7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
Size

2.9MB
MD5

a8f9dfca8c95c3299f0b857b1190c180
SHA1

0cdb5a5a0aec1c9d34697bd01b3282a4de042b53
SHA256

7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323
SHA512

05046b3cfa94d613f2e2f87d096dab097d0a0be27638f46b528c0780d7ff7d7d8250d611d236310c1510640a264421337bdad299656cec79be7bbb4145b86909
SSDEEP

3072:ThzV9Rd1gWIoKMHOlQtjZtIaP5I5hnyypFcBnyypQ1x2Cmswz:dRbOCtjvqifKxms

Score

10^/10

discovery evasion execution persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	DHCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ftdisk.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SYSTEM\DISABLEREGISTRYTOOLS = "1"	ftdisk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SYSTEM\DISABLEREGISTRYTOOLS = "1"	DHCP.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\directx.exe	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3048	DHCP.exe
4316	ftdisk.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	DHCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	DHCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	ftdisk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	ftdisk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe

Drops autorun.inf file 1 TTPs 8 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\Autorun.inf	DHCP.exe
File opened for modification	F:\Autorun.inf	DHCP.exe
File created	C:\Autorun.inf	ftdisk.exe
File opened for modification	C:\Autorun.inf	ftdisk.exe
File created	F:\Autorun.inf	ftdisk.exe
File opened for modification	F:\Autorun.inf	ftdisk.exe
File created	C:\Autorun.inf	DHCP.exe
File opened for modification	C:\Autorun.inf	DHCP.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dhcp.sys	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
File opened for modification	C:\Windows\SysWOW64\ftdisk.sys	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
File opened for modification	C:\Windows\SysWOW64\dpvsrv.dll	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
File opened for modification	C:\Windows\SysWOW64\igfx32.lrc	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
File opened for modification	C:\Windows\SysWOW64\ftdisk.exe	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
File opened for modification	C:\Windows\SysWOW64\helpsrv.exe	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
File opened for modification	C:\Windows\SysWOW64\initgdi32.cui	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
File opened for modification	C:\Windows\SysWOW64\compmhelp.htm	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\media\funnu.wav	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
File opened for modification	C:\Windows\help\ipshelp.hlp	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
File opened for modification	C:\Windows\DHCP.exe	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe

Launches sc.exe 51 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3064	SC.exe
632	SC.exe
4416	SC.exe
436	SC.exe
368	SC.exe
4672	SC.exe
3528	SC.exe
2116	SC.exe
3292	SC.exe
928	SC.exe
552	SC.exe
1096	SC.exe
4344	SC.exe
4768	SC.exe
2428	SC.exe
4808	SC.exe
4860	SC.exe
5048	SC.exe
2484	SC.exe
4044	SC.exe
4356	SC.exe
4024	SC.exe
4312	SC.exe
4276	SC.exe
4260	SC.exe
1012	SC.exe
1492	SC.exe
2476	SC.exe
4488	SC.exe
408	SC.exe
3032	SC.exe
4244	SC.exe
3112	SC.exe
5064	SC.exe
4272	SC.exe
4168	SC.exe
3612	SC.exe
464	SC.exe
812	SC.exe
1356	SC.exe
4472	SC.exe
1640	SC.exe
3616	SC.exe
4076	SC.exe
2492	SC.exe
4820	SC.exe
2612	SC.exe
4200	SC.exe
1888	SC.exe
3504	SC.exe
2772	SC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	diskpart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ftdisk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	diskpart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DHCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1229272821-838170752-839522115-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN	DHCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1229272821-838170752-839522115-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN	ftdisk.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
3048	DHCP.exe
3048	DHCP.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe
4316	ftdisk.exe
4316	ftdisk.exe
3048	DHCP.exe
3048	DHCP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
3048	DHCP.exe
4316	ftdisk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4808	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	82
PID 4424 wrote to memory of 4808	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	82
PID 4424 wrote to memory of 4808	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	82
PID 4424 wrote to memory of 436	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	170
PID 4424 wrote to memory of 436	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	170
PID 4424 wrote to memory of 436	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	170
PID 4424 wrote to memory of 2612	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	84
PID 4424 wrote to memory of 2612	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	84
PID 4424 wrote to memory of 2612	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	84
PID 4424 wrote to memory of 928	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	85
PID 4424 wrote to memory of 928	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	85
PID 4424 wrote to memory of 928	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	85
PID 4424 wrote to memory of 5048	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	86
PID 4424 wrote to memory of 5048	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	86
PID 4424 wrote to memory of 5048	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	86
PID 4424 wrote to memory of 4860	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	87
PID 4424 wrote to memory of 4860	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	87
PID 4424 wrote to memory of 4860	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	87
PID 4424 wrote to memory of 3032	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	88
PID 4424 wrote to memory of 3032	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	88
PID 4424 wrote to memory of 3032	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	88
PID 4424 wrote to memory of 4768	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	89
PID 4424 wrote to memory of 4768	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	89
PID 4424 wrote to memory of 4768	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	89
PID 4424 wrote to memory of 3612	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	90
PID 4424 wrote to memory of 3612	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	90
PID 4424 wrote to memory of 3612	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	90
PID 4424 wrote to memory of 1492	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	91
PID 4424 wrote to memory of 1492	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	91
PID 4424 wrote to memory of 1492	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	91
PID 4424 wrote to memory of 4200	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	181
PID 4424 wrote to memory of 4200	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	181
PID 4424 wrote to memory of 4200	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	181
PID 4424 wrote to memory of 2116	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	93
PID 4424 wrote to memory of 2116	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	93
PID 4424 wrote to memory of 2116	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	93
PID 4424 wrote to memory of 368	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	94
PID 4424 wrote to memory of 368	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	94
PID 4424 wrote to memory of 368	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	94
PID 4424 wrote to memory of 552	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	95
PID 4424 wrote to memory of 552	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	95
PID 4424 wrote to memory of 552	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	95
PID 4424 wrote to memory of 4472	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	96
PID 4424 wrote to memory of 4472	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	96
PID 4424 wrote to memory of 4472	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	96
PID 4424 wrote to memory of 2476	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	97
PID 4424 wrote to memory of 2476	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	97
PID 4424 wrote to memory of 2476	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	97
PID 4424 wrote to memory of 3048	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	115
PID 4424 wrote to memory of 3048	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	115
PID 4424 wrote to memory of 3048	4424	7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe	115
PID 3048 wrote to memory of 2428	3048	DHCP.exe	116
PID 3048 wrote to memory of 2428	3048	DHCP.exe	116
PID 3048 wrote to memory of 2428	3048	DHCP.exe	116
PID 3048 wrote to memory of 3528	3048	DHCP.exe	117
PID 3048 wrote to memory of 3528	3048	DHCP.exe	117
PID 3048 wrote to memory of 3528	3048	DHCP.exe	117
PID 3048 wrote to memory of 4356	3048	DHCP.exe	118
PID 3048 wrote to memory of 4356	3048	DHCP.exe	118
PID 3048 wrote to memory of 4356	3048	DHCP.exe	118
PID 3048 wrote to memory of 4168	3048	DHCP.exe	119
PID 3048 wrote to memory of 4168	3048	DHCP.exe	119
PID 3048 wrote to memory of 4168	3048	DHCP.exe	119
PID 3048 wrote to memory of 4024	3048	DHCP.exe	120

System policy modification 1 TTPs 8 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\EXPLORER	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NOFIND = "1"	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NORUN = "1"	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	DHCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\EXPLORER	ftdisk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NOFIND = "1"	ftdisk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NORUN = "1"	ftdisk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	ftdisk.exe

C:\Users\Admin\AppData\Local\Temp\7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe
"C:\Users\Admin\AppData\Local\Temp\7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323N.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\SC.exe
  SC STOP AudioSrv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4808
- C:\Windows\SysWOW64\SC.exe
  SC DELETE AudioSrv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:436
- C:\Windows\SysWOW64\SC.exe
  SC STOP spooler
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2612
- C:\Windows\SysWOW64\SC.exe
  SC DELETE spooler
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:928
- C:\Windows\SysWOW64\SC.exe
  SC STOP SENS
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5048
- C:\Windows\SysWOW64\SC.exe
  SC DELETE SENS
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4860
- C:\Windows\SysWOW64\SC.exe
  SC STOP wscsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3032
- C:\Windows\SysWOW64\SC.exe
  SC DELETE wscsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Windows\SysWOW64\SC.exe
  SC STOP SharedAccess
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3612
- C:\Windows\SysWOW64\SC.exe
  SC DELETE SharedAccess
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1492
- C:\Windows\SysWOW64\SC.exe
  SC STOP srservice
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4200
- C:\Windows\SysWOW64\SC.exe
  SC DELETE srservice
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Windows\SysWOW64\SC.exe
  SC STOP wuauserv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:368
- C:\Windows\SysWOW64\SC.exe
  SC DELETE wuauserv
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:552
- C:\Windows\SysWOW64\SC.exe
  SC STOP avp
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4472
- C:\Windows\SysWOW64\SC.exe
  SC DELETE avp
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2476
- C:\Windows\DHCP.exe
  C:\Windows\DHCP.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3048
- - C:\Windows\SysWOW64\SC.exe
    SC STOP AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2428
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3528
- - C:\Windows\SysWOW64\SC.exe
    SC STOP spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4356
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4168
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4024
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3292
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2772
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2492
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1096
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1356
- - C:\Windows\SysWOW64\SC.exe
    SC STOP srservice
    3⤵
    - Launches sc.exe
    PID:4044
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE srservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3112
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wuauserv
    3⤵
    - Launches sc.exe
    PID:4244
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3504
- - C:\Windows\SysWOW64\SC.exe
    SC STOP avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1640
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1012
- - C:\Windows\SysWOW64\SC.exe
    SC START Themes
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_dsP.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:928
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /d SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      PID:3284
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /e /r SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /d SYSTEM
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:1884
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /e /r SYSTEM
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:3580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_dhS.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2568
  - - C:\Windows\SysWOW64\diskpart.exe
      Diskpart /s C:\Users\Admin\AppData\Local\Temp\hcdRS.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
- - C:\Windows\SysWOW64\SC.exe
    SC STOP Themes
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4416
- C:\Windows\SysWOW64\ftdisk.exe
  C:\Windows\system32\ftdisk.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:4316
- - C:\Windows\SysWOW64\SC.exe
    SC STOP AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4672
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE AudioSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4076
- - C:\Windows\SysWOW64\SC.exe
    SC STOP spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4820
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE spooler
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4260
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4276
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SENS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1888
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:436
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4272
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:812
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4344
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:464
- - C:\Windows\SysWOW64\SC.exe
    SC STOP srservice
    3⤵
    - Launches sc.exe
    PID:2484
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE srservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3064
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5064
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4488
- - C:\Windows\SysWOW64\SC.exe
    SC STOP avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3616
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE avp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4312
- - C:\Windows\SysWOW64\SC.exe
    SC START Themes
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_dsP.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1320
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /d SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      PID:3444
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /e /r SYSTEM
      4⤵
      System Location Discovery: System Language Discovery
      PID:368
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /d SYSTEM
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:1912
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /e /r SYSTEM
      4⤵
      Enumerates connected drives
      PID:3616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_dhS.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516
  - - C:\Windows\SysWOW64\diskpart.exe
      Diskpart /s C:\Users\Admin\AppData\Local\Temp\hcdRS.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2680

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3132

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4200

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4364

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_dhS.bat

Filesize
30B

MD5
e364adc1af8dcd8855917c5f5e5aa32b

SHA1
95946e4905d32aba06e5e8f8df345ac2e80e688c

SHA256
0712c019ea16c5cd38cd6d71e7087abace758c7abbc63c5e4410fb9f6cb40b5f

SHA512
0faa612365b28429080983c1835595f74d5b1d94cae04418adcc1896871e84a1333f1f8f2715ae2c6951ee3cc452fb47f9bad1e31faa61b04f8fe8222f924d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_dsP.bat

Filesize
154B

MD5
a9175117fbe053af5801fab1fc1d10c2

SHA1
a73480add868d1b38301c6a9357305f5e26a3937

SHA256
b0aed7ed335174276eff28862bc12a7ec2068c7f120d05ed0c1c97ef769c7d16

SHA512
9ca0c82fcfe6179a3fb3031d2f8418ecf5155a876a0f667573a4249e51f72d1a673e182c0b7adc5efad12b246f324212a6e5a9bf1b239b46129dc9fffe8736c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_dyR.txt

Filesize
3B

MD5
3841822014f738222634f8040e3e5fef

SHA1
035aad85eef262df6c47a767762832f093d7411a

SHA256
b259bcb434250e59221023c52831a95998cc89345587a711578627e51ade37ec

SHA512
371b4cb8353a240dd6897b1af0a79d9e96c6e7e481a83f82dd21b175b292824df43f3e41d0c9b28409c2ae8cb2bcfe01619e2dbd560a001795433178b9dc21d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\hcdRS.txt

Filesize
56B

MD5
274a7ef1109cd1b66e34dee14669cbdb

SHA1
dc318e1568d7e5b9440556ec94d42b1f3c1bbafa

SHA256
1343f7baec62086f30e2135dde0a8c152903e0531dd6747ee9b63ec04effff32

SHA512
cbd0b86c452edbf4c1c2d78b724ee913c2f67d53458148f1bc2355d1ee420f1d5719cc0560a677c2189be0f6663cc94e430efce961297e54c251234b0a04ccdf

Download Submit
C:\Windows\DHCP.exe

Filesize
3.1MB

MD5
86f1d3b34892cbc7f284538efeb3b20d

SHA1
ca1a9de05b1539c510fe8421749580b0eb0e8610

SHA256
932d8fbf298ade0d4c78e91624839a4dc670e187aa18d6218a669355786ed364

SHA512
443c7284992e5d3eb480496c9264d78075fbd1f29dea6390cbd42ea9a29432c09267503c20999b172fe83c8525fab2f1af5fc319c3db8949fbd809768281f5c4

Download Submit
C:\Windows\Media\funnu.wav

Filesize
2.9MB

MD5
a8f9dfca8c95c3299f0b857b1190c180

SHA1
0cdb5a5a0aec1c9d34697bd01b3282a4de042b53

SHA256
7eff6aac597c90965a935990e8f148d490cc9f1332d9785dd87dbe1abeccd323

SHA512
05046b3cfa94d613f2e2f87d096dab097d0a0be27638f46b528c0780d7ff7d7d8250d611d236310c1510640a264421337bdad299656cec79be7bbb4145b86909

Download Submit
C:\Windows\SysWOW64\ftdisk.exe

Filesize
3.0MB

MD5
ebcb4e0da486ebcc68f8a5aa0b8e4890

SHA1
1f366a36fd169656d6d6527540cd667e95daef03

SHA256
c83ac5d0e5e53b77f5fb2b22daacc3d7d81bdb59a5cd42e07b427db2b61c1241

SHA512
b9d53945701bf015acfd4b1091256217fc92ab45bcbd9e0131872aaca6154876bf56c447ee51142a86bc1b9f7ebbd3dfd22a9e93fab982f3482ffb6ac20f6251

Download Submit
C:\Windows\Temp\Drctx.bsti

Filesize
1KB

MD5
790c3f0c0ec3525d69efd88e9355de96

SHA1
a605cd2bd84d2d4096cd8f85d3baae9d120f1c70

SHA256
611ab7718034cdeca3b1540ea5b5b3d509750ac2e7d9b423b7f3cc20e52ca376

SHA512
4f383c4820602e61c27390ccc75ee7e76995dc7fdcf6c5e3313f7f754436505919d81b6a83f86478ed3490e66bc6b7e06a1b7e45d5fedccbdc18dc4b96472cb5

Download Submit
C:\Windows\Temp\Iter.inx

Filesize
14KB

MD5
a3b40ae1ea1007b944035a89e96eb21b

SHA1
323f6de8b18484ae979f479653132edbb8677142

SHA256
485c1d5ed308e41fa543d97855766f145867eb91882b172db3eb9ea6280d0ba4

SHA512
d9e26174c3e69fe40b53e8c91554e49b61705352357ecd0afc5a10b548623ec4c3d65799238a99e65c93e1b2e49416510e75470d0f10fddebd411c15002a09c6

Download Submit
C:\Windows\Temp\chk.chm

Filesize
14KB

MD5
144b85f03abbfab788298dfb9fa4b7a8

SHA1
97d2a008c95ca8b094e91b74d99f5959fe3fe7e4

SHA256
02241e88aa5dd0b99d4e9130f4d0557caf5c61eec5d6fc150fe54a5fe1542a0e

SHA512
25e0aedffc33a82807c63ad9694ac5f0605edf769a73986eb5121334db75a700781c0d202575f8b38d34fa20e53b7f1ca931e319179014482e7f336c63a97fef

Download Submit
C:\Windows\Temp\dos.cli

Filesize
1KB

MD5
11ec3af30ebabf1d7e9c36304bf4f57b

SHA1
c5aa8682392037064f8a0b852b84bf78455f5bb8

SHA256
a1d354df63b96640b5e61f9d5ce1d1cb9db501899683fb856d5bffa02a7ceece

SHA512
9223bfc220f0475ee81c220f8286776b2e6a93ac98d4fdc1e24c14de0084224da24c8b2f61bcd0ec6c4357d89ea6fc515fdc3ce78e0778c1bea0a4e3afc5b306

Download Submit
C:\Windows\Temp\ent.bnt

Filesize
1KB

MD5
97e8a304d95bb98ea34d1f54039cebe5

SHA1
26b51816c8145b5fd4a499c90b9c2fe38590a86a

SHA256
b26468b5b105833c8c557441e84892c8e620563ac0fb226a45580fdaa1bd7f4b

SHA512
8bdbdb526cc5933059512bc2f3889be2c2911e4736d0fa9110eb83b648fcff25906ab6993261dd6600888f4ae72e16036ea9f0866b742501b0668c53d8fe0156

Download Submit
C:\Windows\Temp\fldR.lnk

Filesize
17KB

MD5
f4fac00cb7f1638353ae9c0957fd4e69

SHA1
62f5b31658f60fdddc1fe8b2e5e99ebddac7083e

SHA256
67fde9c9f53ac9f14ca76c9bb912ae006083a19465fbf73a45e1e411c1c9e1bb

SHA512
41a031241d05e9f58e24055a71e67a23e03257c1c8c37b4190b92dc3d4a8c0e8d14f87a4d52a548915dc3c152fdf7098306391cc21fd20f045513be0b30de39d

Download Submit
C:\Windows\Temp\msi.cmu

Filesize
14KB

MD5
4659511a62321b0ed69c38a5dfe8fb95

SHA1
d74f52bd08d95776c84777892d1d099dd2836918

SHA256
a7b694859598040c5f854d40600eb02c343279bbc098b559ad6e9ed935082e1e

SHA512
bee9e33a2dbd5a9d254f5d776f81617dd80e06bb10cc26ad9b9535600c1beb490e7806462ac9bafef3af179c4936f51f5f9b4a91bea3c88d31b1f47e457f11fa

Download Submit
F:\Autorun.inf

Filesize
145B

MD5
384005d30a82e12a6223861eeb85ac7e

SHA1
2c1aa5dc2744617e8d42e2c3270596fa92cc17c6

SHA256
77a9539c1ede9ec5e331076ca2fe1103c4318b96a5d72904621b3b47159822d7

SHA512
7ff368c01638e9701138f20b108e02b8d1e9e4d7b40443fa00429b8bf6bd0dfcae8e364281756aa95f95982ff79c843a9b466929ed18d1cca00f418dfb2ef019

Download Submit