c8a496dcf94d5d246dec0747f139957709b63412f48d9a1591ca5e771a988636

Analysis

max time kernel
299s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

runme.exe
Size

100KB
MD5

b0feccddd78039aed7f1d68dae4d73d3
SHA1

8fcffb3ae7af33b9b83af4c5acbb044f888eeabf
SHA256

5714efd4746f7796bbc52a272f8e354f67edfb50129d5fdaa1396e920956d0d6
SHA512

b02b9476eeb9c43fcfef56949f867c1c88f152d65f3961a2838b8bff02df2383945aefb9a8c517ac78d79b5a9163c7677f5b6238f4624b1966994c9c09eb428d
SSDEEP

1536:ThBfyxwMz14BSSQGRwmkwmGDAzGC6TaPAlbv/g:1BKxwMz14wSQGGUDAATaPAlbv/g

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

runme.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

runme.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Rundll32 = "C:\\Rundll32.exe"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEX\DevicePath = "C:\\Rundll32.exe"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MediaPath = "C:\\Rundll32.exe"	runme.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

runme.exe

description ioc process

File opened (read-only) \??\D: runme.exe
Drops file in Windows directory 1 IoCs

Processes:

runme.exe

description ioc process

File created C:\windows\Program Files\Kazaa\My Shared Folder\Norton 2003 Pro.exe runme.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\D:	runme.exe

description	ioc	process
File created	C:\windows\Program Files\Kazaa\My Shared Folder\Norton 2003 Pro.exe	runme.exe

Modifies Control Panel 3 IoCs

evasion

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Appearance\Schemes	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\Pattern Upgrade = "TRUE"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

runme.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "kIlLeRgUaTe 1.03, I mAke ThIs vIrUs BeCaUsE I dOn'T hAvE NoThInG tO dO!!"	runme.exe

Modifies registry class 29 IoCs

Processes:

runme.exerunme.exerunme.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32\ThreadingModel = "Apartment"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellFolder	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32\ = "Shell32.dll"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ = "kIlLeRgUaTe 1.03"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe,0"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe,0"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe,0"	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InfoTip = "kIlLeRgUaTe 1.03"	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx\PropertySheetHandlers\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runme.exe\" %1"	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	runme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx\PropertySheetHandlers	runme.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellFolder\Attributes = 00000000	runme.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	2296	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2296	AUDIODG.EXE
Token: 33	2296	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2296	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

runme.exe

pid process

2168 runme.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

runme.exerunme.exerunme.exe

pid process

2168 runme.exe
2276 runme.exe
540 runme.exe

pid	process
2168	runme.exe

pid	process
2168	runme.exe
2276	runme.exe
540	runme.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

runme.exerundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2168 wrote to memory of 2360	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2360	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2360	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2360	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2360	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2360	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2360	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1888	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1888	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1888	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1888	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1888	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1888	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1888	2168	runme.exe	rundll32.exe
PID 1888 wrote to memory of 1860	1888	rundll32.exe	RunDll32.exe
PID 1888 wrote to memory of 1860	1888	rundll32.exe	RunDll32.exe
PID 1888 wrote to memory of 1860	1888	rundll32.exe	RunDll32.exe
PID 1888 wrote to memory of 1860	1888	rundll32.exe	RunDll32.exe
PID 2168 wrote to memory of 2200	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2200	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2200	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2200	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2200	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2200	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 2200	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1596	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1596	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1596	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1596	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1596	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1596	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1596	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1600	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1600	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1600	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1600	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1600	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1600	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1600	2168	runme.exe	rundll32.exe
PID 1600 wrote to memory of 2276	1600	rundll32.exe	runme.exe
PID 1600 wrote to memory of 2276	1600	rundll32.exe	runme.exe
PID 1600 wrote to memory of 2276	1600	rundll32.exe	runme.exe
PID 1600 wrote to memory of 2276	1600	rundll32.exe	runme.exe
PID 1600 wrote to memory of 2276	1600	rundll32.exe	runme.exe
PID 1600 wrote to memory of 2276	1600	rundll32.exe	runme.exe
PID 1600 wrote to memory of 2276	1600	rundll32.exe	runme.exe
PID 2168 wrote to memory of 320	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 320	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 320	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 320	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 320	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 320	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 320	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1504	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1504	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1504	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1504	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1504	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1504	2168	runme.exe	rundll32.exe
PID 2168 wrote to memory of 1504	2168	runme.exe	rundll32.exe
PID 1504 wrote to memory of 540	1504	rundll32.exe	runme.exe
PID 1504 wrote to memory of 540	1504	rundll32.exe	runme.exe
PID 1504 wrote to memory of 540	1504	rundll32.exe	runme.exe
PID 1504 wrote to memory of 540	1504	rundll32.exe	runme.exe

C:\Users\Admin\AppData\Local\Temp\runme.exe
"C:\Users\Admin\AppData\Local\Temp\runme.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl @1
2⤵
PID:2360

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL netcpl.cpl
2⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL netcpl.cpl
3⤵
PID:1860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,,0
2⤵
PID:2200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL main.cpl @0
2⤵
PID:1596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL modem.cpl
2⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Local\Temp\runme.exe
"C:\Users\Admin\AppData\Local\Temp\runme.exe" C:\Windows\system32\rundll32.exe
3⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL main.cpl @1
2⤵
PID:320

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl @1
2⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\runme.exe
"C:\Users\Admin\AppData\Local\Temp\runme.exe" C:\Windows\System32\SystemPropertiesComputerName.exe
3⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,1
2⤵
PID:488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL timedate.cpl
2⤵
PID:360

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,0
2⤵
- Modifies Control Panel
PID:1292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0
2⤵
PID:2116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2296

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Rundll32.exe
Filesize
100KB

MD5
b0feccddd78039aed7f1d68dae4d73d3

SHA1
8fcffb3ae7af33b9b83af4c5acbb044f888eeabf

SHA256
5714efd4746f7796bbc52a272f8e354f67edfb50129d5fdaa1396e920956d0d6

SHA512
b02b9476eeb9c43fcfef56949f867c1c88f152d65f3961a2838b8bff02df2383945aefb9a8c517ac78d79b5a9163c7677f5b6238f4624b1966994c9c09eb428d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Filesize
1KB

MD5
7c048eaacd1820ac933dccc0b872fa05

SHA1
955999eb7463f7e4031d551e24fbd1e1fb812197

SHA256
614d7a9ca519b3aa741a512e95f6f99aedd25e8c1630d30d13dd9735b562b3be

SHA512
09f35a1a69344e64b13f0a54ecc82cd7dd1ee9124bfc274fcd5fe8af2a07e30bbf0841d9230591cbbe12bc8f066f5f36e1577b82d5d1f3f0eb6b9b5154ce5d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Filesize
1KB

MD5
d835de730c2496708378bf3dce10892e

SHA1
591faf986469a03f8d46f5b53a3ebf1eaa67a1c7

SHA256
2157e9cd768423a4c6a6532cc34fa1b40e9766ee41dad15a7266474c57095bc1

SHA512
a97e55f7196ffab77e1301884908008cd3c0b10fdf4aa48b120060cb26f911f90a3a0a424e38998974aa874776d7442ba8fdce7128fbbddac5e3fce6c3c7ecc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Filesize
1KB

MD5
05471356f0ea1c0f5f5b8deb29c3ebd1

SHA1
12b14b737d1e0f76ca2494fb7a6841e5792a0504

SHA256
cf59479c75a8803468dd2a2c1d2803a2694c41992d5a0b3b65b1c69c28d1eac7

SHA512
942285259612792c2b3a45a65483e0775314841e397e815d447fd8f69f63f5de1ac48653a051c0121bd73415655c468772d39ce72bb1ba3d8ae367f78143502b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Filesize
1KB

MD5
b65aeb1b3da0b96313cc6e10dde4afe0

SHA1
34039989280d6d5a45793deaab79665c79b74b8d

SHA256
0254d776e25aeb83f195aacc7d477cd37683932586b27fdb7f09836d08296a3c

SHA512
be5c22848ee3491061feaab9c8e708e04e5d34bc0d8b46e816e059e6616c0114cfe5f40aee935f9d5dee546a990efa3bca00bdec03bcc29fedad37d0dbda95ea

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads