForBrowser -prefsHandle 4392 -prefMapHandle 4388 -prefsLen 26251 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22279282-d7a3-49c0-9d89-4534380131dc} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 4404 22722558 tab
    3⤵
    PID:2780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.9.453648121\848252778" -childID 8 -isForBrowser -prefsHandle 1604 -prefMapHandle 3160 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94f6017c-7cd0-492b-b517-61e9da9a965d} 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 4040 1eadb158 tab
    3⤵
    PID:2980
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:380
  - - C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system executable filetype association
      Registers COM server for autorun
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:1640

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\AppData\Local\Temp\RedEngine_Cracked_V5_1.rar"
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\Rar.txt

Filesize
105KB

MD5
b954981a253f5e1ee25585037a0c5fee

SHA1
96566e5c591df1c740519371ee6953ac1dc6a13f

SHA256
59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd

SHA512
6a7772c6b404cd7fee50110b894ff0c470e5813264e605852b8dcc06bfaeb62b8cc79adcb695b3da149e42d5372a0d730cc7e8ed893c0bd0edb015fc088b7531

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt

Filesize
45KB

MD5
1c44c85fdab8e9c663405cd8e4c3dbbd

SHA1
74d44e9cb2bf6f4c152aadb61b2ffc6b6ccd1c88

SHA256
33108dd40b4e07d60e96e1bcfa4ad877eb4906de2cc55844e40360e5d4dafb5d

SHA512
46d3fb4f2d084d51b6fd01845823100abc81913ebd1b0bcfeb52ef18e8222199d282aa45cae452f0716e0e2bf5520f7a6a254363d22b65f7ab6c10f11292ee2d

Download Submit
C:\Program Files\WinRAR\WinRAR.chm

Filesize
316KB

MD5
6ca1bc8bfe8b929f448e1742dacb8e7f

SHA1
eca3e637db230fa179dcd6c6499bd7d616f211e8

SHA256
997184b6f08d36dedc2cd12ee8dc5afb5e6e4bf77f7ab10f7ade9eefdb163344

SHA512
d823f2c960a4d92129b9bda0f4f9195d32e64b929082b5efb9149546b5053021255d1dd03cb443f0a03106314554f76b94173e280a553a81e4ac2ac282877973

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
3.1MB

MD5
53cf9bacc49c034e9e947d75ffab9224

SHA1
7db940c68d5d351e4948f26425cd9aee09b49b3f

SHA256
3b214fd9774c6d96332e50a501c5e467671b8b504070bbb17e497083b7e282c3

SHA512
44c9154b1fdbcf27ab7faee6be5b563a18b2baead3e68b3ea788c6c76cf582f52f3f87bd447a4f6e25ec7d4690761332211659d754fb4e0630c22a372e470bda

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9bot8sq2.default-release\cache2\doomed\13232

Filesize
16KB

MD5
0522b31f2e4a9ef10df63ab1b399f625

SHA1
dcd3b82c2f4a3aa99944f435ddc7cedcda971bff

SHA256
d414b57bf6ef223c1037fe9a32c4c2ebeeeb00640b95f6f6086235a320ba7751

SHA512
9ae1670d366175c51a35a8633184474f32d3ea0e3b6266a033feea6f335d6e97c86eee3e0cac8b51eb925d37e638d1bde9b875fcaf25eab70a314f8c26031716

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9bot8sq2.default-release\cache2\doomed\17493

Filesize
12KB

MD5
06db67f0e40e5c1e2fa95f336b7b55d7

SHA1
633dd9c20119bb1d0aa84c3bd359846da4ea1f5e

SHA256
2cdd181bbfea0e1ddcf8e3266b3fc7116f7a58801cff09b6fa6bc5cfb5686983

SHA512
6e3319f1a832e7e4993519f533e0e45afcadc5f0f5c913bbae5dbd0c84c4269eb84e4e181c3673b4e13258980d4fc7be80844ad9456edc7cb9393a8b444c9392

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9bot8sq2.default-release\cache2\doomed\22522

Filesize
9KB

MD5
e864a184721b0701ec5c5409de4ae7f1

SHA1
44cb6954f407797bf77b13f5c3f746ddb5c403f8

SHA256
e89d0d99b92009040e7fbd251b931bf2d195f65bce26dfb300a5c2af04a50eac

SHA512
29804b40db3d2f40eb575b2f7472e4e58886d3721bb5809914a59c5f74f45f74f42189dd700250886ad9ef7705fbf7bcc229cdc8cf481e078e11824693a66eaa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9bot8sq2.default-release\cache2\entries\79B0DDE3FA8DCB1BD2B4CA2ED3EB8F3088226A6C

Filesize
38KB

MD5
36d8ccd5c679373bf1befaa413a8710c

SHA1
7783cb9ab72554120dbcee78c28a761da766da19

SHA256
00c6f316607c1ef8cfbfadefe195b0992fca6165996267c646bfac40486b3acd

SHA512
7201b97691050eacf41f902574c9ccb6cef17bf6694373ecd3f4a781ed5eb67bb3d0a82de4529d7dda143a934329d39f2a92d296c6854e2713124cb91dbcf99a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9bot8sq2.default-release\cache2\entries\874F18BED7CB5132715B8A78AD866AC231B4B3F3

Filesize
18KB

MD5
0b24c79bde2dea6cec2e6daaff371df6

SHA1
de7c4b20677553376d73a878a2c6fb93158cfc84

SHA256
def9973a5195081b143423616499b2cef51da249279439323d044083ec6dfad4

SHA512
e988d3e440f9cf1b89e48b5395be624bd6fc1b3a16a0ac97cd3dee0c4272e347f9f3ef35e131f687f86b96cbaab5b7b2df5c9a2f208660c825dec6458f4e6c58

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9D8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6B32.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
a5649ffffb6814bca72cc94fa565d7a0

SHA1
a7fee0475adbd1b5dfbfb5b394b328ef3b32f938

SHA256
bff55ef50cd260ce25b18673c6815a4c1fd3cea4a432d90d874c510b09d44752

SHA512
228464e729513a26f11bc122613db263649146467958f359dd332450e086ab5da659608d8d5ef341b18540dc1adf982f3597dbb39c69a73af1facded7f4e5074

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
312c521b045ec659519680dd481cdfdd

SHA1
843bc4bdbcc15c91c8f5d4c59d3750b4f50250e2

SHA256
a5667d954dd25cc9ee8b748683f3f4c455085c23ab3f7d3209620e4cf3eb3833

SHA512
ea575627b162bc7adc8a01625feaea3ec7763c71787a94a60c79a1e79e71a79393bed51a30574adab20ad2b466914c86f6d136711d65de32efeea6816179cc6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\datareporting\glean\pending_pings\2ef91b62-063a-4a5c-9944-bbac73f5f4cf

Filesize
931B

MD5
187c7699584683a3b2a7dc776d69c255

SHA1
d62ab19e2d9df85a15b4f9107b0c0d0ca5fba96d

SHA256
08acbd0d0cd05f32414d0d4d23b5883d2fbe38cafe85ae864a845d64c73f575c

SHA512
32a483922db1abe131fb757ec46c8bf8e4067d1e834df51540d3a683e9fa3ea43ce7124a249d42c193a3c60a5ecf481bc009f509035eeb92105c32d043dad851

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\datareporting\glean\pending_pings\6e31a8cd-6370-4c1f-9db3-47ba22b15f7c

Filesize
12KB

MD5
1177c40cfc89f4efcdc46e61b7013e2e

SHA1
e44840f07be566262ef697611d07f21c45c6a188

SHA256
6652d5069d8714ce1a91ffd34a0860871b5b9250b3bb340fa53368d717e9c919

SHA512
2c1ef813079a5972924b3ccabcfc205bd34024ca41bdd74b309d5559d49dcd3c09443d45bead29c21f4238bf2e688b0dbce3fbd4e13418057fc77529cc06505a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\datareporting\glean\pending_pings\6f3adcb6-b111-4be8-9386-cd6939397895

Filesize
854B

MD5
46adb0eda6b006fe07c42fac26212fa2

SHA1
d56ebfa8a4976a9d2b10f53ecd2c310ba76492c5

SHA256
53b05f668a13ad129ad045bbd38a27be51228a283777df44c98fc4c846daaf65

SHA512
0f7627c89eccebc7988fd2753ffd0136f6b3d1ec30e63eabaed79e032104218a291f17690c137f7a80dfc2ecf0b8cbadcb59695a7e40dcf62e39b5e4d09558fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\datareporting\glean\pending_pings\fdf090de-277c-43bd-9a3a-1be95add1aa8

Filesize
745B

MD5
9e4063c12107f3f59fc919c98d0d7ec3

SHA1
06edc5a2555a3e20b6b0e55387bdb73eafe13946

SHA256
54ba207769a112c2a315fdd7f24c2755d6d17bab18577a64cac2f5321b65591a

SHA512
290ca8315f20af05415bde7743977d675873aa5de789994e67ee045556aa917be3557a72e57cd621b48247f8b22b64554ae53ff05ab701953d6055b496de42eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\prefs-1.js

Filesize
7KB

MD5
d342e14bb8a44fd21d497adf6bd670f0

SHA1
b8cf4b665a2eff138c0061b81ea8204985696737

SHA256
ef33afd4197e25600c5ad35678856ebf4e62f53b1ed57e1828b500fa8fc0eced

SHA512
266633167965060d983445dd67342a9aae79494335ac40279a644f07b8314dfa2e73b3c1ec096112be8d0d03031c14d876fec8eb7d29c87e97ca43bf8494d710

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\prefs-1.js

Filesize
6KB

MD5
8fac23c8ac74b40be0c1a674fe30dee2

SHA1
cb81faf8f54c7c738438b36cff3356de04f667cf

SHA256
4569d9225a7d5c86a08a14d0823afd22be79bacf5244bdca7541b25e12e8b83f

SHA512
5819e930f6e5fbeb7e1032e12450382223353a0f32f72ca4aad5a518f80a3a92ce33084a60d549cfd16e05c33ecaf4b56c316331d0d446b12d51a7bb9b69bc43

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\prefs-1.js

Filesize
6KB

MD5
28f1cc49d8c1e3de9b673077f46a9cda

SHA1
427ca943a6af2f6e6d4106cc60989b8c4c726f65

SHA256
51cd923740da5f4fb5b5494b3d0b63ca9a7712f312750bba4cd99161709b9ecc

SHA512
e5097eadfdfb1c1a42a8ba1e4ce7d0e8e72fbcff4effc7b725d0c59d830c37f043086e9ddd3704f08e20b6c567ff6d93b92481f2fbb8fc610a5d87fd6ddc76c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
aea90c12b98850eba7eedde73a47c387

SHA1
bdd9b7cfc6d31ba9db71d0a371136bb22e18d005

SHA256
5bcb7dd87d1c2df1b904ac46f399c83bd68b2e3575fba6dbb9103bde0a759b66

SHA512
c94596904f849472998ad47e1d77c64ebfcfbfceea7c5911d98932495579944716af6bb86dfe7b0a67e15f8a9db24d0759807c8143e641d133d6ac7245559bf3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
d980810dcd5d757949ff2ea90f9d3c4b

SHA1
fa8575ef05a52663a220b31b540fd278141c71a0

SHA256
b2e1babe0eab6b8becfd588c626a03fb6ebd29efecff7484b65fc591002c4d4f

SHA512
9d7d195cf21057ffaac1859f88635d4503681375e3fa330b030fe86b0bf10312fa8074155e168a17193d22dfcd1b8bcf50cd932e750890f889de2c882c86915e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
7788e6779e6b656e4ada086c54f82e75

SHA1
1bb715f1e0168603fe5e116cdded756dfdad048e

SHA256
773ab700870215b502072d5b65e7532482c830c55575ef1bbae85c9dba194be0

SHA512
82f765e22ec32d198cb2383f7eabcdb69126d61388cdad2f7b577f97a13235a0a741756a63fd37cf84dc489fc568a3f07f22cbeaf9cd3d9ca7722c91dfd442e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
f8586da9a48c7f68288f9dbfe1da5e1c

SHA1
05315fa3af10425fd2bbb7a03d52bed716e40e7b

SHA256
848e6e5f60d0540a180f8f115339809a89e64b07d3cf67562152923824c4900d

SHA512
3eb8a726184568cef84c0b641eb03b054520cfa548c30082cda48993262bbba63aa9716951d2d3abdccc35096d01cfbf090daec5174e29da751341689687930b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
698c55fa6c6786d7db1faa9a00fb4188

SHA1
e5fd42d601fd6ed202809e0898374bdbe358f40d

SHA256
12342a7d33e67efdaad68e93acd7f13be267099dcb5e941d87e74be7006350da

SHA512
758ecf85399bb3d5f2488f40edfa3a4ff8f7124ca54dbafa616756b29f4738a7add5293e0ba94ef4bf573058590c136f5d5424e5d26502447cd0e7a65caf9f35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
4f08dd1323fbadf2969efa2054da0e77

SHA1
be9f30eca69ae912977e7e9ac1a371b39240451a

SHA256
d20821b672b735a1535bea0a4a47dfe18ffdb6ffc82f82538e9cbfaf04418b13

SHA512
94c272b0951046a79306986729ffc9fbae38a1a4b17993414b6e3f13b9fab7816e9abd7a6c8ffb57d6a4a3cb4a197a753f7a433e4d6bc09e1abd622548595a6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
d62de51effc24d7f5d27691b059d2e20

SHA1
0d28425f1d571cb0ecc02352fcf803574b7d6fdb

SHA256
d6a0561b42dde9c319faf2dd12df9617bd762da01412ffe32c9441c6a2601367

SHA512
38d6d4ce7907fa48fee1f0a239e2f682796226a4b564a4437e476d16e6bf13009e3339bcaa368777c96757ed17f2c71c9bbe8f121cb22e50ec329e37c52df5ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
b5eed58a327ffb6914f4f635732fb850

SHA1
cc776b1f9ea48e86e298c86eb83e8a9ae0a22305

SHA256
8e91d1f233de3678a15e61f91f8acc11c05a6676a746773ee586d6cdf1fb1cf9

SHA512
50c5a3fa175d783f5612ff6c9802f7573547566712e407474921c83d34ef9c7fc3d5004aef5f5826328a6394e0bfb9efc4d7119a0e6278c3c1fd0e2a5140d569

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.DO7sdwPr.exe.part

Filesize
1.1MB

MD5
65374b2cd379b051a49125a9b36bcda5

SHA1
405c281006e14b7c6081bb602404303b8450a9a0

SHA256
39b48f199f04ef64897e707b6aa026631f34e6939c4a7064d2094b1519e7668b

SHA512
329f6d1ed351d1de677a1b9226d6fa2c077f650aabb8dc37aa6d9da4dcb35bb6fe867cf82b4742b9699fb5ae3c056a5d2fb91a5b8e185b8856198b2ff93b6ffd

Download Submit
\Program Files\WinRAR\RarExt.dll

Filesize
636KB

MD5
1e86c3bfcc0688bdbe629ed007b184b0

SHA1
793fada637d0d462e3511af3ffaec26c33248fac

SHA256
7b08daee81a32f72dbc10c5163b4d10eb48da8bb7920e9253be296774029f4ef

SHA512
4f8ae58bbf55acb13600217ed0eef09fa5f124682cedd2bfc489d83d921f609b66b0294d8450acb1a85d838adb0e8394dadf5282817dba576571e730704f43ac

Download Submit
\Program Files\WinRAR\Uninstall.exe

Filesize
477KB

MD5
4783f1a5f0bba7a6a40cb74bc8c41217

SHA1
a22b9dc8074296841a5a78ea41f0e2270f7b7ad7

SHA256
f376aaa0d4444d0727db5598e8377f9f1606400adbbb4772d39d1e4937d5f28c

SHA512
463dff17f06eca41ae76e3c0b2efc4ef36529aa2eaed5163eec0a912fe7802c9fb38c37acfe94b82972861aaf1acf02823a5948fbb3292bb4743641acb99841e

Download Submit
\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads