Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 14:26

General

  • Target

    2024-07-26_88f337f389dbd3ba5e78d69d5991089f_hacktools_icedid_mimikatz.exe

  • Size

    8.5MB

  • MD5

    88f337f389dbd3ba5e78d69d5991089f

  • SHA1

    4cfc11fae7a0c814e665e5190623ce643432a3d0

  • SHA256

    bac8a2d842e2b1a8feeed4a699d4078098e713a6f9f58cb2e4df6207e9736891

  • SHA512

    3f4a8d1c4030d87643e9610136e51cc02ffee37b3f5bca4805e607d05a4f0b1f15d8ae7b1742250f9824e99d84249c93aa7e917c2377e390e9b5302e4fba4d88

  • SSDEEP

    196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Contacts a large (29713) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

  • XMRig Miner payload 12 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 5 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Creates a Windows Service
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NSIS installer 3 IoCs
  • Modifies data under HKEY_USERS 45 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:2152
      • C:\Windows\TEMP\zbbalhtpz\qyhlfu.exe
        "C:\Windows\TEMP\zbbalhtpz\qyhlfu.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1200
    • C:\Users\Admin\AppData\Local\Temp\2024-07-26_88f337f389dbd3ba5e78d69d5991089f_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-07-26_88f337f389dbd3ba5e78d69d5991089f_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3476
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\gbligmuz\yfnuatu.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:796
        • C:\Windows\gbligmuz\yfnuatu.exe
          C:\Windows\gbligmuz\yfnuatu.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1544
    • C:\Windows\gbligmuz\yfnuatu.exe
      C:\Windows\gbligmuz\yfnuatu.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3672
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3484
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4544
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
            PID:1792
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1624
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1716
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
              PID:4316
            • C:\Windows\SysWOW64\cacls.exe
              cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2568
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static del all
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4060
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add policy name=Bastards description=FuckingBastards
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3636
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add filteraction name=BastardsList action=block
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2200
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\bidwwglya\weuihhyya\wpcap.exe /S
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5008
            • C:\Windows\bidwwglya\weuihhyya\wpcap.exe
              C:\Windows\bidwwglya\weuihhyya\wpcap.exe /S
              3⤵
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Suspicious use of WriteProcessMemory
              PID:1016
              • C:\Windows\SysWOW64\net.exe
                net stop "Boundary Meter"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1788
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Boundary Meter"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3796
              • C:\Windows\SysWOW64\net.exe
                net stop "TrueSight Meter"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2120
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "TrueSight Meter"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1448
              • C:\Windows\SysWOW64\net.exe
                net stop npf
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4684
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1660
              • C:\Windows\SysWOW64\net.exe
                net start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4468
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4436
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4908
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1512
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:624
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1968
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
                PID:736
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  4⤵
                    PID:4696
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c C:\Windows\bidwwglya\weuihhyya\ybeehbbuf.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\bidwwglya\weuihhyya\Scant.txt
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1612
                • C:\Windows\bidwwglya\weuihhyya\ybeehbbuf.exe
                  C:\Windows\bidwwglya\weuihhyya\ybeehbbuf.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\bidwwglya\weuihhyya\Scant.txt
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4968
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c C:\Windows\bidwwglya\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\bidwwglya\Corporate\log.txt
                2⤵
                • Drops file in Windows directory
                PID:5076
                • C:\Windows\bidwwglya\Corporate\vfshost.exe
                  C:\Windows\bidwwglya\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3204
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "pgfaablbt" /ru system /tr "cmd /c C:\Windows\ime\yfnuatu.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1044
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1376
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "pgfaablbt" /ru system /tr "cmd /c C:\Windows\ime\yfnuatu.exe"
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:4540
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bbnuzgiyh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\gbligmuz\yfnuatu.exe /p everyone:F"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:3296
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2492
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "bbnuzgiyh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\gbligmuz\yfnuatu.exe /p everyone:F"
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3856
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "zuhefgcwf" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\zbbalhtpz\qyhlfu.exe /p everyone:F"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2012
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  3⤵
                    PID:1760
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /sc minute /mo 1 /tn "zuhefgcwf" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\zbbalhtpz\qyhlfu.exe /p everyone:F"
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:432
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:4588
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:888
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:2984
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static set policy name=Bastards assign=y
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:2160
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:1656
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:2316
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:3228
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static set policy name=Bastards assign=y
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:3068
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:1716
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:3704
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:1612
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static set policy name=Bastards assign=y
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:2140
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net stop SharedAccess
                  2⤵
                    PID:4052
                    • C:\Windows\SysWOW64\net.exe
                      net stop SharedAccess
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:3856
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop SharedAccess
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:4268
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c netsh firewall set opmode mode=disable
                    2⤵
                      PID:4748
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall set opmode mode=disable
                        3⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:2692
                    • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                      C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 768 C:\Windows\TEMP\bidwwglya\768.dmp
                      2⤵
                      • Executes dropped EXE
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4832
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c netsh Advfirewall set allprofiles state off
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4324
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh Advfirewall set allprofiles state off
                        3⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:1480
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c net stop MpsSvc
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:3296
                      • C:\Windows\SysWOW64\net.exe
                        net stop MpsSvc
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3356
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop MpsSvc
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2572
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c net stop WinDefend
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2388
                      • C:\Windows\SysWOW64\net.exe
                        net stop WinDefend
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:1904
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop WinDefend
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:5008
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c net stop wuauserv
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4016
                      • C:\Windows\SysWOW64\net.exe
                        net stop wuauserv
                        3⤵
                          PID:3680
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop wuauserv
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:4448
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config MpsSvc start= disabled
                        2⤵
                          PID:3052
                          • C:\Windows\SysWOW64\sc.exe
                            sc config MpsSvc start= disabled
                            3⤵
                            • Launches sc.exe
                            • System Location Discovery: System Language Discovery
                            PID:3528
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c sc config SharedAccess start= disabled
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:3112
                          • C:\Windows\SysWOW64\sc.exe
                            sc config SharedAccess start= disabled
                            3⤵
                            • Launches sc.exe
                            • System Location Discovery: System Language Discovery
                            PID:1656
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c sc config WinDefend start= disabled
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1368
                          • C:\Windows\SysWOW64\sc.exe
                            sc config WinDefend start= disabled
                            3⤵
                            • Launches sc.exe
                            PID:4828
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c sc config wuauserv start= disabled
                          2⤵
                            PID:5064
                            • C:\Windows\SysWOW64\sc.exe
                              sc config wuauserv start= disabled
                              3⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:224
                          • C:\Windows\TEMP\xohudmc.exe
                            C:\Windows\TEMP\xohudmc.exe
                            2⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:1512
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 332 C:\Windows\TEMP\bidwwglya\332.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4292
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 2152 C:\Windows\TEMP\bidwwglya\2152.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:532
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 2636 C:\Windows\TEMP\bidwwglya\2636.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1760
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 2768 C:\Windows\TEMP\bidwwglya\2768.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4808
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 2856 C:\Windows\TEMP\bidwwglya\2856.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1660
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 3088 C:\Windows\TEMP\bidwwglya\3088.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:844
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 3848 C:\Windows\TEMP\bidwwglya\3848.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:724
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 3936 C:\Windows\TEMP\bidwwglya\3936.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3612
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 4000 C:\Windows\TEMP\bidwwglya\4000.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5020
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 4088 C:\Windows\TEMP\bidwwglya\4088.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5016
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 1856 C:\Windows\TEMP\bidwwglya\1856.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3324
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 4080 C:\Windows\TEMP\bidwwglya\4080.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1920
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 1456 C:\Windows\TEMP\bidwwglya\1456.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2572
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 2300 C:\Windows\TEMP\bidwwglya\2300.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5060
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 392 C:\Windows\TEMP\bidwwglya\392.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:724
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 1748 C:\Windows\TEMP\bidwwglya\1748.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3228
                          • C:\Windows\TEMP\bidwwglya\petcuuhbu.exe
                            C:\Windows\TEMP\bidwwglya\petcuuhbu.exe -accepteula -mp 4964 C:\Windows\TEMP\bidwwglya\4964.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3544
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c C:\Windows\bidwwglya\weuihhyya\scan.bat
                            2⤵
                              PID:1484
                              • C:\Windows\bidwwglya\weuihhyya\qauuzmvgz.exe
                                qauuzmvgz.exe TCP 194.110.0.1 194.110.255.255 445 512 /save
                                3⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:3292
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                              2⤵
                                PID:4420
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4684
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls C:\Windows\system32\drivers\etc\hosts /T /D users
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2160
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4116
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:800
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2084
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4168
                            • C:\Windows\SysWOW64\nslfoo.exe
                              C:\Windows\SysWOW64\nslfoo.exe
                              1⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:2568
                            • C:\Windows\system32\cmd.EXE
                              C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\gbligmuz\yfnuatu.exe /p everyone:F
                              1⤵
                                PID:800
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                  2⤵
                                    PID:4340
                                  • C:\Windows\system32\cacls.exe
                                    cacls C:\Windows\gbligmuz\yfnuatu.exe /p everyone:F
                                    2⤵
                                      PID:4492
                                  • C:\Windows\system32\cmd.EXE
                                    C:\Windows\system32\cmd.EXE /c C:\Windows\ime\yfnuatu.exe
                                    1⤵
                                      PID:796
                                      • C:\Windows\ime\yfnuatu.exe
                                        C:\Windows\ime\yfnuatu.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4808
                                    • C:\Windows\system32\cmd.EXE
                                      C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\zbbalhtpz\qyhlfu.exe /p everyone:F
                                      1⤵
                                        PID:1168
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                          2⤵
                                            PID:4548
                                          • C:\Windows\system32\cacls.exe
                                            cacls C:\Windows\TEMP\zbbalhtpz\qyhlfu.exe /p everyone:F
                                            2⤵
                                              PID:2084
                                          • C:\Windows\system32\cmd.EXE
                                            C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\gbligmuz\yfnuatu.exe /p everyone:F
                                            1⤵
                                              PID:2800
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                2⤵
                                                  PID:6112
                                                • C:\Windows\system32\cacls.exe
                                                  cacls C:\Windows\gbligmuz\yfnuatu.exe /p everyone:F
                                                  2⤵
                                                    PID:5692
                                                • C:\Windows\system32\cmd.EXE
                                                  C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\zbbalhtpz\qyhlfu.exe /p everyone:F
                                                  1⤵
                                                    PID:3708
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                      2⤵
                                                        PID:5860
                                                      • C:\Windows\system32\cacls.exe
                                                        cacls C:\Windows\TEMP\zbbalhtpz\qyhlfu.exe /p everyone:F
                                                        2⤵
                                                          PID:1376
                                                      • C:\Windows\system32\cmd.EXE
                                                        C:\Windows\system32\cmd.EXE /c C:\Windows\ime\yfnuatu.exe
                                                        1⤵
                                                          PID:5328
                                                          • C:\Windows\ime\yfnuatu.exe
                                                            C:\Windows\ime\yfnuatu.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5512

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Windows\SysWOW64\Packet.dll

                                                          Filesize

                                                          95KB

                                                          MD5

                                                          86316be34481c1ed5b792169312673fd

                                                          SHA1

                                                          6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                                          SHA256

                                                          49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                                          SHA512

                                                          3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                                        • C:\Windows\SysWOW64\wpcap.dll

                                                          Filesize

                                                          275KB

                                                          MD5

                                                          4633b298d57014627831ccac89a2c50b

                                                          SHA1

                                                          e5f449766722c5c25fa02b065d22a854b6a32a5b

                                                          SHA256

                                                          b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                                          SHA512

                                                          29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                                        • C:\Windows\TEMP\bidwwglya\1456.dmp

                                                          Filesize

                                                          8.6MB

                                                          MD5

                                                          6a50f6fbc7f5a5c8894f5e89c18d25b8

                                                          SHA1

                                                          a5215998cfa30aa61a224865852f54d16b3b654c

                                                          SHA256

                                                          40b11e21e93996b9a9cadb2d7e48fc9f70363afda7ab594b3172f50e398af28f

                                                          SHA512

                                                          5d08200b41d954aec94816a1f463bc249ba997bc00b61a8a3bf13a00acfdcc038f317201507788531c138a2583e247308cf138fcb4380c8bb90d1ea3f2bf9d61

                                                        • C:\Windows\TEMP\bidwwglya\1856.dmp

                                                          Filesize

                                                          25.8MB

                                                          MD5

                                                          c583236f7ba1193a38914d02b2b5fee2

                                                          SHA1

                                                          fa7acafd98a5643c251b8193bf65049a81fdb392

                                                          SHA256

                                                          176d56a6d5d69147b2209c3e4bc53d567f54bbb4340a04b9418050070f674a95

                                                          SHA512

                                                          96307732bc879254b301abf46b5d191081d77d6cdef64351ac829851cd31aa5184b9a3778dea9a1266f7d3e602750f59525bc1026cee02b340763216ecc26c26

                                                        • C:\Windows\TEMP\bidwwglya\2152.dmp

                                                          Filesize

                                                          4.1MB

                                                          MD5

                                                          55e36db32ea50ec8ba3e95cf95c72be6

                                                          SHA1

                                                          9ebcf4fedf577aadbda0089573588294174b3c0e

                                                          SHA256

                                                          466a6897ad9d98c29609d493b0e849674d28faff49fee347598afe488f4722c5

                                                          SHA512

                                                          67dffa829165b390bcfe5c3c81bcdf77cf53f3e2930537fa8c242bfb37d7901141a8b12297b7e3ee52d3dbd1174b50b55146666377f00722ea4afb98ec5c291b

                                                        • C:\Windows\TEMP\bidwwglya\2636.dmp

                                                          Filesize

                                                          3.9MB

                                                          MD5

                                                          9c8c24b3a66576489666de3972a98998

                                                          SHA1

                                                          746336001dd2df6c74ff9ddda8012ab51823a005

                                                          SHA256

                                                          8f4240c42dc2da3c083c92f568e5ceb3e39febfb11d32db0afa6a34b12c5aef3

                                                          SHA512

                                                          5ea161ee8418c9d3c3bf75d4f0c7c0e3d80e5f81c09e119715fc38a8ff9afe152fd67cb0ab49259f2e73bf9569b9803073218e85c25c1728d998718e2c43c31c

                                                        • C:\Windows\TEMP\bidwwglya\2768.dmp

                                                          Filesize

                                                          2.9MB

                                                          MD5

                                                          00ebb0c759af1ddc629ddb377af55390

                                                          SHA1

                                                          7d1541db5d2cc94bfa8a61deb0bebf464c42dae8

                                                          SHA256

                                                          14df8d47ce4d08c61d4b6aab41cd190cbefea4b8237fa0bf72d776c4c85fe181

                                                          SHA512

                                                          3df1a30802eb36324f46520bcf4eb6ead6f351f48b4e05174ced0a02ad1be06b8a0e6a1423499257477c5026180bc4ed2f651d3b185980702314934dfaf52b79

                                                        • C:\Windows\TEMP\bidwwglya\2856.dmp

                                                          Filesize

                                                          7.5MB

                                                          MD5

                                                          362e18e7c8e076c0e396bc02e69d46e6

                                                          SHA1

                                                          b0403c1c1f9c79cba049d999735eddba797f6e6f

                                                          SHA256

                                                          28fbaa64db148014718b8185cab3aa42fb4e4c3cbdfdcf7a7a5d89e5f3553b2b

                                                          SHA512

                                                          8b780f1c788dda68012a6d606ec3859e8a711a2832c8c1c741d968e12767ca7a06b26c5211d0246a392282a02941e9b040cbd163843685e664ba030eb8467bcb

                                                        • C:\Windows\TEMP\bidwwglya\3088.dmp

                                                          Filesize

                                                          822KB

                                                          MD5

                                                          0c34e1012fdbe38a7dc023768d47cd04

                                                          SHA1

                                                          97787b73e3abb64d7b086f47a44ffffbd305409b

                                                          SHA256

                                                          9907418b08ca0378139456bad5c590502a6265cb1cf0138b296fe1fec9a582c3

                                                          SHA512

                                                          d3049aaffe9d678b60aa3ad664d5842a1a80fc689b2f20e130680890825a4612d6de8a2e8f8e6bdb5a3f858e142064f79b7c43bc1f44c52006c3d65c6f65921a

                                                        • C:\Windows\TEMP\bidwwglya\332.dmp

                                                          Filesize

                                                          33.6MB

                                                          MD5

                                                          da805e1c362ac3c394b5d62be27f2c29

                                                          SHA1

                                                          adad76573c21dca273bf8e2d2a373f263d8c3a97

                                                          SHA256

                                                          b0a1d65096b65f5ff3287f4c116790cc33d79e03dd72e446669279cf7bdc147e

                                                          SHA512

                                                          3b0798c8df0520d741e980a50752a6a85c144d14eee799a4543a359b803f23852b9eae16304864be20e9d92d8bd6ca9dd4fab2ad29f13f38ca4a2ea849e1ee46

                                                        • C:\Windows\TEMP\bidwwglya\3848.dmp

                                                          Filesize

                                                          2.7MB

                                                          MD5

                                                          2445aabcfd0b6cf620935cdc1e41cee4

                                                          SHA1

                                                          be1af002f9ecda2a7db1b615a4405130f0f3af39

                                                          SHA256

                                                          53050e29b8e0b7e3820d1a0eb77d468a94b03c058bc59b9ba0648b4c0a75e078

                                                          SHA512

                                                          888f2c9fc3773c711ed80a9558d1bd93cd733c493cc761296532bdbf34f574363e9b3230be7db4be48641659aa54f9720303e4bbd88cdd8dc091be03f90408f6

                                                        • C:\Windows\TEMP\bidwwglya\3936.dmp

                                                          Filesize

                                                          20.5MB

                                                          MD5

                                                          b19e7bd59f395a26dc74ec34aef355e6

                                                          SHA1

                                                          5887cf97d3e3d2ce14832707bf0e9a5695c2f27b

                                                          SHA256

                                                          7862b98770d1e1c64025e5ba0a3540acfb086fdefa5ca24bf58cb3d377d70370

                                                          SHA512

                                                          e962c5b5abf9a711077d0efa3ae268bd2ca946d565794e72af0cbfd4605134c1d79946400df57568c0a9b0e3db411d429ef740a1edc34a5b3fc7f5d1aa8e4f4e

                                                        • C:\Windows\TEMP\bidwwglya\4000.dmp

                                                          Filesize

                                                          8.4MB

                                                          MD5

                                                          fa8b450bb9e8e9e6f2b6dc1c3de80bdf

                                                          SHA1

                                                          c3771295054b62cb6d53adfb6f5a6db80f6979d1

                                                          SHA256

                                                          2c1bfae3e334b5d1e23b7ea0a1b14ecc8b7b0456a9aa2da4fc68607d9406bf57

                                                          SHA512

                                                          835591ef939954d74ba00053cbffba6f88ba4aff7a289d40c6cd1308a0e153239cca71f42d39c2fd6bd2c6b481184d77afaa8a6bd8ec08463ff14b41599d2679

                                                        • C:\Windows\TEMP\bidwwglya\4080.dmp

                                                          Filesize

                                                          1.2MB

                                                          MD5

                                                          c45109ebdfd290e28bc2f0dcffd2c023

                                                          SHA1

                                                          ad0040ed2c81bc241a5ef6d54e5d9b9f3b9fc76f

                                                          SHA256

                                                          1a18587b4f53110bf647a9a078bcf795dc3bbbf539316b8ff5bf6b472c3cb47d

                                                          SHA512

                                                          d8a5c3a980a7cf6b92b88f21407c9f665840ca915c8ffe1c423a3bd95e3bbd601f12a48fa3f956e5dc27a564f4988d638eea4067c7ad4b144641be39188889a6

                                                        • C:\Windows\TEMP\bidwwglya\4088.dmp

                                                          Filesize

                                                          43.8MB

                                                          MD5

                                                          2dc9768f14497069f26550e2034f64b0

                                                          SHA1

                                                          98430725435282e4f7f58a3bb6c4af408ffb38d0

                                                          SHA256

                                                          66f93cb90915bdc140ad0a8810a91ada0adae665171bfa8e3a2bb1407d65d90b

                                                          SHA512

                                                          4bf16fb81043a14d905ede849b074e3561ea758045de7ac878d5bc98adacdd5216b914e986be400229bbf90117b8cb73ac812eceb429eaf09f32159a80ffa68d

                                                        • C:\Windows\TEMP\bidwwglya\768.dmp

                                                          Filesize

                                                          3.3MB

                                                          MD5

                                                          f4fd6840df133b6319f720654aa4239b

                                                          SHA1

                                                          5e80b5ad5ee5451b3b34bd86152fcd0e90477798

                                                          SHA256

                                                          fb0c86e352b7baaed6010c580d3cda86c65c74528641b771b22c56bd669755cc

                                                          SHA512

                                                          1720330a48ebc867e45a6a5fac14fd16f50771af282f72874b770be80d24104d3c91c82e82e211f5fdd586fcabfb989b338a1a4bac87cd71a27f6044510ec866

                                                        • C:\Windows\TEMP\xohudmc.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          cbefa7108d0cf4186cdf3a82d6db80cd

                                                          SHA1

                                                          73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                                          SHA256

                                                          7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                                          SHA512

                                                          b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                                        • C:\Windows\TEMP\zbbalhtpz\config.json

                                                          Filesize

                                                          693B

                                                          MD5

                                                          f2d396833af4aea7b9afde89593ca56e

                                                          SHA1

                                                          08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                                          SHA256

                                                          d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                                          SHA512

                                                          2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                                        • C:\Windows\Temp\bidwwglya\petcuuhbu.exe

                                                          Filesize

                                                          126KB

                                                          MD5

                                                          e8d45731654929413d79b3818d6a5011

                                                          SHA1

                                                          23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                                          SHA256

                                                          a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                                          SHA512

                                                          df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                                        • C:\Windows\Temp\nscE3EA.tmp\System.dll

                                                          Filesize

                                                          11KB

                                                          MD5

                                                          2ae993a2ffec0c137eb51c8832691bcb

                                                          SHA1

                                                          98e0b37b7c14890f8a599f35678af5e9435906e1

                                                          SHA256

                                                          681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                                          SHA512

                                                          2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                                        • C:\Windows\Temp\nscE3EA.tmp\nsExec.dll

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          b648c78981c02c434d6a04d4422a6198

                                                          SHA1

                                                          74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                                          SHA256

                                                          3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                                          SHA512

                                                          219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                                        • C:\Windows\Temp\zbbalhtpz\qyhlfu.exe

                                                          Filesize

                                                          343KB

                                                          MD5

                                                          2b4ac7b362261cb3f6f9583751708064

                                                          SHA1

                                                          b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                                          SHA256

                                                          a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                                          SHA512

                                                          c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                                        • C:\Windows\bidwwglya\Corporate\vfshost.exe

                                                          Filesize

                                                          381KB

                                                          MD5

                                                          fd5efccde59e94eec8bb2735aa577b2b

                                                          SHA1

                                                          51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                                          SHA256

                                                          441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                                          SHA512

                                                          74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                                        • C:\Windows\bidwwglya\weuihhyya\wpcap.exe

                                                          Filesize

                                                          424KB

                                                          MD5

                                                          e9c001647c67e12666f27f9984778ad6

                                                          SHA1

                                                          51961af0a52a2cc3ff2c4149f8d7011490051977

                                                          SHA256

                                                          7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                                          SHA512

                                                          56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                                        • C:\Windows\bidwwglya\weuihhyya\ybeehbbuf.exe

                                                          Filesize

                                                          332KB

                                                          MD5

                                                          ea774c81fe7b5d9708caa278cf3f3c68

                                                          SHA1

                                                          fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                                          SHA256

                                                          4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                                          SHA512

                                                          7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                                        • C:\Windows\gbligmuz\yfnuatu.exe

                                                          Filesize

                                                          8.6MB

                                                          MD5

                                                          a9e1807078efe51aca6f9d7298995bc1

                                                          SHA1

                                                          d1ac9b485b17fa8d0fff9179559d9b8708e28e87

                                                          SHA256

                                                          ea9010f6d270ad350e51b21e528003fea01b19dc1be68684b8b9fcf9f3325f57

                                                          SHA512

                                                          c18e939ee3553dc18b10e0e7527dbba76bfd55cf3a20fc79bd9a34669d1f0edf610b832443dae68b918b0c041e7f843b63224df73b7438598cf40df6de5bb15f

                                                        • C:\Windows\system32\drivers\etc\hosts

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          c838e174298c403c2bbdf3cb4bdbb597

                                                          SHA1

                                                          70eeb7dfad9488f14351415800e67454e2b4b95b

                                                          SHA256

                                                          1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                                                          SHA512

                                                          c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                                                        • memory/532-174-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/724-233-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/724-196-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/844-191-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/1200-249-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-163-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-265-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-266-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-267-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-264-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-231-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-269-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-193-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-181-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-167-0x00000196BBAA0000-0x00000196BBAB0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/1200-199-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-217-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1200-211-0x00007FF6C1B90000-0x00007FF6C1CB0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/1512-151-0x0000000010000000-0x0000000010008000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/1512-166-0x0000000000400000-0x0000000000412000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/1544-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/1660-187-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/1760-178-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/1920-219-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2572-227-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/3204-136-0x00007FF7EE1B0000-0x00007FF7EE29E000-memory.dmp

                                                          Filesize

                                                          952KB

                                                        • memory/3204-138-0x00007FF7EE1B0000-0x00007FF7EE29E000-memory.dmp

                                                          Filesize

                                                          952KB

                                                        • memory/3228-235-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/3292-247-0x0000000000EA0000-0x0000000000EB2000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/3324-214-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/3476-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/3476-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/3544-237-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/3612-201-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/4292-170-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/4808-183-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/4832-145-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/4832-142-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/4968-78-0x0000000001690000-0x00000000016DC000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/5016-209-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/5020-205-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/5060-230-0x00007FF740490000-0x00007FF7404EB000-memory.dmp

                                                          Filesize

                                                          364KB