1db766c15e939bbd900cdda0737dce4788310565c613b7090b5a1cc7d1b67380

Resubmissions

02/10/2024, 16:56

241002-vftaka1anf8

02/10/2024, 15:19

241002-sqh68sxanf7

Analysis

max time kernel
43s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Minecraft.exe
Size 3.9MB
Sample241002-vftaka1anf
SHA256 1db766c15e939bbd900cdda0737dce4788310565c613b7090b5a1cc7d1b67380
MD5 e8faa3d0c85f50ddbe65a854653519b4
SHA1 1527822325e35fa2e7b43c4192d308af6a3d0ea7
SHA512 949a22815d19e1a78e361eb3e5f6ae82dd86d475c93f10ef4e73ac3d944793448042df872583cd48dc5b2aac121c503fc543aed660472415095a3658b9c66eb1
SSDEEP 98304:Kr1PbRCqtEG/TUAnxj63RcPfcmfbzORDP2o3nJDKvJ:gPbRHEG5j6hcnJO9PLnOJ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\DRIVERS\SETE9A4.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxDrv.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETE9A4.tmp	MsiExec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
3980	anletblf.we1.exe
4584	ce-installer_7.14.2_vbox-6.1.20.exe
4304	ce_7.14.2_windows_x86_64.exe

Loads dropped DLL 43 IoCs

pid	Process
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
960	MsiExec.exe
1644	MsiExec.exe
1644	MsiExec.exe
1644	MsiExec.exe
1644	MsiExec.exe
960	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	anletblf.we1.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
81	404	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 9 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version	Minecraft.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	Minecraft.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	Minecraft.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version	Minecraft.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	Minecraft.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	Minecraft.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	Minecraft.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV	Minecraft.exe
Key opened	\REGISTRY\MACHINE\Software\Avast Software\Avast	Minecraft.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRVSTORE	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.inf	MsiExec.exe
File opened for modification	C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.inf	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.cat	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\sdk\install\vboxapi\__init__.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuth.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ubuntu_preseed.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel5_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\msvcr100.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxHostChannel.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_uk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDD.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\debian_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qminimal.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestAdditions.iso	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\lgw_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_tr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxC.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxCAPI.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSDL.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxWebSrv.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\fedora_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_zh_CN.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UICommon.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel3_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_nt6_unattended.xml	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\DbgPlugInDiggers.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\msvcr100.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\SDL.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_CN.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxBugReport.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuthSimple.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDTrace.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox.chm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_eu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_uk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_lt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel4_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_es.qm	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57d3ea.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCC5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d3ea.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDDBE.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d3ee.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD50.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE215.tmp	msiexec.exe
File created	C:\Windows\Installer\{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA24.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE85F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9F4.tmp	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Minecraft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce_7.14.2_windows_x86_64.exe

Modifies data under HKEY_USERS 60 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "126"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{245D88BD-800A-40F8-87A6-170D02249A55}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{3BA329DC-659C-488B-835C-4ECA7AE71C6C}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C39EF4D6-7532-45E8-96DA-EB5986AE76E4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D7B98D2B-30E8-447E-99CB-E31BECAE6AE4}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678FBD9A-93AF-42A7-7F13-79AD6EF1A18D}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CA2ADBA-8F30-401B-A8CD-FE31DBE839C0}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{392F1DE4-80E1-4A8A-93A1-67C5F92A838A}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E8C25D4D-AC97-4C16-B3E2-81BD8A57CC27}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F05D7E60-1BCF-4218-9807-04E036CC70F1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B66349B5-3534-4239-B2DE-8E1535D94C0B}\ = "ISharedFolderChangedEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E14C189-4A75-437E-B0BB-7E7C90D0DF2A}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DA2DEC7-71B2-4817-9A64-4ED12C17388E}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{A0BAD6DF-D612-47D3-89D4-DB3992533948}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9A0C183-7071-4894-93D6-DCBEC010FA91}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D0D93830-70A2-487E-895E-D3FC9679F7B3}\NumMethods\ = "15"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D37FE88F-0979-486C-BAA1-3ABB144DC82D}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VirtualBox.VirtualBox	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\ProgID\ = "VirtualBox.VirtualBoxClient.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4376693C-CF37-453B-9289-3B0F521CAF27}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{59A235AC-2F1A-4D6C-81FC-E3FA843F49AE}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8E3496E-735F-4FDE-8A54-427D49409B5F}\ = "ICloudNetwork"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B66349B5-3534-4239-B2DE-8E1535D94C0B}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{CADEF0A2-A1A9-4AC2-8E80-C049AF69DAC8}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39B4E759-1EC0-4C0F-857F-FBE2A737A256}\NumMethods\ = "16"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{89A63ACE-0C65-11EA-AD23-0FF257C71A7F}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{181DFB55-394D-44D3-9EDB-AF2C4472C40A}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B0A0904D-2F05-4D28-855F-488F96BAD2B2}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B79DE686-EABD-4FA6-960A-F1756C99EA1C}\ = "IGuestSessionRegisteredEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{755E6BDF-1640-41F9-BD74-3EF5FD653250}\ = "IKeyboard"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{13A11514-402E-022E-6180-C3944DE3F9C8}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FD82A4B0C2D65943AA4D477AB9223CC\VBoxNetwork = "\x06VBoxApplication"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5ABC823-04D0-4DB6-8D66-DC2F033120E1}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50CE4B51-0FF7-46B7-A138-3C6E5AC946B4}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B2F98F8-9641-4397-854A-040439D0114B}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EA9227C-E9BB-49B3-BFC7-C5171E93EF38}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E8C25D4D-AC97-4C16-B3E2-81BD8A57CC27}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{08E25756-08A2-41AF-A05F-D7C661ABAEBE}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E775EA3-9070-4F9C-B0D5-53054496DBE0}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10CD08D0-E8B8-4838-B10C-45BA193734C1}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FAEF61E-6E15-4F71-A6A5-94E707FAFBCC}\ = "INATEngine"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1E8D3F27-B45C-48AE-8B36-D35E83D207AA}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5094F67A-8084-11E9-B185-DBE296E54799}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{41A033B8-CC87-4F6E-A0E9-47BB7F2D4BE5}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EA9227C-E9BB-49B3-BFC7-C5171E93EF38}\NumMethods\ = "17"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CB6F0F2C-8384-11E9-921D-8B984E28A686}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00AE6AF4-00A7-4104-0009-49BC00B2DA80}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00AE6AF4-00A7-4104-0009-49BC00B2DA80}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B1D978B8-F7B7-4B05-900E-2A9253C00F51}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E775EA3-9070-4F9C-B0D5-53054496DBE0}\NumMethods\ = "18"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{20479EAF-D8ED-44CF-85AC-C83A26C95A4D}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4376693C-CF37-453B-9289-3B0F521CAF27}\ = "IStateChangedEvent"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9622225A-5409-414B-BD16-77DF7BA3451E}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7B98D2B-30E8-447E-99CB-E31BECAE6AE4}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13A11514-402E-022E-6180-C3944DE3F9C8}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{890ED3DC-CC19-43FA-8EBF-BAECB6B9EC87}\ = "IVirtualBoxSDS"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73AF4152-7E67-4144-BF34-41C38E8B4CC7}\ = "IBIOSSettings"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C365FB7B-4430-499F-92C8-8BED814A567A}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678FBD9A-93AF-42A7-7F13-79AD6EF1A18D}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1BCC6D5-7966-481D-AB0B-D0ED73E28135}\NumMethods\ = "14"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FF5BEFC3-4BA3-7903-2AA4-43988BA11554}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B5191A7C-9536-4EF8-820E-3B0E17E5BBC8}\ = "IGuestFileIOEvent"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\progId_VirtualBox.Shell.ova\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FD82A4B0C2D65943AA4D477AB9223CC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{334DF94A-7556-4CBC-8C04-043096B02D82}\ = "IBandwidthGroupChangedEvent"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
4916	Minecraft.exe
404	msiexec.exe
404	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	Minecraft.exe
Token: SeShutdownPrivilege	4700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4700	msiexec.exe
Token: SeSecurityPrivilege	404	msiexec.exe
Token: SeCreateTokenPrivilege	4700	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4700	msiexec.exe
Token: SeLockMemoryPrivilege	4700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4700	msiexec.exe
Token: SeMachineAccountPrivilege	4700	msiexec.exe
Token: SeTcbPrivilege	4700	msiexec.exe
Token: SeSecurityPrivilege	4700	msiexec.exe
Token: SeTakeOwnershipPrivilege	4700	msiexec.exe
Token: SeLoadDriverPrivilege	4700	msiexec.exe
Token: SeSystemProfilePrivilege	4700	msiexec.exe
Token: SeSystemtimePrivilege	4700	msiexec.exe
Token: SeProfSingleProcessPrivilege	4700	msiexec.exe
Token: SeIncBasePriorityPrivilege	4700	msiexec.exe
Token: SeCreatePagefilePrivilege	4700	msiexec.exe
Token: SeCreatePermanentPrivilege	4700	msiexec.exe
Token: SeBackupPrivilege	4700	msiexec.exe
Token: SeRestorePrivilege	4700	msiexec.exe
Token: SeShutdownPrivilege	4700	msiexec.exe
Token: SeDebugPrivilege	4700	msiexec.exe
Token: SeAuditPrivilege	4700	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4700	msiexec.exe
Token: SeChangeNotifyPrivilege	4700	msiexec.exe
Token: SeRemoteShutdownPrivilege	4700	msiexec.exe
Token: SeUndockPrivilege	4700	msiexec.exe
Token: SeSyncAgentPrivilege	4700	msiexec.exe
Token: SeEnableDelegationPrivilege	4700	msiexec.exe
Token: SeManageVolumePrivilege	4700	msiexec.exe
Token: SeImpersonatePrivilege	4700	msiexec.exe
Token: SeCreateGlobalPrivilege	4700	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4916	Minecraft.exe
4964	LogonUI.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3980	4916	Minecraft.exe	97
PID 4916 wrote to memory of 3980	4916	Minecraft.exe	97
PID 3980 wrote to memory of 4584	3980	anletblf.we1.exe	99
PID 3980 wrote to memory of 4584	3980	anletblf.we1.exe	99
PID 4584 wrote to memory of 4700	4584	ce-installer_7.14.2_vbox-6.1.20.exe	101
PID 4584 wrote to memory of 4700	4584	ce-installer_7.14.2_vbox-6.1.20.exe	101
PID 404 wrote to memory of 960	404	msiexec.exe	105
PID 404 wrote to memory of 960	404	msiexec.exe	105
PID 404 wrote to memory of 1644	404	msiexec.exe	106
PID 404 wrote to memory of 1644	404	msiexec.exe	106
PID 404 wrote to memory of 5032	404	msiexec.exe	109
PID 404 wrote to memory of 5032	404	msiexec.exe	109
PID 404 wrote to memory of 5032	404	msiexec.exe	109
PID 4584 wrote to memory of 4304	4584	ce-installer_7.14.2_vbox-6.1.20.exe	111
PID 4584 wrote to memory of 4304	4584	ce-installer_7.14.2_vbox-6.1.20.exe	111
PID 4584 wrote to memory of 4304	4584	ce-installer_7.14.2_vbox-6.1.20.exe	111

C:\Users\Admin\AppData\Local\Temp\Minecraft.exe
"C:\Users\Admin\AppData\Local\Temp\Minecraft.exe"
1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\anletblf.we1.exe
  "C:\Users\Admin\AppData\Local\Temp\anletblf.we1.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\SYSTEM32\msiexec.exe
      "msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe
      "ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S13-11 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2488

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8A50B3D4AF3CA9F97A172B680A94349C
  2⤵
  - Loads dropped DLL
  PID:960
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding FE148CD5A1DFFBB3D3E6948C6720B93E E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 00822E9B2593C589AE899D321754962B M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5032

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b0055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57d3ed.rbs

Path C:\Config.Msi\e57d3ed.rbs
Size 898KB
SHA256 49f889dec94c957e078046a1d0cf02dc9660352ce529f95bd138918da1120ffc
MD5 150a875af07f38e294aa83fb1972cdfe
SHA1 62b4100db7567ced3038ec5ae0ee6ccd4661db65
SHA512 3ec52f631bbd03292c01765c2593d09283b085c516dd43404ff8fe1d4070e4756a4443e35b6f069c71ae81bf00c09aec087fe71e9bb12fdfed0da541112c7acc
SSDEEP 6144:9uG1AiB9PqvByOQV9xEMvvKKqS4s9Wj+WDUweVwHmkLlcD/lnr/3yIWAB111X:tN0kDhDWj+WDUweVFkSTlGIWA
MD5 SHA1 SHA512 SSDEEP

Submit Download

VBoxProxyStub.dll

Path C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll
Size 964KB
SHA256 f4d28c75413b99f769e2d924f2b5c1212c3baa39b3f99fe2de2990acde30edce
MD5 db279cd1288ac7da6e6dc8c0d7f90844
SHA1 f16d8d6902725cf4d746046ac39e36ed633f3e93
SHA512 e029fd193331498cd2955a2d67e4ae2f168676f80003d8a4ef403bb84c6d38292ab0a1aff56c40e29471f4ebf798fca1defc825b1319a238da22384bce25be6e
SSDEEP 6144:D3JD8eC+UUhPB9VmRbUXlEhUJDh2iFolMhGI4erBdB4fDZ4WaAC+1mar4Uik3N/4:H8nxlpMgUvIZR0oI
MD5 SHA1 SHA512 SSDEEP

Submit Download

VBoxDrv.cat

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.cat
Size 27KB
SHA256 b0f66ef2d283c5753a855fe6d72c227a386cdf91eb7cb73bd2562942e856f9e7
MD5 67fe3ed0f452c88fd7487639daca2e14
SHA1 a74dbc1dc66e4a6300641c79d3b73b2fd2c2e5f9
SHA512 2a9499aa242ec8d4aa42ac11ffac3b92cdd58ac4aec2c88fc330c777e7d9a04a75cedfee2f5062d994ee2bea400cadaf1d962f911f79584f6cf67c36c49793d3
SSDEEP 384:V4hOyNP1MmVDGiyZegrhjXiuLh34krsl3r+f:GhVdMmVDGFThVt34e
MD5 SHA1 SHA512 SSDEEP

Submit Download

VBoxDrv.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.inf
Size 2KB
SHA256 daf6eea615317b6e83789725d3229926278b6a20907ef1322297841d32f6c62a
MD5 d3de6c5ed26af4abbf70049b14733464
SHA1 e00fb435112c6d01d29dde0bae388f13e9a921b6
SHA512 78fe5a58ad7597d7ff33161a7038ee6d2a18e335fb21bbb1fb4e359cdc012125ab48c54cef62b6389d23aca6aed72b2608d3b1119d187044adfb963deaef1c28
MD5 SHA1 SHA512

Submit Download

VBoxDrv.sys

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.sys
Size 1013KB
SHA256 05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b
MD5 321ccdb9223b0801846b9ad131ac4d81
SHA1 ac8fb0fc82a8c30b57962fe5d869fda534053404
SHA512 75b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a
SSDEEP 12288:CXYAhsH3POTVWXUoRJfXRML5cHTe3n2A9ICnPIjc8d0q8d8XG:nAhk3PKWXU+gLkTeGA9ICnPCV8aG
MD5 SHA1 SHA512 SSDEEP

Submit Download

VBoxProxyStub-x86.dll

Path C:\Program Files\Oracle\VirtualBox\x86\VBoxProxyStub-x86.dll
Size 581KB
SHA256 349eed09bcaa2630a26fc32dacefaa0aed32263ac3104a36376ca3cf76732d33
MD5 029b62786b7418fce3360abb7b3e9e25
SHA1 1fe9c3258bbba504c403454318a72bf7172f577b
SHA512 d15e5d69fc9ad5bc3a922de6fe0376f9b15f808484cfb4128038055bc5a3fd7c321c1402052913f28daf65f499ad43e8a6f756de0b0f35683249b271f1c06e39
SSDEEP 6144:9SHVDiXWKuLc+1mar4Uik3N//MfqXQrvc6/7leBs2AGKxN:kHV/3lpMgUvdUMxN
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OCommonResources.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\H2OCommonResources.dll
Size 5.7MB
SHA256 3a59cf866661a07ea7c2cb88c957a966fc5a24e1f0fb2b764195b79702c18239
MD5 7057b9c92d465cd8582b3af21d44239c
SHA1 fddb6a013467a9973c7eaeb0ceccc94209d5cfdf
SHA512 da80adce2bd141a73caae5bbce7a38751a34534af1fa6e8bf0d6c4456c97f8c0dcf73d231a07e9eff860471785850be4a8f2f243eb04982bd3fe83fa0fc8a7c8
SSDEEP 98304:D0lVqJZXNOujZWBh1jwJb9QpFiCjzMIPYxY9HjmgMDZZbyHwazLDrqNPVIG:YzqJnZE1j3pFiCp0Y9yZOvrqNPZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2ODAL.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\H2ODAL.dll
Size 17KB
SHA256 f28041ab9edb612da9e7c42bb4d940e69fb440d4cb786f969512e0b61e54e637
MD5 d7134e64bdce2ea5fa7504781a57adaa
SHA1 5a72a075736b8ce2c3375a745c8e7cdc4320ed15
SHA512 9a108406857af08238d73c56dfa1ea3f42eba40bdd65915aea74c871ba3aa0f75cbf2ad7f5bce2ac40d5efeffd16f3bfeb70f88e88798419a8fdef77ef2fef54
SSDEEP 384:DmvAus7esV6N9a9hD4Tel9LV3gcmL05b:DDusSsV9Rtc05b
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OModels.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\H2OModels.dll
Size 78KB
SHA256 f5138fe637e5b1b735fb2e54607147ceb973cc537ad07690ef1bca27ac6da4b5
MD5 e57646a871a04782fd546583a01d62b4
SHA1 983fad031d66098df6331e0b562d69853ccb37e2
SHA512 65d4f51417a19d0cc16ec47f21ab3a1d8877864015098a7bdf21286eaf4be05356381e15ba9d7a27baf9567f0fa47f17cfb35e6af6bab495b617dde9d7d89ef0
SSDEEP 1536:bZ8gMK44suOo5//DK8XWBYDSdk/epQyHt6PKyCBvNLh3qr8TENV+c1yiW:qgMK44X9e8XWBYDSdk/epQVVC5NLg8Tt
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OResources.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\H2OResources.dll
Size 20KB
SHA256 8881f487bc800630d0292aff9ff8364c228e634710f1e4766616b0ab7f9a724b
MD5 d2f164645dc4fbff8458306adf7b1870
SHA1 85b787ea895d08925d06ff021eff2412593db40d
SHA512 21c729c85ef36cdda3d1574a9cdf8fc18d7c868ff4072c8e5e8968c57bc6c239ba5d627189ad0ac24d04d9eb5390b090882f8d17da09fac308b81acf4617d4dd
SSDEEP 384:CiQ+OA/5erKqbZ5kXl0FCHYIptbO3zwYHIvhp5uwb9:cAKPkXl0Q4Ipk8Y0GI
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OServices.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\H2OServices.dll
Size 168KB
SHA256 eed0eabb8ecbf5d30abc0ed992f2ec2f28fa2e7d5588a090d357af424a4ddd84
MD5 046edd0ee8296e611920786c4f25cd7a
SHA1 597eb52d27c61dcbb076e03f6a2fa71d6733a61b
SHA512 f7a3877aa7d452dc4d7c0b37c1da088d5f211342c934c4419873a0fca267cfd5911e217fb45c0cb10eaa78526733a996b0e2ea2de1c35abe2fc4305a355ed79a
SSDEEP 3072:A1ng4X/VCJVy9TfqKlhniQFrF7yLtTbZOAdfyaRZ4wXBSotNm11/:A1g44ChfZpiQ/7yLdbUUWwLNm
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OUtilities.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\H2OUtilities.dll
Size 125KB
SHA256 fe4942cf5b5fdfd04e6af4cdaa128fbadd35b9a4c6d7d6b4407a02ce55131932
MD5 de46930143bfc9b30f0f68ef2317a320
SHA1 e6b48151e5f3fcc5d9f300b330e9aeb7602adcf9
SHA512 8e23169277ba0cbc0b8f42db19140d1edf66a9f24f115be19c98f3acf64ea871d8bb8923d709e8b1dbfda0abc0382f5326457c929d422099d8e7a1d26560bea3
SSDEEP 3072:2DM+fL+Yg9YEBi4EX5FD7bbvcv0qnOvb:2A+fL+Yg9Y+i48b
MD5 SHA1 SHA512 SSDEEP

Submit Download

H2OViewModels.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\H2OViewModels.dll
Size 9KB
SHA256 295b970cd45ca0d9577d5ce875de5cf92367fcb6c7794e525b00090fa1ad62d6
MD5 0ef343471a5777b6f90d9ae85164449e
SHA1 90a754b788f48a1a1e799d77cbd5d84e60bcdae4
SHA512 d939ccb622f4b519f5aa602f8793ba69492e77b1f73a710997899b9a716f1425044bf8a86b1ad3335eb81339d9cdc3ef7f641eb7d4c1ab29486210fafe76f14c
SSDEEP 192:zNX8C8BbRTRouc/IZ6yub2InQGWEOSZlrvuxWEoMF4ewk8ZKQa:aRTaucwQzaInQGWEOSZlrvQnpeewzZKH
MD5 SHA1 SHA512 SSDEEP

Submit Download

HtmlAgilityPack.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\HtmlAgilityPack.dll
Size 154KB
SHA256 23056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f
MD5 17220f65bd242b6a491423d5bb7940c1
SHA1 a33fabf2b788e80f0f7f84524fe3ed9b797be7ad
SHA512 bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e
SSDEEP 1536:Iuvsy1RTMOgbULSmwAh+NwPyT71hjo6/bKYKeHDYwlELbUGjUin7K5YOEZJ5u6Dw:VvsmRYOgbUvUlr/njY0FEZeE0BL
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyDownloader.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\MyDownloader.Core.dll
Size 56KB
SHA256 1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
MD5 f931e960cc4ed0d2f392376525ff44db
SHA1 1895aaa8f5b8314d8a4c5938d1405775d3837109
SHA512 7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
SSDEEP 768:a/nineequbTcsaB8+bfAvCIlATfL99Vi2oc4w:yineezcsaBbfCCRTfL/V5Mw
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyDownloader.Extension.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\MyDownloader.Extension.dll
Size 168KB
SHA256 c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
MD5 28f1996059e79df241388bd9f89cf0b1
SHA1 6ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA512 9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
SSDEEP 3072:uuAjNMSC7Mdlszb/0DfV9H8I++Wy/6EAwZZIm11ufs48TVB2:b7rzb/0DfDH8I++Wy/6EAwTIm1gfa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Newtonsoft.Json.dll
Size 541KB
SHA256 56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583
MD5 9de86cdf74a30602d6baa7affc8c4a0f
SHA1 9c79b6fbf85b8b87dd781b20fc38ba2ac0664143
SHA512 dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641
SSDEEP 6144:+lLkxTZNddfQr7w9Tckw+CQuahz0PQ78X/Wva/KFWi9Mb5hijnFrBV9r3iCGH5jY:+ybNxFxhPRGeLByjfjuGO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ninject.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Ninject.dll
Size 133KB
SHA256 3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701
MD5 8db691813a26e7d0f1db5e2f4d0d05e3
SHA1 7c7a33553dd0b50b78bf0ca6974c77088da253eb
SHA512 d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f
SSDEEP 3072:4n+0ukQ9BqyPqwtE6qqfupoLUq7SK+giWqRHqoq7fUgWjwwJkvX5r+5MfkHaO1/X:s+0ukQ9BqyPqwtE6qqfupoLUq7SK+gig
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfferSDK.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\OfferSDK.dll
Size 178KB
SHA256 9a059883bee5177723b1a971172010a349db64c1dd60fcb3bbf190fe0e78bb07
MD5 1105b8b33b0f019651566b87959512e2
SHA1 14d9ee07349bb349c32fc3b0e80087fb75e6bacb
SHA512 aaca1803c2618cf92306b6dd71b6d8d505c0fe8cd0c6262be268d7097251cd4edcfbeb60be109488958956b570485f2ea94a4ab7cc8e8c149f55759741014010
SSDEEP 3072:+uiX5Ik7sXtXQalLwSvUYZOcqxPOZr9SyDVSQ0m3O76TVfEW+rEGsElN7Os0q27t:+uiX5Ik7+tXPlLwSvUYZOcqxPOZr9Sm/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfferPage.html

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Resources\OfferPage.html
Size 1KB
SHA256 465a40a1ed05bea8f1d7585aeab3ffd68823944851d5918e24cd9c1e8d97a556
MD5 85b54a2a99b52f36ab7fdf691dc5aaca
SHA1 360b65a3a0357c63736afb0bb0aed3b720339592
SHA512 53c847287962006ead177fe0cf52ec980ec363616b4ca77c147d29eed88ed1d113afd37f54514ab28c4ecea60e7053170f8a9b8bf79a171889c2610ed3088362
MD5 SHA1 SHA512

Submit Download

style.css

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Resources\style.css
Size 52KB
SHA256 bc33ff136252c911c72dfacacc13cb99f8c33de7e5cb8898e6fa388f22d0f2e7
MD5 6fd8d9b82b6ef1ddbc690a639f09821a
SHA1 80609ab076d19b6879ec46f891699d0d62610dbf
SHA512 079ff635c0190c470c989026f76e082da451cae26524d5a2bb26c46cdeab37a4cb809efb65487fc4ef56a29f0f9d816f2a503dcda7f8f50ac4978cfaeb4145ca
SSDEEP 768:Wvy+Ll8u7SqeRHShpymgGQBQ1RKJGkAzR3vEFiZ2tuG3SghImRybKSMzoHJ:WvZlA9WVgnBQ1RKGlvnqRzh5tgHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Config.tis

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Resources\tis\Config.tis
Size 291B
SHA256 98f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b
MD5 bf5328e51e8ab1211c509b5a65ab9972
SHA1 480dfb920e926d81bce67113576781815fbd1ea4
SHA512 92bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928
MD5 SHA1 SHA512

Submit Download

EventHandler.tis

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Resources\tis\EventHandler.tis
Size 10KB
SHA256 5c09c6784f3fdc4a6b2998c4c9e02e366265ee5314c0f982859825576dc0eafd
MD5 1116d7747130f4552a91e61a3a6000b1
SHA1 bc36996a664dab24b941ec263679c9d6322e61a2
SHA512 af34413f242b64737ac9f7076e449b0d0485842d653d1cad12b54b868f09817d3595cd935ad7e03003d536127c173d624dd9a031c079fdb8f897ab0b7b9474e8
SSDEEP 192:/kKclOboB4HWkIP83pGWyJHkWkiykiOk4xMd2zIN/XFf+s:iCfw83pLydRByBOXxMd2zIhXFB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Log.tis

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Resources\tis\Log.tis
Size 1014B
SHA256 73ed0be73f408ab8f15f2da73c839f86fef46d0a269607330b28f9564fae73c7
MD5 cef7a21acf607d44e160eac5a21bdf67
SHA1 f24f674250a381d6bf09df16d00dbf617354d315
SHA512 5afb4609ef46f156155f7c1b5fed48fd178d7f3395f80fb3a4fb02f454a3f977d8a15f3ef8541af62df83426a3316d31e1b9e2fd77726cf866c75f6d4e7adc2f
MD5 SHA1 SHA512

Submit Download

TranslateOfferTemplate.tis

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Resources\tis\TranslateOfferTemplate.tis
Size 2KB
SHA256 7b8c76a85261c5f9e40e49f97e01a14320e9b224ff3d6af8286632ca94cf96f8
MD5 551029a3e046c5ed6390cc85f632a689
SHA1 b4bd706f753db6ba3c13551099d4eef55f65b057
SHA512 22a67a8371d2aa2fdbc840c8e5452c650cb161e71c39b49d868c66db8b4c47d3297cf83c711ec1d002bc3e3ae16b1e0e4faf2761954ce56c495827306bab677e
MD5 SHA1 SHA512

Submit Download

ViewStateLoader.tis

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Resources\tis\ViewStateLoader.tis
Size 16KB
SHA256 940ef5e9f28da759fbf3676fba6da5cc4199b78ffc4fefe078ab11d53e70fb0a
MD5 85c33c8207f5fcb2d31c7ce7322771ac
SHA1 6b64f919e6b731447b9add9221b3b7570de25061
SHA512 904188ab57cfb4f3d8c51eb55746ae2589852f271b9fa3840b82bda93f69c9f985e65f67169302d08818b707f36246f83f245470d5175dba5f0ad3a2482740c4
SSDEEP 192:tUv+YgDKoXAuwhunsFA7QNVyTmiFMLv6pA12VETqJ7PkPpnc5TimljfLtFaI+9j0:6mYgBFXwezljfJFaI+9jZWBN4K46O76b
MD5 SHA1 SHA512 SSDEEP

Submit Download

SciterWrapper.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\SciterWrapper.dll
Size 139KB
SHA256 51e42ff1d66f3042e512be1dd60ac1c7b1a2a5307acd191dffcf24ef106c8970
MD5 6cbc4475b6af8a6f68ed8696df09ff2d
SHA1 906e0caab3feac88b372c2c25a083c9149e31dc0
SHA512 7d5d0fcbfaa218ad95918c421f4cc97e5f98090945c8b4f786ee2d92d0fe44698b580838777cddda34fe1e556eac549168df6eb01a9f9041ad915203e52aa023
SSDEEP 3072:bt+gHBedPTQ/0JjLpypoQm4CRkML1wC+gvx:thON9pypBmrRkgwC+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ServiceHide.Net.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.Net.dll
Size 101KB
SHA256 42c2156b7eee3bf8bee8d0c1d3d3f138e059ddda342cf8ee0d723130fb865304
MD5 fc3be382cc3a7b4fafee4fdd465cab2e
SHA1 334da714147aac5d32116ba1753c88e2d6956705
SHA512 2e2d99c93d9f89fca51ae744b9ad0ad6d86dd97cb4a81913e0783984e1d16173eeaf6b3123a4db6241ee0b71b461fb47d297eb20ea501c37c608e15294cf39f4
SSDEEP 3072:NdJa65zjj5kH7JoqI36Ow6l7BZ2QxNey:Ndv5zjlkH7Ja36OwO7Bgkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ServiceHide.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll
Size 151KB
SHA256 43bad9c77f861c5ce0f622896a33dbd8c34157c004550cac22cc97d3a4ba3052
MD5 26d7a9a819ad38801857d657da7b43da
SHA1 c234851024d125caae81d759da98789c9dd2501c
SHA512 628299c06673b33566049d70f2f1f1a2a5c769ea5f5a1382b917c3cb11cd6b943005870e536b9e816632f29d1a3dced8eaa81e154b741491d57ef2cd54192190
SSDEEP 3072:9zKO9JfnxZiVutA6dQHpLXNBDP6UsQ8sqNFNCFQ:NKO9xnymdQHdWNCFQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vestris.ResourceLib.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Vestris.ResourceLib.dll
Size 76KB
SHA256 d571df8d154118bbbfd16fffb1a4ad642ad854a98ccfb712097633b522ce7aca
MD5 d39f7ef14893f4d0e909a9ef67d91d7e
SHA1 dfd7519871580b605366a513377db0549bcd5eee
SHA512 f15f759ef12970afb8aa46550d5e3491ec771b69c861da3be4a32cb6a6d93eb78b52aa595758277918358961ff99e5ec4fa5f411fe86ca7f87af0fc1a8923b1e
SSDEEP 1536:Vx+rDv49EAcd4OGZzUDInJMtIxexanrP:jwD/AczGZkInJrxecL
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\app.ico
Size 766B
SHA256 effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508
MD5 4003efa6e7d44e2cbd3d7486e2e0451a
SHA1 a2a9ab4a88cd4732647faa37bbdf726fd885ea1e
SHA512 86e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198
MD5 SHA1 SHA512

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\msvcp140.dll
Size 426KB
SHA256 51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
MD5 8ff1898897f3f4391803c7253366a87b
SHA1 9bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA512 cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
SSDEEP 12288:/gO0BGzePo6+J+4P0xYv7IQgnhUgiW6QR7t5s03Ooc8dHkC2esKcWKe0:701Po6+J+dxYv7IQgk03Ooc8dHkC2ezc
MD5 SHA1 SHA512 SSDEEP

Submit Download

sciter32.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\sciter32.dll
Size 5.6MB
SHA256 b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b
MD5 b431083586e39d018e19880ad1a5ce8f
SHA1 3bbf957ab534d845d485a8698accc0a40b63cedd
SHA512 7805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b
SSDEEP 98304:/0lVqJZXNOujZWBh1jwJb9QpFiCjzMIPYxY9HjmgMDZZbyHwazLDrqNPVIGu:szqJnZE1j3pFiCp0Y9yZOvrqNPZu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\vcruntime140.dll
Size 74KB
SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
MD5 1a84957b6e681fca057160cd04e26b27
SHA1 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA512 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
SSDEEP 1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ce-installer_7.14.2_vbox-6.1.20.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
Size 158KB
SHA256 a6ad9d59c8b2dcef13da38edd6a7339072840d2691a85ff07bd00a5ac300cb9e
MD5 b0e01c5413b9a6b760acf7a495bb3416
SHA1 d8f105ae851eb0da195502635ee9a803c088f7bb
SHA512 c525ded66ddf5219ab9d5914c9a9c81bb618134e189269627867e6df4f432fc455a70f4923d8fa9f563670148ce9b323a45dcb0edda12864368f03ca1eab4920
SSDEEP 3072:PQ6xn9yOASYYgce15EgpHnCLkh+pzFT4RRA5GWGnN4TAP:PhnES1gce1HpHCL7R4zhxP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ce_7.14.2_windows_x86_64.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe
Size 9.1MB
SHA256 86f8f150e8e78b98d6f5ed4df08e8334fd3bd1882a1aceca31b0b8a8db1874a8
MD5 c22865430527fb6d1b8af5f32a98ffca
SHA1 bfdd4001b4f0774a4cc780811d6b7bf376a4f91b
SHA512 9585370d49c24716188fc9e06c96adaed564a1324efaa07c033a3fb6e981d6c41fdd8e682d881131b3555a8a97c5dea4ba542585518c4cca3d87d7d28e5679f0
SSDEEP 196608:kzytBOM5lwlJZdx7Ctdyqvof658X5KPGDCnTll+wTkx:kzy35ulJlwyOJK5KPvGMkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.cfg

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.cfg
Size 6B
SHA256 a474da2308914f6ead4d9e86b568efd268ca5cd6a8d11155b71e4e1fc91c6736
MD5 26f71f91f294b4d98ed01c5bf0dabf5a
SHA1 f5f80f5d239e516322f5d89e7e08d86d96cf38d1
SHA512 e73f62c2689abcdac5af858dce224dcc49d4edd253ac9a722f5a48a6415854513ddfd4ce2526f1658e204fb6ddfac8959f2f5290251d1fc2bc21bcee1fda163b
MD5 SHA1 SHA512

Submit Download

charityengine-install-vbox-log.txt

Path C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

MSIDDBE.tmp

Path C:\Windows\Installer\MSIDDBE.tmp
Size 149KB
SHA256 ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
MD5 418322f7be2b68e88a93a048ac75a757
SHA1 09739792ff1c30f73dacafbe503630615922b561
SHA512 253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef
SSDEEP 3072:rfmUZkq40ok1KA+2LSQa/967K4AcIaWHTnYzMgYesp0Ccaw:rfmekqAA+2RTCcZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIE215.tmp

Path C:\Windows\Installer\MSIE215.tmp
Size 195KB
SHA256 cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8
MD5 4298cfa3dab9867af517722fe69b1333
SHA1 ab4809f8c9282e599aa64a8ca9900b09b98e0425
SHA512 37b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b
SSDEEP 6144:t0UiqtfViMTahVzgDpW90yNShZWpUhysme1:t0UfWyiShZT1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIE85F.tmp

Path C:\Windows\Installer\MSIE85F.tmp
Size 690KB
SHA256 cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4
MD5 8deb7d2f91c7392925718b3ba0aade22
SHA1 fc8e9b10c83e16eb0af1b6f10128f5c37b389682
SHA512 37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c
SSDEEP 6144:f1AiB9PqvByOQV9xEMvvKKqS4s9Wj+WDUweVwHmkLlcD/lnr/3yIWAB1R:/N0kDhDWj+WDUweVFkSTlGIW+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4916-146-0x0000000006BF0000-0x0000000006BFC000-memory.dmp

Download

memory/4916-186-0x000000000A080000-0x000000000A0AE000-memory.dmp

Download

memory/4916-162-0x00000000073A0000-0x0000000007432000-memory.dmp

Download

memory/4916-206-0x000000007491E000-0x000000007491F000-memory.dmp

Download

memory/4916-213-0x0000000074910000-0x00000000750C0000-memory.dmp

Download

memory/4916-155-0x0000000009110000-0x00000000096C4000-memory.dmp

Download

memory/4916-149-0x00000000075A0000-0x0000000007B44000-memory.dmp

Download

memory/4916-0-0x000000007491E000-0x000000007491F000-memory.dmp

Download

memory/4916-140-0x0000000006710000-0x0000000006A64000-memory.dmp

Download

memory/4916-139-0x00000000066E0000-0x0000000006702000-memory.dmp

Download

memory/4916-138-0x0000000006240000-0x000000000625C000-memory.dmp

Download

memory/4916-133-0x00000000062C0000-0x000000000634C000-memory.dmp

Download

memory/4916-112-0x0000000005BF0000-0x0000000005C02000-memory.dmp

Download

memory/4916-249-0x0000000008200000-0x000000000821A000-memory.dmp

Download

memory/4916-252-0x0000000074910000-0x00000000750C0000-memory.dmp

Download

memory/4916-274-0x000000000C670000-0x000000000C67A000-memory.dmp

Download

memory/4916-276-0x0000000074910000-0x00000000750C0000-memory.dmp

Download

memory/4916-96-0x0000000005670000-0x000000000568D000-memory.dmp

Download

memory/4916-30-0x00000000054F0000-0x0000000005522000-memory.dmp

Download

memory/4916-38-0x00000000054D0000-0x00000000054EA000-memory.dmp

Download

memory/4916-46-0x0000000005560000-0x0000000005590000-memory.dmp

Download

memory/4916-54-0x0000000005590000-0x00000000055B6000-memory.dmp

Download

memory/4916-70-0x00000000055F0000-0x00000000055F8000-memory.dmp

Download

memory/4916-78-0x0000000005640000-0x000000000566A000-memory.dmp

Download

memory/4916-86-0x00000000056A0000-0x00000000056CC000-memory.dmp

Download

memory/4916-62-0x0000000005530000-0x000000000553A000-memory.dmp

Download

memory/4916-22-0x0000000005480000-0x00000000054A8000-memory.dmp

Download

memory/4916-3-0x0000000005070000-0x0000000005454000-memory.dmp

Download

memory/4916-2-0x0000000074910000-0x00000000750C0000-memory.dmp

Download

memory/4916-1-0x00000000001D0000-0x00000000005B6000-memory.dmp

Download

memory/4916-521-0x0000000074910000-0x00000000750C0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads