4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Size

3.0MB
MD5

078cb9b595c98ffc17e0a8410df44420
SHA1

dade71931dd3d282340a0b0302d85b0c3c2d5551
SHA256

4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729
SHA512

091a9c0a16678aa2f0a904edbfbd4de34a346cd04cedfa9615941f3b794942c73297b5be62764d5a39adfefc464cb26d3fddc822ab60a737d03e7e5b9be2998f
SSDEEP

3072:ThzV9Rd1gWIoKMHOlQtjZtIax1I5cJKAcBnyypQ1x2Cmswz:dRbOCtjvpJUfKxms

Score

10^/10

discovery evasion execution persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ftdisk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	DHCP.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SYSTEM\DISABLEREGISTRYTOOLS = "1"	DHCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SYSTEM\DISABLEREGISTRYTOOLS = "1"	ftdisk.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\directx.exe	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4616	DHCP.exe
2184	ftdisk.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	ftdisk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	DHCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	DHCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	ftdisk.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe

Drops autorun.inf file 1 TTPs 8 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Autorun.inf	DHCP.exe
File created	F:\Autorun.inf	DHCP.exe
File opened for modification	F:\Autorun.inf	DHCP.exe
File created	C:\Autorun.inf	ftdisk.exe
File opened for modification	C:\Autorun.inf	ftdisk.exe
File created	F:\Autorun.inf	ftdisk.exe
File opened for modification	F:\Autorun.inf	ftdisk.exe
File created	C:\Autorun.inf	DHCP.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ftdisk.exe	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\helpsrv.exe	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\initgdi32.cui	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\compmhelp.htm	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\dhcp.sys	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\ftdisk.sys	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\dpvsrv.dll	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\SysWOW64\igfx32.lrc	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DHCP.exe	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\media\funnu.wav	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
File opened for modification	C:\Windows\help\ipshelp.hlp	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe

Launches sc.exe 51 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1556	SC.exe
1092	SC.exe
1028	SC.exe
3300	SC.exe
4908	SC.exe
2164	SC.exe
2736	SC.exe
2436	SC.exe
4932	SC.exe
3096	SC.exe
3844	SC.exe
4144	SC.exe
4708	SC.exe
4528	SC.exe
2784	SC.exe
3476	SC.exe
2304	SC.exe
4708	SC.exe
2268	SC.exe
4384	SC.exe
1212	SC.exe
1784	SC.exe
352	SC.exe
4104	SC.exe
3564	SC.exe
1564	SC.exe
4300	SC.exe
2272	SC.exe
3340	SC.exe
3548	SC.exe
5004	SC.exe
4312	SC.exe
4504	SC.exe
5116	SC.exe
4848	SC.exe
4812	SC.exe
1228	SC.exe
4520	SC.exe
1724	SC.exe
5100	SC.exe
3208	SC.exe
4964	SC.exe
4412	SC.exe
4984	SC.exe
4192	SC.exe
4376	SC.exe
4516	SC.exe
3212	SC.exe
2496	SC.exe
4396	SC.exe
212	SC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ftdisk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	diskpart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DHCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	diskpart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1229272821-838170752-839522115-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN	DHCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1229272821-838170752-839522115-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN	ftdisk.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
4616	DHCP.exe
4616	DHCP.exe
4616	DHCP.exe
4616	DHCP.exe
2184	ftdisk.exe
2184	ftdisk.exe
2184	ftdisk.exe
2184	ftdisk.exe
4616	DHCP.exe
4616	DHCP.exe
4616	DHCP.exe
4616	DHCP.exe
2184	ftdisk.exe
2184	ftdisk.exe
2184	ftdisk.exe
2184	ftdisk.exe
4616	DHCP.exe
4616	DHCP.exe
4616	DHCP.exe
2184	ftdisk.exe
4616	DHCP.exe
2184	ftdisk.exe
2184	ftdisk.exe
4616	DHCP.exe
4616	DHCP.exe
2184	ftdisk.exe
4616	DHCP.exe
2184	ftdisk.exe
4616	DHCP.exe
2184	ftdisk.exe
2184	ftdisk.exe
4616	DHCP.exe
2184	ftdisk.exe
4616	DHCP.exe
2184	ftdisk.exe
4616	DHCP.exe
2184	ftdisk.exe
4616	DHCP.exe
2184	ftdisk.exe
4616	DHCP.exe
4616	DHCP.exe
2184	ftdisk.exe
2184	ftdisk.exe
2184	ftdisk.exe
4616	DHCP.exe
4616	DHCP.exe
4616	DHCP.exe
2184	ftdisk.exe
4616	DHCP.exe
2184	ftdisk.exe
2184	ftdisk.exe
4616	DHCP.exe
4616	DHCP.exe
2184	ftdisk.exe
4616	DHCP.exe
2184	ftdisk.exe
4616	DHCP.exe
2184	ftdisk.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
4616	DHCP.exe
2184	ftdisk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4376	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	81
PID 4696 wrote to memory of 4376	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	81
PID 4696 wrote to memory of 4376	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	81
PID 4696 wrote to memory of 3548	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	82
PID 4696 wrote to memory of 3548	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	82
PID 4696 wrote to memory of 3548	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	82
PID 4696 wrote to memory of 1564	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	83
PID 4696 wrote to memory of 1564	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	83
PID 4696 wrote to memory of 1564	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	83
PID 4696 wrote to memory of 2164	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	84
PID 4696 wrote to memory of 2164	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	84
PID 4696 wrote to memory of 2164	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	84
PID 4696 wrote to memory of 3844	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	85
PID 4696 wrote to memory of 3844	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	85
PID 4696 wrote to memory of 3844	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	85
PID 4696 wrote to memory of 1212	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	86
PID 4696 wrote to memory of 1212	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	86
PID 4696 wrote to memory of 1212	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	86
PID 4696 wrote to memory of 5004	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	87
PID 4696 wrote to memory of 5004	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	87
PID 4696 wrote to memory of 5004	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	87
PID 4696 wrote to memory of 4528	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	88
PID 4696 wrote to memory of 4528	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	88
PID 4696 wrote to memory of 4528	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	88
PID 4696 wrote to memory of 5100	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	89
PID 4696 wrote to memory of 5100	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	89
PID 4696 wrote to memory of 5100	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	89
PID 4696 wrote to memory of 3300	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	90
PID 4696 wrote to memory of 3300	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	90
PID 4696 wrote to memory of 3300	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	90
PID 4696 wrote to memory of 1228	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	91
PID 4696 wrote to memory of 1228	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	91
PID 4696 wrote to memory of 1228	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	91
PID 4696 wrote to memory of 3096	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	92
PID 4696 wrote to memory of 3096	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	92
PID 4696 wrote to memory of 3096	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	92
PID 4696 wrote to memory of 4812	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	93
PID 4696 wrote to memory of 4812	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	93
PID 4696 wrote to memory of 4812	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	93
PID 4696 wrote to memory of 2496	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	94
PID 4696 wrote to memory of 2496	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	94
PID 4696 wrote to memory of 2496	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	94
PID 4696 wrote to memory of 4708	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	95
PID 4696 wrote to memory of 4708	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	95
PID 4696 wrote to memory of 4708	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	95
PID 4696 wrote to memory of 4516	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	96
PID 4696 wrote to memory of 4516	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	96
PID 4696 wrote to memory of 4516	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	96
PID 4696 wrote to memory of 4616	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	113
PID 4696 wrote to memory of 4616	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	113
PID 4696 wrote to memory of 4616	4696	4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe	113
PID 4616 wrote to memory of 4384	4616	DHCP.exe	114
PID 4616 wrote to memory of 4384	4616	DHCP.exe	114
PID 4616 wrote to memory of 4384	4616	DHCP.exe	114
PID 4616 wrote to memory of 4192	4616	DHCP.exe	115
PID 4616 wrote to memory of 4192	4616	DHCP.exe	115
PID 4616 wrote to memory of 4192	4616	DHCP.exe	115
PID 4616 wrote to memory of 1028	4616	DHCP.exe	116
PID 4616 wrote to memory of 1028	4616	DHCP.exe	116
PID 4616 wrote to memory of 1028	4616	DHCP.exe	116
PID 4616 wrote to memory of 352	4616	DHCP.exe	117
PID 4616 wrote to memory of 352	4616	DHCP.exe	117
PID 4616 wrote to memory of 352	4616	DHCP.exe	117
PID 4616 wrote to memory of 212	4616	DHCP.exe	118

System policy modification 1 TTPs 8 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	ftdisk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\EXPLORER	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NOFIND = "1"	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NORUN = "1"	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	DHCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\EXPLORER	ftdisk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NOFIND = "1"	ftdisk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NORUN = "1"	ftdisk.exe

C:\Users\Admin\AppData\Local\Temp\4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe
"C:\Users\Admin\AppData\Local\Temp\4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729N.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\SC.exe
  SC STOP AudioSrv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4376
- C:\Windows\SysWOW64\SC.exe
  SC DELETE AudioSrv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3548
- C:\Windows\SysWOW64\SC.exe
  SC STOP spooler
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1564
- C:\Windows\SysWOW64\SC.exe
  SC DELETE spooler
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2164
- C:\Windows\SysWOW64\SC.exe
  SC STOP SENS
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3844
- C:\Windows\SysWOW64\SC.exe
  SC DELETE SENS
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1212
- C:\Windows\SysWOW64\SC.exe
  SC STOP wscsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5004
- C:\Windows\SysWOW64\SC.exe
  SC DELETE wscsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4528
- C:\Windows\SysWOW64\SC.exe
  SC STOP SharedAccess
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5100
- C:\Windows\SysWOW64\SC.exe
  SC DELETE SharedAccess
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\Windows\SysWOW64\SC.exe
  SC STOP srservice
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1228
- C:\Windows\SysWOW64\SC.exe
  SC DELETE srservice
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3096
- C:\Windows\SysWOW64\SC.exe
  SC STOP wuauserv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4812
- C:\Windows\SysWOW64\SC.exe
  SC DELETE wuauserv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2496
- C:\Windows\SysWOW64\SC.exe
  SC STOP avp
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4708
- C:\Windows\SysWOW64\SC.exe
  SC DELETE avp
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Windows\DHCP.exe
  C:\Windows\DHCP.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4616
- - C:\Windows\SysWOW64\SC.exe
    SC STOP AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4384
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4192
- - C:\Windows\SysWOW64\SC.exe
    SC STOP spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1028
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:352
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:212
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4984
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1092
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SharedAccess
    3⤵
    - Launches sc.exe
    PID:2436
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2304
- - C:\Windows\SysWOW64\SC.exe
    SC STOP srservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3340
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE srservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4144
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4848
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3564
- - C:\Windows\SysWOW64\SC.exe
    SC STOP avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1784
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3208
- - C:\Windows\SysWOW64\SC.exe
    SC START Themes
    3⤵
    - Launches sc.exe
    PID:4708
- - C:\Windows\SysWOW64\SC.exe
    SC STOP Themes
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_dsP.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5012
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /d SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      PID:1936
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /e /r SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      PID:3808
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /d SYSTEM
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:1040
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /e /r SYSTEM
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:4196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_dhS.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1732
  - - C:\Windows\SysWOW64\diskpart.exe
      Diskpart /s C:\Users\Admin\AppData\Local\Temp\hcdRS.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
- C:\Windows\SysWOW64\ftdisk.exe
  C:\Windows\system32\ftdisk.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2184
- - C:\Windows\SysWOW64\SC.exe
    SC STOP AudioSrv
    3⤵
    - Launches sc.exe
    PID:4412
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4964
- - C:\Windows\SysWOW64\SC.exe
    SC STOP spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2272
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2268
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3212
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4300
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4312
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4396
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2736
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1556
- - C:\Windows\SysWOW64\SC.exe
    SC STOP srservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5116
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE srservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4908
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4104
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3476
- - C:\Windows\SysWOW64\SC.exe
    SC STOP avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2784
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4504
- - C:\Windows\SysWOW64\SC.exe
    SC START Themes
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_dsP.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1736
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /d SYSTEM
      4⤵
      PID:4404
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /e /r SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      PID:2472
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /d SYSTEM
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:4360
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /e /r SYSTEM
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_dhS.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1556
  - - C:\Windows\SysWOW64\diskpart.exe
      Diskpart /s C:\Users\Admin\AppData\Local\Temp\hcdRS.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:3688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4972

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1568

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Autorun.inf

Filesize
145B

MD5
384005d30a82e12a6223861eeb85ac7e

SHA1
2c1aa5dc2744617e8d42e2c3270596fa92cc17c6

SHA256
77a9539c1ede9ec5e331076ca2fe1103c4318b96a5d72904621b3b47159822d7

SHA512
7ff368c01638e9701138f20b108e02b8d1e9e4d7b40443fa00429b8bf6bd0dfcae8e364281756aa95f95982ff79c843a9b466929ed18d1cca00f418dfb2ef019

Download Submit
C:\Users\Admin\AppData\Local\Temp\_dhS.bat

Filesize
30B

MD5
e364adc1af8dcd8855917c5f5e5aa32b

SHA1
95946e4905d32aba06e5e8f8df345ac2e80e688c

SHA256
0712c019ea16c5cd38cd6d71e7087abace758c7abbc63c5e4410fb9f6cb40b5f

SHA512
0faa612365b28429080983c1835595f74d5b1d94cae04418adcc1896871e84a1333f1f8f2715ae2c6951ee3cc452fb47f9bad1e31faa61b04f8fe8222f924d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_dsP.bat

Filesize
154B

MD5
a9175117fbe053af5801fab1fc1d10c2

SHA1
a73480add868d1b38301c6a9357305f5e26a3937

SHA256
b0aed7ed335174276eff28862bc12a7ec2068c7f120d05ed0c1c97ef769c7d16

SHA512
9ca0c82fcfe6179a3fb3031d2f8418ecf5155a876a0f667573a4249e51f72d1a673e182c0b7adc5efad12b246f324212a6e5a9bf1b239b46129dc9fffe8736c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_dyR.txt

Filesize
3B

MD5
3841822014f738222634f8040e3e5fef

SHA1
035aad85eef262df6c47a767762832f093d7411a

SHA256
b259bcb434250e59221023c52831a95998cc89345587a711578627e51ade37ec

SHA512
371b4cb8353a240dd6897b1af0a79d9e96c6e7e481a83f82dd21b175b292824df43f3e41d0c9b28409c2ae8cb2bcfe01619e2dbd560a001795433178b9dc21d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\hcdRS.txt

Filesize
56B

MD5
274a7ef1109cd1b66e34dee14669cbdb

SHA1
dc318e1568d7e5b9440556ec94d42b1f3c1bbafa

SHA256
1343f7baec62086f30e2135dde0a8c152903e0531dd6747ee9b63ec04effff32

SHA512
cbd0b86c452edbf4c1c2d78b724ee913c2f67d53458148f1bc2355d1ee420f1d5719cc0560a677c2189be0f6663cc94e430efce961297e54c251234b0a04ccdf

Download Submit
C:\Windows\DHCP.exe

Filesize
3.2MB

MD5
b586147083e1a88e1b229df4b6c702e4

SHA1
a071422c50570f42c38765b4cee9ca9f27c50311

SHA256
e154ebf012f3cf07db18c18c1515ecc6b534b2d530a73a7d5b5ed871822e2efb

SHA512
ba360ca60ab9da53765a11aa2221940c2f639f57c56250468210d3c6064a857c685c3933aebfe3876ca87f200456aed8570582719ccfed30d6ca1ec4a5b94ed2

Download Submit
C:\Windows\Media\funnu.wav

Filesize
3.0MB

MD5
8c7bff000df48fd2f5914dec726fbc96

SHA1
1a8c6a30efbb310bcc35f7c7893ed83ae6b95089

SHA256
537b94483bd36c1ed4c0bff14ed215ec0ebd7966aba4a9d49e675473b35f5322

SHA512
f997e99a288400bc65177cc0f6e3ed4243d34406d88f3bf1b43da96d554d7a08da823d71dffcf2b36aa616f7b37758290bf31119424d3c27d2160d39fb705561

Download Submit
C:\Windows\SysWOW64\ftdisk.exe

Filesize
3.1MB

MD5
d25a7b4b487062fef28d8d9f8ec2b762

SHA1
f75e9ddf8fee97d6b0a5fc757b7ca49cd574ca0e

SHA256
26fdbfe17e705c737d35e1c724b81f7b56dffd3648459394e8f83595e22324c8

SHA512
c8d4001fac978585a3a4c7dcf5f62416a8b84b2b8e2038dbbd609fc57e7380f93739f2cea0bb3bf854d736e09757004d76864422d21938b52507bc84459a5b54

Download Submit
C:\Windows\SysWOW64\initgdi32.cui

Filesize
3.0MB

MD5
078cb9b595c98ffc17e0a8410df44420

SHA1
dade71931dd3d282340a0b0302d85b0c3c2d5551

SHA256
4f165c8504693c6b854628a1cce6962c2fd419b18311a2aa5e169b508fc80729

SHA512
091a9c0a16678aa2f0a904edbfbd4de34a346cd04cedfa9615941f3b794942c73297b5be62764d5a39adfefc464cb26d3fddc822ab60a737d03e7e5b9be2998f

Download Submit
C:\Windows\Temp\Drctx.bsti

Filesize
1KB

MD5
790c3f0c0ec3525d69efd88e9355de96

SHA1
a605cd2bd84d2d4096cd8f85d3baae9d120f1c70

SHA256
611ab7718034cdeca3b1540ea5b5b3d509750ac2e7d9b423b7f3cc20e52ca376

SHA512
4f383c4820602e61c27390ccc75ee7e76995dc7fdcf6c5e3313f7f754436505919d81b6a83f86478ed3490e66bc6b7e06a1b7e45d5fedccbdc18dc4b96472cb5

Download Submit
C:\Windows\Temp\Iter.inx

Filesize
14KB

MD5
a3b40ae1ea1007b944035a89e96eb21b

SHA1
323f6de8b18484ae979f479653132edbb8677142

SHA256
485c1d5ed308e41fa543d97855766f145867eb91882b172db3eb9ea6280d0ba4

SHA512
d9e26174c3e69fe40b53e8c91554e49b61705352357ecd0afc5a10b548623ec4c3d65799238a99e65c93e1b2e49416510e75470d0f10fddebd411c15002a09c6

Download Submit
C:\Windows\Temp\chk.chm

Filesize
14KB

MD5
144b85f03abbfab788298dfb9fa4b7a8

SHA1
97d2a008c95ca8b094e91b74d99f5959fe3fe7e4

SHA256
02241e88aa5dd0b99d4e9130f4d0557caf5c61eec5d6fc150fe54a5fe1542a0e

SHA512
25e0aedffc33a82807c63ad9694ac5f0605edf769a73986eb5121334db75a700781c0d202575f8b38d34fa20e53b7f1ca931e319179014482e7f336c63a97fef

Download Submit
C:\Windows\Temp\dos.cli

Filesize
1KB

MD5
11ec3af30ebabf1d7e9c36304bf4f57b

SHA1
c5aa8682392037064f8a0b852b84bf78455f5bb8

SHA256
a1d354df63b96640b5e61f9d5ce1d1cb9db501899683fb856d5bffa02a7ceece

SHA512
9223bfc220f0475ee81c220f8286776b2e6a93ac98d4fdc1e24c14de0084224da24c8b2f61bcd0ec6c4357d89ea6fc515fdc3ce78e0778c1bea0a4e3afc5b306

Download Submit
C:\Windows\Temp\ent.bnt

Filesize
1KB

MD5
97e8a304d95bb98ea34d1f54039cebe5

SHA1
26b51816c8145b5fd4a499c90b9c2fe38590a86a

SHA256
b26468b5b105833c8c557441e84892c8e620563ac0fb226a45580fdaa1bd7f4b

SHA512
8bdbdb526cc5933059512bc2f3889be2c2911e4736d0fa9110eb83b648fcff25906ab6993261dd6600888f4ae72e16036ea9f0866b742501b0668c53d8fe0156

Download Submit
C:\Windows\Temp\fldR.lnk

Filesize
17KB

MD5
f4fac00cb7f1638353ae9c0957fd4e69

SHA1
62f5b31658f60fdddc1fe8b2e5e99ebddac7083e

SHA256
67fde9c9f53ac9f14ca76c9bb912ae006083a19465fbf73a45e1e411c1c9e1bb

SHA512
41a031241d05e9f58e24055a71e67a23e03257c1c8c37b4190b92dc3d4a8c0e8d14f87a4d52a548915dc3c152fdf7098306391cc21fd20f045513be0b30de39d

Download Submit
C:\Windows\Temp\msi.cmu

Filesize
14KB

MD5
4659511a62321b0ed69c38a5dfe8fb95

SHA1
d74f52bd08d95776c84777892d1d099dd2836918

SHA256
a7b694859598040c5f854d40600eb02c343279bbc098b559ad6e9ed935082e1e

SHA512
bee9e33a2dbd5a9d254f5d776f81617dd80e06bb10cc26ad9b9535600c1beb490e7806462ac9bafef3af179c4936f51f5f9b4a91bea3c88d31b1f47e457f11fa

Download Submit