cerber | ab9f6ac4a669e6cbd9cfb7f7a53f8d2393cd9753cc1b1f0953f8655d80a4a1df

Analysis

max time kernel
141s
max time network
251s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 18:27

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Cerber 5.zip
Size

181KB
MD5

10d74de972a374bb9b35944901556f5f
SHA1

593f11e2aa70a1508d5e58ea65bec0ae04b68d64
SHA256

ab9f6ac4a669e6cbd9cfb7f7a53f8d2393cd9753cc1b1f0953f8655d80a4a1df
SHA512

1755be2bd1e2c9894865492903f9bf03a460fb4c952f84b748268bf050c3ece4185b612c855804c7600549170742359f694750a46e5148e00b5604aca5020218
SSDEEP

3072:1rdfCdJA9AZODSf1MIH34E8Ylcg16hK1z0mZiPS6weJ2vbYEzoN:LfuA2D1MIHl8Ylt151z0mZiPSM2vbY7

Score

10^/10

cerber discovery evasion persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___AYVYQ_.txt

Family

cerber

Ransom Note

Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/4491-0D47-2E2C-0098-B2F1 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/4491-0D47-2E2C-0098-B2F1 2. http://xpcx6erilkjced3j.19kdeh.top/4491-0D47-2E2C-0098-B2F1 3. http://xpcx6erilkjced3j.1mpsnr.top/4491-0D47-2E2C-0098-B2F1 4. http://xpcx6erilkjced3j.18ey8e.top/4491-0D47-2E2C-0098-B2F1 5. http://xpcx6erilkjced3j.17gcun.top/4491-0D47-2E2C-0098-B2F1 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://xpcx6erilkjced3j.onion/4491-0D47-2E2C-0098-B2F1

http://xpcx6erilkjced3j.1n5mod.top/4491-0D47-2E2C-0098-B2F1

http://xpcx6erilkjced3j.19kdeh.top/4491-0D47-2E2C-0098-B2F1

http://xpcx6erilkjced3j.1mpsnr.top/4491-0D47-2E2C-0098-B2F1

http://xpcx6erilkjced3j.18ey8e.top/4491-0D47-2E2C-0098-B2F1

http://xpcx6erilkjced3j.17gcun.top/4491-0D47-2E2C-0098-B2F1

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2181	2060	mshta.exe
2196	1092	mshta.exe

Contacts a large (1102) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2804	netsh.exe
2648	netsh.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	[email protected]

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	[email protected]
File opened (read-only)	\??\n:	[email protected]
File opened (read-only)	\??\s:	[email protected]
File opened (read-only)	\??\w:	[email protected]
File opened (read-only)	\??\y:	[email protected]
File opened (read-only)	\??\b:	[email protected]
File opened (read-only)	\??\t:	[email protected]
File opened (read-only)	\??\b:	[email protected]
File opened (read-only)	\??\r:	[email protected]
File opened (read-only)	\??\v:	[email protected]
File opened (read-only)	\??\l:	[email protected]
File opened (read-only)	\??\r:	[email protected]
File opened (read-only)	\??\o:	[email protected]
File opened (read-only)	\??\l:	[email protected]
File opened (read-only)	\??\p:	[email protected]
File opened (read-only)	\??\j:	[email protected]
File opened (read-only)	\??\i:	[email protected]
File opened (read-only)	\??\z:	[email protected]
File opened (read-only)	\??\i:	[email protected]
File opened (read-only)	\??\m:	[email protected]
File opened (read-only)	\??\v:	[email protected]
File opened (read-only)	\??\e:	[email protected]
File opened (read-only)	\??\t:	[email protected]
File opened (read-only)	\??\a:	[email protected]
File opened (read-only)	\??\h:	[email protected]
File opened (read-only)	\??\k:	[email protected]
File opened (read-only)	\??\n:	[email protected]
File opened (read-only)	\??\q:	[email protected]
File opened (read-only)	\??\x:	[email protected]
File opened (read-only)	\??\a:	[email protected]
File opened (read-only)	\??\y:	[email protected]
File opened (read-only)	\??\q:	[email protected]
File opened (read-only)	\??\u:	[email protected]
File opened (read-only)	\??\x:	[email protected]
File opened (read-only)	\??\e:	[email protected]
File opened (read-only)	\??\m:	[email protected]
File opened (read-only)	\??\h:	[email protected]
File opened (read-only)	\??\g:	[email protected]
File opened (read-only)	\??\j:	[email protected]
File opened (read-only)	\??\s:	[email protected]
File opened (read-only)	\??\u:	[email protected]
File opened (read-only)	\??\g:	[email protected]
File opened (read-only)	\??\p:	[email protected]
File opened (read-only)	\??\w:	[email protected]
File opened (read-only)	\??\z:	[email protected]
File opened (read-only)	\??\o:	[email protected]

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	[email protected]

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6806.bmp"	[email protected]

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\word	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft sql server	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\word	[email protected]
File opened for modification	\??\c:\program files (x86)\outlook	[email protected]
File opened for modification	\??\c:\program files (x86)\powerpoint	[email protected]
File opened for modification	\??\c:\program files (x86)\steam	[email protected]
File opened for modification	\??\c:\program files (x86)\thunderbird	[email protected]
File opened for modification	\??\c:\program files (x86)\excel	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\program files (x86)\onenote	[email protected]
File opened for modification	\??\c:\program files (x86)\office	[email protected]
File opened for modification	\??\c:\program files (x86)\the bat!	[email protected]
File opened for modification	\??\c:\program files (x86)\	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\excel	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\office	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	[email protected]
File opened for modification	\??\c:\program files\	[email protected]
File opened for modification	\??\c:\program files (x86)\bitcoin	[email protected]

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	[email protected]
File opened for modification	\??\c:\windows\	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2232	cmd.exe
1760	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1580	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2224	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1760	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2576	chrome.exe
2576	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1092	mshta.exe
2324	msinfo32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2696	[email protected]

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2696	[email protected]
Token: SeDebugPrivilege	1580	taskkill.exe
Token: 33	1600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1600	AUDIODG.EXE
Token: 33	1600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1600	AUDIODG.EXE
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2224	NOTEPAD.EXE
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2060	mshta.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2696	[email protected]
2988	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2804	2696	[email protected]	34
PID 2696 wrote to memory of 2804	2696	[email protected]	34
PID 2696 wrote to memory of 2804	2696	[email protected]	34
PID 2696 wrote to memory of 2804	2696	[email protected]	34
PID 2696 wrote to memory of 2648	2696	[email protected]	36
PID 2696 wrote to memory of 2648	2696	[email protected]	36
PID 2696 wrote to memory of 2648	2696	[email protected]	36
PID 2696 wrote to memory of 2648	2696	[email protected]	36
PID 2696 wrote to memory of 2060	2696	[email protected]	40
PID 2696 wrote to memory of 2060	2696	[email protected]	40
PID 2696 wrote to memory of 2060	2696	[email protected]	40
PID 2696 wrote to memory of 2060	2696	[email protected]	40
PID 2696 wrote to memory of 2224	2696	[email protected]	41
PID 2696 wrote to memory of 2224	2696	[email protected]	41
PID 2696 wrote to memory of 2224	2696	[email protected]	41
PID 2696 wrote to memory of 2224	2696	[email protected]	41
PID 2696 wrote to memory of 2232	2696	[email protected]	42
PID 2696 wrote to memory of 2232	2696	[email protected]	42
PID 2696 wrote to memory of 2232	2696	[email protected]	42
PID 2696 wrote to memory of 2232	2696	[email protected]	42
PID 2232 wrote to memory of 1580	2232	cmd.exe	44
PID 2232 wrote to memory of 1580	2232	cmd.exe	44
PID 2232 wrote to memory of 1580	2232	cmd.exe	44
PID 2232 wrote to memory of 1580	2232	cmd.exe	44
PID 2232 wrote to memory of 1760	2232	cmd.exe	46
PID 2232 wrote to memory of 1760	2232	cmd.exe	46
PID 2232 wrote to memory of 1760	2232	cmd.exe	46
PID 2232 wrote to memory of 1760	2232	cmd.exe	46
PID 2576 wrote to memory of 2804	2576	chrome.exe	52
PID 2576 wrote to memory of 2804	2576	chrome.exe	52
PID 2576 wrote to memory of 2804	2576	chrome.exe	52
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53
PID 2576 wrote to memory of 1508	2576	chrome.exe	53

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Cerber 5.zip"
1⤵
PID:2340

C:\Users\Admin\Desktop\Cerber 5\[email protected]
"C:\Users\Admin\Desktop\Cerber 5\[email protected]"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2648
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___QEKAL48V_.hta"
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___AYVYQ_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:2224
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "E"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1760

C:\Users\Admin\Desktop\Cerber 5\[email protected]
"C:\Users\Admin\Desktop\Cerber 5\[email protected]"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2988

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2460

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6a29758,0x7fef6a29768,0x7fef6a29778
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:8
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1516 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:8
  2⤵
  PID:320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2584 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:2
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1368 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3052 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3944 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3832 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:8
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1240 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3988 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=576 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1104 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2456 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3108 --field-trial-handle=984,i,9913604789049602662,16049789449574494672,131072 /prefetch:1
  2⤵
  PID:1452

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:852

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\ConnectInvoke.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1736

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___QEKAL48V_.hta"
1⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
PID:1092

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\RevokeUse.nfo"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2324

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1400

C:\Windows\twunk_32.exe
"C:\Windows\twunk_32.exe"
1⤵
PID:3044

C:\Windows\winhlp32.exe
"C:\Windows\winhlp32.exe"
1⤵
PID:1724

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:2936

C:\Windows\winhlp32.exe
"C:\Windows\winhlp32.exe"
1⤵
PID:2684

C:\Windows\winhlp32.exe
"C:\Windows\winhlp32.exe"
1⤵
PID:2440

C:\Windows\winhlp32.exe
"C:\Windows\winhlp32.exe"
1⤵
PID:1728

C:\Windows\winhlp32.exe
"C:\Windows\winhlp32.exe"
1⤵
PID:700

C:\Windows\winhlp32.exe
"C:\Windows\winhlp32.exe"
1⤵
PID:1340

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FindInvoke.vbe"
1⤵
PID:1580

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2000
- C:\Windows\system32\shutdown.exe
  shutdown -p
  2⤵
  PID:2440

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1060

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\4VggQuV1Dw.9b3a

Filesize
364KB

MD5
f8f046469a74aba8cda65949005780fc

SHA1
bce2ed03f7fc279732ac43d5be0eda886a162634

SHA256
c7b689f3bacfea59814b17d94a576febad33a11ac0715335083648f0c874d13f

SHA512
8cb04b82fef5bc55200f19e32a5f3864b2228df8c9f00a702d476fd41b3d65cb747e63ef68656ba11b8aa6de38784ef48e46e7dc513ca6f650439f84b3a7b1fa

Download Submit
C:\D6LJQLY7ZZ.9b3a

Filesize
86KB

MD5
86b195666c078b6f9dce04832148d511

SHA1
8fe7e6f876d72b445bbb24f3e4a4206c55969759

SHA256
466287b3aedb6fd558bf60e738635376c6487e103b10ebdb8f69cd0365443f5c

SHA512
630345c35b19cab8ca69f601cd5e85a54c87e093caa465bca087971b5ae9012b3ef5a1789d1e1ba811d5646cac2291affe1ffbdef7f85d795b146b9d2d4259d6

Download Submit
C:\N9SCpRBpJV.9b3a

Filesize
379KB

MD5
1749dd998c1ce7e6eaeb06c0a19f9fc2

SHA1
0b9eb9c5ca6ba2cba0936ef4ad01c5da3d8282d3

SHA256
7c591ca38fdd1dd2450d3503486688b48f4181ba304855fd992b8b9f0b3f1dce

SHA512
682e5a94c8ff66182b05e9e90998aeef6be76ab6f339333cbc92c20e79c1b7e2c249f889171aded53105217545ae396f99c807274ee2874faa5f0ad1e643569c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3a5e977c-2b30-48ce-a130-908df403ce1a.tmp

Filesize
336KB

MD5
473beb214c1af708809fad97869e673a

SHA1
5a2583ef75cf003bde2ccb57ca758a50811cc3bc

SHA256
624f87e3f6f7f680462887e2c8f0f8ceadb178e74c65d41d61f330049a0f6233

SHA512
f3848c1a43c591599fcff51d31c2bd1efed09e32fa5475718813e7306246be727e56c02d3ff1bdaa58d73ab5eb772a9654ce7506dab675f0b84816a1f15a237e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\82ce8a86-d3db-40f4-93b3-43749d366a45.tmp

Filesize
422KB

MD5
d84912d216b7bc33b43713385d6b5fb0

SHA1
683d77ce57babc5fe06c8a9bf9e0de940d9285fe

SHA256
4d16893c8070821250fd2d763f7c030935b7003b96399a7915a06e0f08d3cdd5

SHA512
2a1270a56abdbbf3a27dce1ded21d46c965fb6128294cc5040ed45633c8f7062a30357813e16d088202ac4b27a3582d54bba9ff1526609a17a450f3a70c94fe0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
6153e5599c3c5a97f4d0d943e9fc3aea

SHA1
e4788f06703842cd7e9fb96ffe58b4b448c2f27e

SHA256
0780dc58dbc2c4c0cb387b870f448c2cfbdfc198e890dac06aead806b84d8da5

SHA512
fa4a80b90d9a34f9e534b11ae18daf6b7c00f4ce955589467aaee88303e7d8260e2e90435585a7f8ca46d5434dd897934eeec2f599070fb49c801fc2ed1c6856

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\663b9e4d-9e47-477f-8d96-e4e0006c52ff.tmp

Filesize
1KB

MD5
4a1e9438c036390fd3ba5ba3f74a0484

SHA1
44a9eea5c449c18ca592272b04c946cd5771371f

SHA256
9cb5901eb4b5608b6a893ba308de47130b0c8cf944c18bc53ad0a36691c8be4e

SHA512
c3dea29a41286b4f00fd235930681450961f6396b949c1392ef6c3df333664d22b52f64cdd411a33d98fbbf4fb0bf84d45c06f3c852d1bd301181fb3f5bcdba4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1a692844128cf33469fe5539d312274e

SHA1
4f8a9d5623fcaa36fc48c1a7470b7e8c567c4f7f

SHA256
0b1363d68aaad3dc413bd6fb142023cbee3f3896249b804ec318c57b014294bd

SHA512
c790f236b1e2034a19994814ec35e96f47836f7cd029ed3c685967f5378674033cfb7ad8f408e92e9cb7733983cae02b5fab5cbaca4c7a7d259a54966023469f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a02b480c148395b194b81fcb4b15a935

SHA1
3f85b9e544910fffaba12e924cdc8ee30279cc57

SHA256
6134b3ac82f84f351c8a3c700ea1e68930fe8131e8e0ea889d0d43b56f310c3f

SHA512
e1971a080f04a8d8f2c30341827f1f84719d3fc195d728cf53d445e443d5339207fc45a57e066703ac2effa6e93dda2bcf003dbaae1c08cafae0c33344114e47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c724c8cb-9da6-4afd-ad6b-cc2a81d6356b.tmp

Filesize
6KB

MD5
b3131336c69391201fb34ac255e5333d

SHA1
17a20e3bfef95d783e4ff4624392bd4eed264df8

SHA256
40bd06d77e3a3ce3fa6f2caefd9a2a1be6cd743dd6625899335a3d589fdcc336

SHA512
c3f386e72e497d237d94b2b2a4e15c58af914d9cef2ce004334a9f77a785b2f191572adcfb7d4a67a60ca8528a55c8d28264af22604e0e54f2ecfd6eab4f1bde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f9b8f47d-8c26-411c-a29b-c4769d68574b.tmp

Filesize
6KB

MD5
06563719de34050d374445e43b81c8bb

SHA1
fe1e4a350d50b668ea5d3765a0e66b380a846d82

SHA256
434e7ddb867a450910d9ed39049543af579e3e0220d1e761cb005a8e6040e3d3

SHA512
b08827e3bc230c658fccc8efac7f446070cb47d278be7d7d0caeec000686964b52d420c750924da27388786cfb657813931018d5ac1f50883957963ac1da8390

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
367KB

MD5
d741176bf2b058d01a4c42ad347e9c03

SHA1
5f353aa2bb12f600c00ff9584704b5d715e2d8a1

SHA256
f6862d964215a4486d945e62ed3dc17a6d5428c060b8b26467f9f52c8e4b8e63

SHA512
f42bf031a7df50301935fc66c8f4cb93cb76a25693cf702b5424478ef25f8080b8b246497514e5a948f129c8a2226a91dcc102f32ab0ba63a4dfdd13f2e74186

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
335KB

MD5
97620733f3f34228f88e00a593e4a162

SHA1
428106938b1f8540933d36873a901f3950ce52a2

SHA256
583f4b0eceff1e56a6da716092e35b7061233c1037991fb04bb4c628d2bea346

SHA512
ea3e63d5c8c8591d1a9a3d263e49f70bb4c379527918f9f6c3d04d33f6631e942ec2e869a80f8007458ea092513d40eee1c529ac7b2891d2e0648c0dde2c8dfb

Download Submit
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___AYVYQ_.txt

Filesize
1KB

MD5
3f46d56fb17edc738c9078e9a2bfe2e1

SHA1
34f0632ed0b315942347a79be348342b5d8085ac

SHA256
47a7e13fbdee587a1f6c5b99a02362401e2f0055cd2b9dc1a215454ae8097a2a

SHA512
22c3b7a895312e5c81ef14d53cfe6f91b25d6722ea9d9d15039182171c80cfc6ce5a02421d5f8e9b2bc659aba5b0baeb677a9f91e91d705dde351cfc70039d64

Download Submit
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___QEKAL48V_.hta

Filesize
76KB

MD5
ab738c867efd62c6fcdbfb209b20399b

SHA1
3a5ea7ba1039ba8e97bbf7d3fddf323490ae74c0

SHA256
897cf4f692c12046f942e4647ef7360f24d41396303eebc2e0d34c0152ab8bee

SHA512
26ee8718436aa48aa424776bebcf5ae60d2fc03743e3d43d6687b0f47bdcfabdcc0b1738664788b3bd677e972249dcf9de0c86699eb1ee2cac5fc8d6efd0019c

Download Submit
C:\Windows\DtcInstall.log

Filesize
2KB

MD5
a87fc3d14430cd5044c7527cc20fd70a

SHA1
18359cd390c56d7677898fe848a50c9e1cd0ad3b

SHA256
89964d3a42d749d1def07fa05d6db0e13b3ca6de147f20e04ab83e27c895f6f4

SHA512
c7f6531aba4ab2de4933776184e03cf152e122bbbd3597c0e3f125348da308cf32ed69e521321009d4e5243ae8a5aebbb1951006ae694e42ec6431bcd6f52934

Download Submit
C:\Windows\PFRO.log

Filesize
5KB

MD5
e70a923e94783ae2610f6d61eafa2eab

SHA1
370feda18fd0b3f6b06ab9c31a5f53a95fce00ab

SHA256
1e4afbec3ef807225d1f3c1d3ee747abe6b7e27e83774b83ee243c747c950a2a

SHA512
933767bebc854154a69e864a779bf447c52d2a8aaf440b17234bb7c594a5a1310138db33f701caa75ea81d7269a64a1879b94525b8e45a062d0b692d27a03210

Download Submit
C:\Windows\Starter.xml

Filesize
47KB

MD5
9060c3c745e7b2d8e1a81dd061021546

SHA1
0431c8db04c545726e748c3e0d56fde4963f7050

SHA256
9d9f02a29e0546538b06113920e33d4e236173c5518d565d6075d3f85f3e8c7a

SHA512
e22aa8d9310a51273cf3942b12cefc88d8a2283a7f99c3bf99b3c3fc588bcf04e5f73c35e4d0f42185e1299ea66b6d8d568d51167afdeeaf3e53db538cd2a01b

Download Submit
C:\Windows\Ultimate.xml

Filesize
50KB

MD5
be9abba239905c914b050195978e4d02

SHA1
d4b5b3edf0ccc3ad901c48caaaf47e3b7f36d7be

SHA256
a734a139365032665ea78eb51fa12982c47f2714e0bfbc0feb9669c5f7d0505c

SHA512
bf78b17dec4be66513d00ed39ea58397c22b3aa323db5a5a1d0b2062e11bcf5f488929978cd4991c52e301c658884da7e790386f9893e5dd94142dcba62fcd13

Download Submit
C:\Windows\WindowsUpdate.log

Filesize
16KB

MD5
4a71d624fa7d71eeeef982f1e04d08f8

SHA1
5697675f116a5ecd1e65c0f50ada47002a871cad

SHA256
2d01834055a19c3303f1568b1bf060138f98aa5d0e44303e4784d1d03c952981

SHA512
7f7885b8a472da2993454599a5d16e7499deb6de9fb7c72ee6855535b378cae2c3e9dd8f9bd7b43c6fe445062147fce3bbab26673fb098d4afbbbd392cf8306b

Download Submit
C:\Windows\bootstat.dat

Filesize
66KB

MD5
20cdbe820710b29e94e08906a792c67b

SHA1
b721a41d3ec36d1057daf9511bdcdcc42f0ea623

SHA256
64f3bab6af6f03a4e71cf4b0f3390f949243c85b3155746c65fc494eeee2331b

SHA512
40848b2624033d50a118f7f62b0c9b7d3c9e79a22b88998b89389a5a8b3b329f2474deabe113b18a4f07bf3fedd5c916574ef37cdc5a81128a2231cb4d37e893

Download Submit
C:\Windows\msdfmap.ini

Filesize
1KB

MD5
b9fb94a8da62711c6955825defb25c5a

SHA1
bfdb1f6a340d776d7c1e1a1268084a386e188947

SHA256
6a9f599704b0895581ed47805f80137120d14e824da19a78c2808576a8a0405b

SHA512
1f1ee59e7d5515f699a2c499a01d2c83d3906d877c9bbed3da5589cb1d148500f8f32702bbd059c03da6651cac76800fa6218f65a47e8008fab8daaf1a6592f3

Download Submit
C:\Windows\setupact.log

Filesize
21KB

MD5
6bcaa894a91af7d7ff1b7996b37fabd8

SHA1
11fbeeb77ef29789cc66e482802b503718de25c2

SHA256
62c129d2b2135a510fc7ed639985d1acb3fbe1a4b30c51100a81498e876cf2a8

SHA512
3f4a79de3892f9dbd55b8b9a1e8a06ff75e69841cce819daacf4ff9d36de41b28daa356d553668eb87a00f3c92a099e4fb11064e338192d0cabc5a1955379d42

Download Submit
C:\Windows\win.ini

Filesize
478B

MD5
2465ebc8cd6e412cdc1ab9fef40bcae6

SHA1
fb581afdb945b2cd43de0acde49b47790097edf2

SHA256
6d29b301024777e51366a000e05c6b3d40325c9d355a01e8383f59de511b7002

SHA512
ddb29f68166d1a66374cade87972517b4f44a8e5c2a2f3ccd4025ae7c75279b588822a1b168d041104d96bc7e3efffb1b91d29be610d757549a069618566439b

Download Submit
C:\bltEdOBHoH.9b3a

Filesize
80KB

MD5
d739d265882391d0572472a81f37983b

SHA1
63fc85622de0ee7bd2b546e68a3cbb4a5a771f74

SHA256
29d70c1df25588f66d940466bb0bb5c91de3d365812318ba660ddaf337caa74f

SHA512
f45c8233487fd17235582c8d820d727120277d53603ddbb5c6deb5129dea0757ea85a8f86a52c251c588a21f0f557e4ac84e857ccd2086aaf8903efba3869c12

Download Submit
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log

Filesize
165KB

MD5
a105ee90c18de0edb59f845b0b139853

SHA1
7c1c82861796c97e12d1a7fb34463439cec640ba

SHA256
5f41660a134b618903c9fb86ab46be3b2805fad90a03ea4d1a75a3865afc7b93

SHA512
9350b27f27e3871e0e0e1bca082698a076cd9aed967167356e09ad4ce0c00678c376059e0bf27d920099cf24fc61fd188b6c16014ce5917705d1f645934dfa8f

Download Submit
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log

Filesize
192KB

MD5
61ecace38b8a01ccecfd2587ed1a372a

SHA1
35ccb68ac517361250f383aab5337c1937811c9e

SHA256
c39e8176a64bc92834753d64c83549a031daf1b0e45aba81b8277b51ef68eda0

SHA512
7da0d94ea35bcb54e9e8f0b16f7557e15595ded49504992a6ea0bf1ce8408b88cf8a4ec368173be4ba168416620e68f7cfe2bca0f023c58e752f55034c4be813

Download Submit
C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log

Filesize
168KB

MD5
4acb1b7a9f52f8aa77d986c41314c40f

SHA1
88729f50d5ad34e3b9ef8561b11b672dae527308

SHA256
327bba6df3b0cfdabd8f345c4327286d3a675f67f543652f558b38ccf7139fe7

SHA512
be5d853463a71f3b2d3c97f10602b570338ff52bb63c167cca84969758076dfa607a1a20588155be1dca6eee7dec6b2ab27509f47ce1b918413ba330570b0045

Download Submit
C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log

Filesize
206KB

MD5
c8884bc5d30573a31bd4b3e3ff7bc100

SHA1
68b68d507f1d5edcac7da2ead94eb3137bd551a0

SHA256
b6417c3cf0e5beef88575fb1f2af9974bbc4991d521604a8da6ba86741d523f4

SHA512
a6e0cd041d9883c2690572c3af39266086877af489864a3de34b5e28d1a5470c4d24a8cb68497c240f8575c835c383f2d60fd557bad420c9ff58e71510cddb65

Download Submit
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log

Filesize
167KB

MD5
abf16533bf0498fede4642748b49f785

SHA1
31a208da5690ca991e0e25290728387c29f0de04

SHA256
e13c6e426a3f63c5d424c9b335c7fd41382deddb2e042298a65a89e7bba126ab

SHA512
ab2c1a08f9ad98407782d8b36034a29283fdc7958066ba0273efc7a456446b97ccce79e4fd37267486a5979c9099ed1644788be608a4b7eb0ae057a7f937ff0e

Download Submit
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log

Filesize
188KB

MD5
a28e4498bdf702206271f6163a11d06c

SHA1
93145b51f85144f928253099e7415d178a4c6447

SHA256
482aad71b431ad5671fcc63dafcaa961dbc85b2b5771f2d657491591f7078e9a

SHA512
779228e4307a60792b10933c866af9d3862330cd581edbd33b22265d29305a61a8255ab093826f080cda60b1fa2335b2f858a4c62e99fa700df6913f01d54d44

Download Submit
C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log

Filesize
167KB

MD5
02c79bd5429c81c1e83d9ba127f1c1e3

SHA1
4573c7e31f5369ea2948033ddfc289a943423f10

SHA256
feb732aeb8e19dde2bd31d14e6f1c0f88ba0fec2ed5c1c44457f12d35cb8ef43

SHA512
45b7dc12b02bb365e535eaf4d64eac83c90f55dee72845cb5cb0624685adc518b2f91e23903416d64d483d244a65c37a21730491f32c4aa5ce6a0102a9119b06

Download Submit
C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log

Filesize
196KB

MD5
3c82ae6226c49666d4ba72105a23c30c

SHA1
2ca9bb7d50c60cfd64b40105a320a44b0e3b6e23

SHA256
b01dc09a76db76556c43b0da07c50b434b70376858734e945887c6b2b41b5fea

SHA512
b70d386bf16003dad60c713971d2c5c3a371256dcc5f985422b8a9953764d3bde7c70d86055c95a5df4ca5514fc924c33f1b157751c8f158fc63cd41c745da9e

Download Submit
C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log

Filesize
120KB

MD5
06d480b77b026ccf8f80c1b005e3366b

SHA1
0eac3b18c1582c5f09e4ab0adf4e98bc31581d23

SHA256
198d9aa7253a88416c341f7d05d63fe2363e00441abcc828b2e2f7241c101047

SHA512
22934086114c3d4b225b68b7b346f2c411f4ed5197dd160e3c46d6ebe059d4707e978c9542a66d2bc966d391ccc4a9a8d83a67a44d9c14fb61ab8fae0d699efb

Download Submit
C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log

Filesize
127KB

MD5
e8ba97e457f3b0a61eaebd4a5d94e638

SHA1
e71126cb56d7641f891b2690d781c76c55e26f61

SHA256
4ecc2fa6e3a6ee58f29e05202d70f198a839b29de09e0d461f05d5b5494dbc37

SHA512
b4307db365871e9766197c831ea3b493e439a5a454b0d5015652f0830fb7119e2628e45a22cafbd3c37c8fe4cb79954ff12b703380d3c3feeb89bee75d595b73

Download Submit
C:\vcredist2022_x86_001_vcRuntimeMinimum_x86.log

Filesize
121KB

MD5
d82c5c15f0bb9b524aff5e07591f48ab

SHA1
4d2b19a38331e13850f624dde4264c1063b82c81

SHA256
c2f6ef15a153de8149b82aabebc4b86875da895382744653c41e5e656d357f82

SHA512
56199a781ec93506017fe54502dedef60879725738deddebbbb02f6934e5470d510812b1fe105e400b5d445974164d3cf688a440dc28f9bf9589061019750315

Download Submit
C:\vcredist2022_x86_002_vcRuntimeAdditional_x86.log

Filesize
133KB

MD5
73fc5265351aef0905f6133821adcc09

SHA1
09beb08a8416355dce8596dd76cee5b77f144532

SHA256
9fbf53c97e650e0051c1a9651ec1dbe241aa6a6e6e52831b15978b87866d476d

SHA512
ab6a35c28307cedb035dca2520e347d0ee83fe78b4cf4e8033d092fd21d6cd3334c1e05a509cb77fce528525d89c7fab182e632307fd84ebe6849110cf970308

Download Submit
memory/2696-0-0x00000000001F0000-0x0000000000221000-memory.dmp

Filesize
196KB

Download
memory/2696-119-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2696-103-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2696-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2696-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2696-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads