6edfb343ed43ddd5bd2d1131acc658ad72d3128b3c7d63ea933e51aae67a0cff

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 10:39 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27ead79e625289762f6dfae5111ebaa0N.exe
Size

5.4MB
MD5

27ead79e625289762f6dfae5111ebaa0
SHA1

15c2bc0152cf9c07eaa774d0269ed1d3bf884dd6
SHA256

6edfb343ed43ddd5bd2d1131acc658ad72d3128b3c7d63ea933e51aae67a0cff
SHA512

245f40383ac2af916063a94d230af4f318c59d9cf894d0061bc6743aeeda250c237ec743f123adf3834aee882ab7c3f135068187f808415008919950170222fa
SSDEEP

98304:+TCx1ykMv3Aiju03ej9Qfqy/mfr1e2E2IojD4jpLik:m8yBAi6zvmY5e2cogJ

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 11 IoCs

pid	Process
1636	27ead79e625289762f6dfae5111ebaa0n.exe
1208	svchost.exe
3688	icsys.icn.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
5072	svchost.exe
1644	explorer.exe
3368	27ead79e625289762f6dfae5111ebaa0n.exe
3256	icsys.icn.exe
1856	spoolsv.exe
4968	svchost.exe
4976	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	svchost.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File created	C:\Windows\svchost.exe	27ead79e625289762f6dfae5111ebaa0n.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	27ead79e625289762f6dfae5111ebaa0n.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	C:\Windows\svchost.exe	svchost.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	27ead79e625289762f6dfae5111ebaa0N.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\svchost.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27ead79e625289762f6dfae5111ebaa0n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27ead79e625289762f6dfae5111ebaa0n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27ead79e625289762f6dfae5111ebaa0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27ead79e625289762f6dfae5111ebaa0n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
3688	icsys.icn.exe
3688	icsys.icn.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
3688	icsys.icn.exe
3688	icsys.icn.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
3688	icsys.icn.exe
3688	icsys.icn.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
3688	icsys.icn.exe
3688	icsys.icn.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
3688	icsys.icn.exe
3688	icsys.icn.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
3688	icsys.icn.exe
3688	icsys.icn.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
3688	icsys.icn.exe
3688	icsys.icn.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
3688	icsys.icn.exe
3688	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1644	explorer.exe
4968	svchost.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4860	27ead79e625289762f6dfae5111ebaa0N.exe
4860	27ead79e625289762f6dfae5111ebaa0N.exe
3688	icsys.icn.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
3688	icsys.icn.exe
4464	27ead79e625289762f6dfae5111ebaa0n.exe
3368	27ead79e625289762f6dfae5111ebaa0n.exe
3368	27ead79e625289762f6dfae5111ebaa0n.exe
3256	icsys.icn.exe
3256	icsys.icn.exe
1644	explorer.exe
1644	explorer.exe
1856	spoolsv.exe
1856	spoolsv.exe
4968	svchost.exe
4968	svchost.exe
4976	spoolsv.exe
4976	spoolsv.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1636	4860	27ead79e625289762f6dfae5111ebaa0N.exe	84
PID 4860 wrote to memory of 1636	4860	27ead79e625289762f6dfae5111ebaa0N.exe	84
PID 4860 wrote to memory of 1636	4860	27ead79e625289762f6dfae5111ebaa0N.exe	84
PID 1636 wrote to memory of 1208	1636	27ead79e625289762f6dfae5111ebaa0n.exe	86
PID 1636 wrote to memory of 1208	1636	27ead79e625289762f6dfae5111ebaa0n.exe	86
PID 1636 wrote to memory of 1208	1636	27ead79e625289762f6dfae5111ebaa0n.exe	86
PID 4860 wrote to memory of 3688	4860	27ead79e625289762f6dfae5111ebaa0N.exe	87
PID 4860 wrote to memory of 3688	4860	27ead79e625289762f6dfae5111ebaa0N.exe	87
PID 4860 wrote to memory of 3688	4860	27ead79e625289762f6dfae5111ebaa0N.exe	87
PID 1208 wrote to memory of 4464	1208	svchost.exe	89
PID 1208 wrote to memory of 4464	1208	svchost.exe	89
PID 1208 wrote to memory of 4464	1208	svchost.exe	89
PID 3688 wrote to memory of 1644	3688	icsys.icn.exe	91
PID 3688 wrote to memory of 1644	3688	icsys.icn.exe	91
PID 3688 wrote to memory of 1644	3688	icsys.icn.exe	91
PID 4464 wrote to memory of 3368	4464	27ead79e625289762f6dfae5111ebaa0n.exe	92
PID 4464 wrote to memory of 3368	4464	27ead79e625289762f6dfae5111ebaa0n.exe	92
PID 4464 wrote to memory of 3368	4464	27ead79e625289762f6dfae5111ebaa0n.exe	92
PID 4464 wrote to memory of 3256	4464	27ead79e625289762f6dfae5111ebaa0n.exe	93
PID 4464 wrote to memory of 3256	4464	27ead79e625289762f6dfae5111ebaa0n.exe	93
PID 4464 wrote to memory of 3256	4464	27ead79e625289762f6dfae5111ebaa0n.exe	93
PID 1644 wrote to memory of 1856	1644	explorer.exe	94
PID 1644 wrote to memory of 1856	1644	explorer.exe	94
PID 1644 wrote to memory of 1856	1644	explorer.exe	94
PID 1856 wrote to memory of 4968	1856	spoolsv.exe	95
PID 1856 wrote to memory of 4968	1856	spoolsv.exe	95
PID 1856 wrote to memory of 4968	1856	spoolsv.exe	95
PID 4968 wrote to memory of 4976	4968	svchost.exe	96
PID 4968 wrote to memory of 4976	4968	svchost.exe	96
PID 4968 wrote to memory of 4976	4968	svchost.exe	96

C:\Users\Admin\AppData\Local\Temp\27ead79e625289762f6dfae5111ebaa0N.exe
"C:\Users\Admin\AppData\Local\Temp\27ead79e625289762f6dfae5111ebaa0N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860
- \??\c:\users\admin\appdata\local\temp\27ead79e625289762f6dfae5111ebaa0n.exe
  c:\users\admin\appdata\local\temp\27ead79e625289762f6dfae5111ebaa0n.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\svchost.exe
    "C:\Windows\svchost.exe" "c:\users\admin\appdata\local\temp\27ead79e625289762f6dfae5111ebaa0n.exe "
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - \??\c:\users\admin\appdata\local\temp\27ead79e625289762f6dfae5111ebaa0n.exe
      "c:\users\admin\appdata\local\temp\27ead79e625289762f6dfae5111ebaa0n.exe "
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4464
    - - \??\c:\users\admin\appdata\local\temp\27ead79e625289762f6dfae5111ebaa0n.exe
        
        c:\users\admin\appdata\local\temp\27ead79e625289762f6dfae5111ebaa0n.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3368
    - - C:\Windows\Resources\Themes\icsys.icn.exe
        
        C:\Windows\Resources\Themes\icsys.icn.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3256
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3688
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1856
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4968
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4976

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5072

Network

DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

2.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.159.190.20.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

22.236.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.236.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

2.159.190.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

2.159.190.20.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

22.236.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

22.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\27ead79e625289762f6dfae5111ebaa0n.exe

Filesize
5.2MB

MD5
03ae2c0b80414638c9575189a1377c90

SHA1
8dad3039fd0dea101935ca78c300b6da50198eaa

SHA256
97f6f183b6d7737bb20ac4ed9cc56a0b1897b2389d9cdc329917ea8419eabdff

SHA512
5b5236184b6121c97f986d0be569fcb2cec70c14635782f88d2baab385dedfb7a957ae9b96db0566b9199286375b8d5a78293181fa68582bb238d78c751a3472

Download Submit
C:\Users\Admin\AppData\Local\Temp\27ead79e625289762f6dfae5111ebaa0n.exe

Filesize
5.2MB

MD5
f6c40fa1a030b5bce648ac5ecce9dde7

SHA1
11926d6cfc0697cc6fe53cb0aafd12c79cfd3316

SHA256
2086d610c468529e59dd66cad78e6699fd6512c85eb0ae840b09db663b73dd73

SHA512
deacc2c60028c4316d2f5dbc0b4954247eaa0beea191bbd7cd038df4c0368017d8b99ef057ddcce99bd35a3bd246bc68a3242f8cffecdfa3d6e880b8cd733622

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
8a7acc8e8591f41b7d96858ebdbd4541

SHA1
5b876ed2b0aef03514f0f706c167f29b5d20666d

SHA256
0ba221a3cbbf0c5177083f2d8309f60aacc4b621c41ed5c8801bf505fb1223c4

SHA512
0c443b8d67788a1fe007379e817c43896a24d7a93248bfcda6e6471fc44fc893a849c20a51c433da196a86c749f4d65a2a921209a3edf315ef11db5e25dbc10d

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
81431e8c7a9cf24c1e41751bfba32ad9

SHA1
96d029ad4731cbbf137e3ecaf1000ff176e3589e

SHA256
896f497d5a1f5fcbfa0a4677704c8084f5882072391220bd1bda04abcd37310e

SHA512
d7c41cd7284fb4c311a6bb7876788e8c6bccd964355eb3c9309c1c83029ab013e73c7ad089eecdbe3c4a1e0eaef90b950fce4dc19c6811ed8d444f453a29b2f5

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
85a4e4e6f4ff58a26c8bc2e7e775724b

SHA1
f9848049717845c5b18b107cec58a492b8173bde

SHA256
c3d25abd9c8e1751352e73b89ba95e07327395b051853c083f217f38b2dc8575

SHA512
4786eb4e1683e1b59662bb70d036cbfc71368246b2d2fd2b115248a9a91866aab3286023b9eb67b8ea452d2a8d6c3aed664ce72de61421338fcf22710251a446

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
93b6f59205b2878e8cded0ac63366d3b

SHA1
7505b81c98c72f68a8f90962ea8768dc09df2536

SHA256
d31462f7bf91650358c4fcd4b72da8aa4be85ab8412499bf979701d90d826c6f

SHA512
6482999be940e009e4b5c9af0cdf35697d341634340c3f071efcfef655c6bc3dca76e4c77a5fb29698d5de129f8388f65a35d0b0814df347bbea490b7234ee6e

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
memory/1208-28-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1636-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1644-84-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1644-38-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1856-74-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3256-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3368-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3688-76-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4464-49-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4464-21-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4860-75-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4860-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4968-86-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4976-73-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5072-77-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/5072-81-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/5072-85-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.