ace42bc61959dde6abbef1deccb2474f97bc8790f86b853638cf6b9cedf7092c

Resubmissions

26/06/2024, 00:05

240626-adg5asvckn 7

26/06/2024, 00:03

240626-ab6d4svblr 9

Analysis

max time kernel
361s
max time network
362s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

updated_executor/updated executor/new8dh4h4g4.exe
Size

3.2MB
MD5

16c6223445656672a11d8caa3fe5b501
SHA1

9f5f3a0c19f55eb9096849f8cc28a72c68384b4e
SHA256

e788e5d436739b8e4250b049aac61baf7c37710683c59f1c9203bfc1ba6e9c54
SHA512

657412ad28ae1e5256705a6ca6d40d5b3a28d91332521154b55d42c56e946a65e77ac8d7b4def2256718ff5b9ca71a111f47ec074a7bf7a6fb9fc0ee3b68c40a
SSDEEP

49152:cKoECNaxzUgP6yZMcCSIxIGMCgbRahL45jMyhf7nhNkEf/TJs7Swhmz+ODytrogz:GEBxzfPhecyaG7gbBjlbkEa7Sw2nOtv

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	new8dh4h4g4.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	new8dh4h4g4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	new8dh4h4g4.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/memory/2320-0-0x000000013F670000-0x000000013FF22000-memory.dmp	themida
behavioral3/memory/2320-2-0x000000013F670000-0x000000013FF22000-memory.dmp	themida
behavioral3/memory/2320-721-0x000000013F670000-0x000000013FF22000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	new8dh4h4g4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
44	discord.com
45	discord.com
46	discord.com
47	discord.com
48	discord.com
49	discord.com
43	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2320	new8dh4h4g4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003b9f8d164e9af16ea463bbfb7a894e19423abb24ab7ea6ade51538157f782539000000000e80000000020000200000005b1c4b2a8b9e53785430a54a0fafe77a6cfc37b10f2fe979acd15595894ae7ac90000000ac7b3befa47047dc400096d3bc0bd240ae43f1025a9a7e72733042470ed577016eee650292d3f2f0982eb114eef78ff65df66739549adf9f36cef7ec109ad6dc3f04c4ac2d6cbaae14dd954f96b6fe6fb31ab48ea65358b06387f2aaae30f72294078a3325de830cc59a2f2bc8a47e79a8265fd973a3c0fb21cb3d8cdcb2dc6135da884e911b1912c5f6920a86b93464400000007ed7cc7b40b451f2568bc1224945c132e33e9296b910cf7a98d5feecfec7f773140582c402e08c683ab822c4d641c510f1a7f6c7942b412ec3dd42e36940927b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425522074"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000090f7145301016555f1216f78aaf19857a09391c239d4e1fdf764e3f7d836b3e7000000000e8000000002000020000000ba1e08b25cea10941da611887882e8d260588f2e675c9196fc619d3730919d4620000000ff8d17aa8d0db5d23c57319999b8ce1d9cd368a363055ae64d72773b98672a87400000000d6002ae8a893ce04c822034ae65c5abb7570806e61f8a687d58c5172ea80073a7c9b2a6c4f1837965e33001af8b1b19b0c92aeadfd3410ef6bb1574bb48241a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805b0d585cc7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{832D26B1-334F-11EF-BB21-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83344AD1-334F-11EF-BB21-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Modifies registry class 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	new8dh4h4g4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f44471a0359723fa74489c55595fe6b30ee0000	new8dh4h4g4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	new8dh4h4g4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	new8dh4h4g4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	new8dh4h4g4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	new8dh4h4g4.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	new8dh4h4g4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	new8dh4h4g4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	new8dh4h4g4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2320	new8dh4h4g4.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2320	new8dh4h4g4.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2076	iexplore.exe
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2856	iexplore.exe
2856	iexplore.exe
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
2320	new8dh4h4g4.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2164	2320	new8dh4h4g4.exe	29
PID 2320 wrote to memory of 2164	2320	new8dh4h4g4.exe	29
PID 2320 wrote to memory of 2164	2320	new8dh4h4g4.exe	29
PID 2164 wrote to memory of 2076	2164	cmd.exe	30
PID 2164 wrote to memory of 2076	2164	cmd.exe	30
PID 2164 wrote to memory of 2076	2164	cmd.exe	30
PID 2320 wrote to memory of 2932	2320	new8dh4h4g4.exe	31
PID 2320 wrote to memory of 2932	2320	new8dh4h4g4.exe	31
PID 2320 wrote to memory of 2932	2320	new8dh4h4g4.exe	31
PID 2932 wrote to memory of 2856	2932	cmd.exe	32
PID 2932 wrote to memory of 2856	2932	cmd.exe	32
PID 2932 wrote to memory of 2856	2932	cmd.exe	32
PID 2320 wrote to memory of 2516	2320	new8dh4h4g4.exe	33
PID 2320 wrote to memory of 2516	2320	new8dh4h4g4.exe	33
PID 2320 wrote to memory of 2516	2320	new8dh4h4g4.exe	33
PID 2076 wrote to memory of 2796	2076	iexplore.exe	34
PID 2076 wrote to memory of 2796	2076	iexplore.exe	34
PID 2076 wrote to memory of 2796	2076	iexplore.exe	34
PID 2076 wrote to memory of 2796	2076	iexplore.exe	34
PID 2856 wrote to memory of 1404	2856	iexplore.exe	35
PID 2856 wrote to memory of 1404	2856	iexplore.exe	35
PID 2856 wrote to memory of 1404	2856	iexplore.exe	35
PID 2856 wrote to memory of 1404	2856	iexplore.exe	35

C:\Users\Admin\AppData\Local\Temp\updated_executor\updated executor\new8dh4h4g4.exe
"C:\Users\Admin\AppData\Local\Temp\updated_executor\updated executor\new8dh4h4g4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://www.youtube.com/watch?v=Lv6zuJCMiTY&ab_channel=CocainaFivem
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=Lv6zuJCMiTY
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:340993 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://discord.gg/8ySfCmk7G7
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/8ySfCmk7G7
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2a21543bf43d69195fb23824b078d66f

SHA1
b3c544fb543f2f9422f5629db42d746f51aced67

SHA256
18e92ebb53137df616cf8f1fbdfaac762367fd2173d5aeea3cbc37e3aefe263e

SHA512
ecd6edd88070d026c35610c2c4638cd6eeaac1fe69e2a6ce7d15466eee3e0ac8ef1e4353a86cf67b0eef75fea12ed13859d8be90c9ec236ccaa34c887c515ec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72165f3439948beab741395b2c42871e

SHA1
fd8f67617f04c31a65cbf6bea69ab7457a4081b8

SHA256
71b9e38fdce5d804a8dad03da59d1bff1f8d2678dfa0bd54fcdcf0678cedc886

SHA512
4ec6e4dc62883b1ca847a9daf2f7eff1d274dfc2d3450f104560171b462b769cb1bbc54e01b71c88f3fe78d416367ba55e40ff49c2ce4116c33d2a4f487e5097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
814e3a6d9a5feac9ca749a00932f4cd2

SHA1
275ac0dfaf07d4061b20c970f2c1e25c5797c43f

SHA256
a89b3a9404f94418b3b3d0234bf7a8392d9d3b3af2a1fffddcbbb2f548a54dde

SHA512
ea6d73bbdc046ff6e9d2abe04d4b0906a3d2ed37a01e09c98df56e498d1d73abc0099e6ee2cc4721f790b65dff757b05ba0f91664c00d2061b57a3afc050eb18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afb5d897c19d487872ba7f0df73a301c

SHA1
00a35520f748d1d20cb25eaf6758b872563c9bc4

SHA256
ecf9aff33a2412ced405771e16c0e81ccb8bc9caf768cb4c9b84521902aaaf44

SHA512
345a706ee8d2bafec1e3fba9848f765b22788de02d22b4f2c3a218dc5caeea03ecf65067e2bf089774017833b0c19a1dfed1b4ca9df83cf8f034a2975d1ff35d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4c9b6f0eb51db5350463bd5c63cd889

SHA1
0b77a5664f2c03acdde9f89ba5300e74b6ead8ff

SHA256
16bfb6fd9ffc561a2a41ab2b035485a2229cd9e6545bc1b6f2a61b564600cc70

SHA512
e25d0a96b150eeb354ba0991d0da02fe85c09e6479ac0d0efb50ab6a6c406a705f4dbfb8603df55ce7af072f46fbd91bff8b72085a74cbdd231af8d418600cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
046c9471eb9e56b0c6739a2305277e21

SHA1
82cb1ea41d198064f17dfa3d7c205904fa03134d

SHA256
da5e524d18c8b669a0363736010a7b61139ef100273fe8a47692f640bc9d2202

SHA512
4dfff7439b6eeb6660c4995db96bbe8381c493005e83e71b668eaf9071291a54265726d1a976ab4d73f6c8d90a21b246a254e8cc29b242d691865b1cf25b1cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
440f070513c347bbb57e2c7bb3d30ac4

SHA1
12053aca7829c1500ec3e2e27e72113af83ceeaf

SHA256
75198fcd4b723067f48b9084d344b6e78b96a6b7769e1b5dad7ede0ece7b29e8

SHA512
f6500ed3dfdaf3b501325f169db2a69bc19a4b57f7306e9f4a2c1eae2e8162ce6d2d58fa23176fbe6e0879de3a0821aa43872758b8699a1253db2f13e2d1a3ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
374fe57633fb2bd178446038d7148256

SHA1
ba209dd026fbe02878a3e9e4fb5365da8743584d

SHA256
ec5d27ae0c28737781d60c32da7d4d5959c48aa14c90a6fdf54ddfbb3ebf208f

SHA512
66b2c5b9b5edeeaf82268dd32369ca70f488b89c753c2f72220a8ecfe4c3ef65a169b82584f112a015b6c71570ae46166ad6967f4589a0fcff3e88b866f20e9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ec15d4270148f7df99ae6f9b8f172dc

SHA1
44cb5b2dd43cfcbfa95a7841629e84368060797d

SHA256
9e7e997ca885f3980d028052d339725797c9a8a995ab78a2f7b523718d87d971

SHA512
206c667f57854f37e72cd0ab5a73b5926ce8dd13375206ca69d2c4d0a3e36dc1feba0cb7b64a1247b7cb502d12ace3e18bbe2739ec0711183a2c158c7888640b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d69e6d308296da1155bd858352378d00

SHA1
c406c7c67fbd324ea6c5c97282415f790ff38e19

SHA256
31f26df10ea913bdab0ae4a28b6a437d4f6be2bacc4fddb4aa9ce1857fac7446

SHA512
719736adc2312d00d3bb43563bae886523e5052894fb913ded2cfac912eb42e09757af9d2ef64559825cc6f175441737deadc9473a362c0013f52ac3aa1586b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de48b8de019880f04ff1d89e7a47282e

SHA1
f703ffc39e3e5eccf3e76557f7af1fe6a635f151

SHA256
188184f520267d6123218d8c984781e4e5c635003901ede87f0f921813c8e4c7

SHA512
d43b68efeda18a15fde447fc84130f487cd93dfc1791ecbc073f439c0c188ac64f6dec368031aa3b01b3524d46a27b5ee2a27b2b40be478c7084983a7a237eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
123c4a6f6894793fe9feab380c41e218

SHA1
39a08de2a8532167abb148ec83c5d26dadf50e06

SHA256
bb2f99067a24c8f534d8481101aefe8ba0a2e1dfcbbb68bd4526014cc524a740

SHA512
3d9274d050c69c4079908b721b2afe3236e7e7a003758af610d48fed5434ab27a4cba219845e6c4620e39a83331594165f48869df40aba6518b69d5d2be7a67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bda23f3ea9fad46b550aa5be162daf24

SHA1
2fb5dcc04ba5647706ece908f69db1b9cddc1620

SHA256
9c5ea7f6a7a96109cf3134eb48802555e53c522f6d10bd2a458857468f4844bb

SHA512
e2d9d0b62b32d0e8cdf3f68d20d3028996a871872860eb123285820193ab45a09562f29bebd38aaef31ec578021d78aa2ca0920311a80e996f9c342b1bf69885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2aadbce05d8d65c00454d59a8c4637f

SHA1
514a65387825ef030680f0dc5fda38db32e0d4ad

SHA256
2af12f2562a5aa4e405bdff183d10580b781e025c2c5ea301ee86b449b5d6c92

SHA512
194a90fdf7cb017b4d2df48eaa56d4a030a4213a804bdf56a8ad6eb9428267ab50977ff18f5e43d84e7d42f595f093a065a9e7bb6f3dc3a8ecb50393c9df41df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa659d5fddab65af42a29bcd37d1e8c2

SHA1
42800cfb6ae6d6dd2284a89ec14786dbcb889167

SHA256
993e159fcbd8ecce99bc231315a18049a5fa5b7c2ae9f8bfe45cdd6954b76c9c

SHA512
3c7b417c87adf66568ba2c91e5450b174cba6238560d559f398486c268245327c560411391fe1aac6329664515b3dd537126e8e4313d9723eefe543dd7a1fcf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a47d558d77353105aa7eb2b381f26e17

SHA1
27d12d5c33bfa40ac349859dc5cb282214d90e56

SHA256
429768151dc0a35ac76d99ebbe614a1b52fa7acea82b62aa1ab52ae023373e19

SHA512
88e4e711b5872ece3cd34d22884706371b5bbd52f81d0d35198b9bea8d84d64b490ccf4372d964e31e19844c9ab57902dc74ee3600a7ea38b368ae86774028f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
874fc09f5d835ba63404bc5206771a72

SHA1
e17e0bfd48d208cc5c99c7064bedae6aed76e05b

SHA256
2961f0a2f700035ccb9a53d96b12fa8e95c70940956855c603aed03202ef466d

SHA512
5f5031c1576a3a833c987422a0684fc95ab8893b7b743b19e612a81830ad91d65e071a2fcc456e95adcb71531a0c9b9fb22f3a6e6b4a0a114663e878907d87c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
201b445fd9522993bbcb97c3093573f4

SHA1
75606e450c15772a13eec7b0df297ecde527f9cd

SHA256
11eec6d6daac9d51b877ae5ec0643ec82ee6af57603578dca4feaad743faca94

SHA512
38c800c6b34c73d2a3da94447eb5cd4e2620d36b78877c5e7a3346401e2c4eede9265b83f990b8c2c98f9a337b1b18bc670b87e0236c53569ca4a1d5742728a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16c51d75eef6e4bbe63f7f2c50d5ca65

SHA1
a532512b35c14c317e64b47fefc3a952f6e4508a

SHA256
b001393dd05309a38f3cc1c434c43a453c211a34a4942de7d5952f7aa8310d65

SHA512
8c0d5a517d6d252be29b94c090c4755b09da479aff6b7568839d6b96318eba03bdd525badc14be2321aeb6bf6ee9f5d39b81a91a37da915c277e763906a88d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
001038a03a8b4254e41520cff78fe7c6

SHA1
8916bcd2a5cd22ba089233e8813d1578cc97dccb

SHA256
c83de586538b2166ce16418a0df62b5f40b4e45af9b20e20d73052f1244ff9fc

SHA512
55db54df9447859fc188925035d34262e22aed62e7bfe4f49a07ad4a06a03763ad938d2dcbd8c1e0aa477e5307a0b1c722d24eaa0336f2745829def8d2b7344a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a04800a1954d8dd430cf76f6c8d3d49

SHA1
07420ea46501f603a97a299a6a4f49a623b38f11

SHA256
ee03774e1fb4bd0e56530929ba8a4b6603f6d3ee5e59c28734f9096d23ac693f

SHA512
c4e142657af73985a95bd606bc0eb420f75424a61b8974054aabd687e8cf888d41ba6a059fbbc1e3572e374adc58037d5d1b958be63ae69f57872ba30035f045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f78c53672b51c14afd17ee77b381cba

SHA1
f989b78c02d3cc15baa708ae765995a816a70357

SHA256
286987379f48c305f20591d022a6b9debf2c1e1f3061c183f357719e86de120a

SHA512
d46e63d0a4071a676743b616b32cc1f411ff52fdebb151cf7067cdf9728cbd98afc1c76fd92587bf93d004d726e46a9a5edde39325e000bdedeea25cb29e7525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2abc5a52d2da2a7dff0ca6af616c179

SHA1
649be35689386ba2a8d03aec2e320a3e444889cc

SHA256
bdd2ca44e8f31ee8ebb132a32a2891978efd7040007f058994ae73014d5d0899

SHA512
e9a8acf8ef2b32b9e2f765cb429f5a356dc0df99264f4e329c3fdeee2b83280f1422c3d435731ffc23a5fd714163baa33eb847d183f114afa01cced4b2b11f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4bc6af20ea534b02f8300a603e25f67e

SHA1
fa0aabe80f8b04c6f1ea40cff20722d5a6296ede

SHA256
b22ea194bf14a603d770f5a973263a3b061c089735550b0d2005e2c4225c799d

SHA512
93f013b5b31cee775b38d879416877a9470b19225ff9af3ad7674c12d8e61eb5f580d34fed6fd0365ff0288518a0eaf514aaf7f4851167bccd213df6504889bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{832D26B1-334F-11EF-BB21-6AD47596CE83}.dat

Filesize
5KB

MD5
8fcf80a67e9bb37d12103a4e22a3c1a8

SHA1
431ff95bf36ab66de25a0092cff30daa291ddef2

SHA256
4ac917cb1ccc00d38d31a46d3e7af1c1bcc6edaace5695698e8257110bf66b5a

SHA512
195acbf6dd63e0f676cd4317ce7445511127d7e72f1333edf82149d782614259545e4f321e1e02a9b8eab25e00262188fafb396e2c8ef614401893968ad1444f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\92mvs6j\imagestore.dat

Filesize
1KB

MD5
7f4b72a3c529d1a7427b02b754dd61c0

SHA1
e58e6fd4cfbd2a0d07c81cd45f15f8aeb53decf6

SHA256
1a1a0875fe69e5263183d75da95485671c32b20f1b9effdf3b40cb245da57314

SHA512
0ecaf5a89b5a7babb714474a7453fab7ae72a2239ad43dacf1f3e2955c9a34670e5cd2f2887cfce662d557e8a8bee73e0e062394826967b1ba59828a7df8fbdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\92mvs6j\imagestore.dat

Filesize
25KB

MD5
940703cb39e020f5283309f42485c440

SHA1
1183dab6a7d580c6c24442e88c0ed6e1cd7eafc2

SHA256
f87a463f1eff1c43691157bd18b3ab1840ab644c5cb4b49e546c99ef6286fac4

SHA512
928c7fc4a47cc1c0d0ea44c403ef160305df75d0e30b1bf348b068d1e4fb21a76a35c8bff57952a11445ca21cd21d6b9ff48aecb31eb72c9a213622278f74d5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\favicon[1].ico

Filesize
1KB

MD5
f2a495d85735b9a0ac65deb19c129985

SHA1
f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

SHA256
8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

SHA512
6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\favicon[2].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2128.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar212A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21BD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2164-23-0x0000000002140000-0x0000000002240000-memory.dmp

Filesize
1024KB

Download
memory/2164-24-0x0000000002140000-0x0000000002240000-memory.dmp

Filesize
1024KB

Download
memory/2320-722-0x00000000040C0000-0x00000000040D0000-memory.dmp

Filesize
64KB

Download
memory/2320-0-0x000000013F670000-0x000000013FF22000-memory.dmp

Filesize
8.7MB

Download
memory/2320-721-0x000000013F670000-0x000000013FF22000-memory.dmp

Filesize
8.7MB

Download
memory/2320-2-0x000000013F670000-0x000000013FF22000-memory.dmp

Filesize
8.7MB

Download
memory/2320-1-0x00000000775F0000-0x00000000775F2000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads