56cfc41b83987215930b7bf5635c1c9aea80d83fc9303e090e17ab1108273282

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CL.Setup.exe
Size

291KB
MD5

0fdee79dec8323ec107c0c0a97b2d3f8
SHA1

c3c7f9c3fcc0d5459190df8769f5bc4c6d5bb630
SHA256

56cfc41b83987215930b7bf5635c1c9aea80d83fc9303e090e17ab1108273282
SHA512

4263da4c410ce6d0361186f7793e610e9c68abca4eda738d1a2eca6e46ade13d7a3883040b48764dc74e6d0591ad9dfb6ee0e6345ac93e9dd30fd79c0f66b0e5
SSDEEP

6144:zQYngRzRb5ZoZjAIrbdo2c0B+nZXRTxfpJMJbAnAfmZ6b:zQAEdDoZjAIdU0OJ00Z6b

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 2 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\Parameters\ServiceDll = "C:\\Windows\\system32\\w32time.DLL"	w32tm.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\Parameters\ServiceDll = "C:\\Windows\\system32\\w32time.DLL"	w32tm.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Boot or Logon Autostart Execution: Time Providers 1 TTPs 48 IoCs

The Windows Time service (W32Time) enables time synchronization across and within domains.

persistence

Time Providers

T1547.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\CrossSiteSyncFlags = "2"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpServer\EventLogFlags = "0"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\ResolvePeerBackoffMinutes = "15"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\ResolvePeerBackoffMaxTimes = "7"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpServer\InputProvider = "0"	w32tm.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\VMICTimeProvider\DllName = "%SystemRoot%\\System32\\vmictimeprovider.dll"	w32tm.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\SpecialPollTimeRemaining = 0000	w32tm.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\VMICTimeProvider	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\VMICTimeProvider\InputProvider = "1"	w32tm.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\DllName = "C:\\Windows\\system32\\w32time.DLL"	w32tm.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpServer\DllName = "C:\\Windows\\system32\\w32time.DLL"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\EventLogFlags = "1"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\VMICTimeProvider\Enabled = "1"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpServer\Enabled = "0"	w32tm.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\VMICTimeProvider\Parameters	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\VMICTimeProvider\Enabled = "1"	w32tm.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\NtpClient	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\LargeSampleSkew = "3"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpServer\AllowNonstandardModeCombinations = "1"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpServer\InputProvider = "0"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\ResolvePeerBackoffMinutes = "15"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\EventLogFlags = "1"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpServer\AllowNonstandardModeCombinations = "1"	w32tm.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\NtpServer	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\Enabled = "1"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\CompatibilityFlags = "2147483648"	w32tm.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\DllName = "C:\\Windows\\system32\\w32time.DLL"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\InputProvider = "1"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\SpecialPollInterval = "604800"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\CompatibilityFlags = "2147483648"	w32tm.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\VMICTimeProvider\DllName = "%SystemRoot%\\System32\\vmictimeprovider.dll"	w32tm.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\VMICTimeProvider	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\ResolvePeerBackoffMaxTimes = "7"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\LargeSampleSkew = "3"	w32tm.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\VMICTimeProvider\Parameters	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\AllowNonstandardModeCombinations = "1"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\Enabled = "1"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\AllowNonstandardModeCombinations = "1"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpServer\Enabled = "0"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\CrossSiteSyncFlags = "2"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\VMICTimeProvider\InputProvider = "1"	w32tm.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\NtpServer	w32tm.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\SpecialPollTimeRemaining = 0000	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\SpecialPollInterval = "604800"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpClient\InputProvider = "1"	w32tm.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpServer\EventLogFlags = "0"	w32tm.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\w32time\TimeProviders\NtpServer\DllName = "C:\\Windows\\system32\\w32time.DLL"	w32tm.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\NtpClient	w32tm.exe

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CL.Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w32tm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w32tm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w32tm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w32tm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
536	net1.exe
784	cmd.exe
2552	net.exe
2180	net1.exe
2276	cmd.exe
2256	net.exe

Modifies Internet Explorer settings 1 TTPs 58 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005d1a925217db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC5A5F21-8345-11EF-AF9A-46D787DB8171} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC559C61-8345-11EF-AF9A-46D787DB8171} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000001e984c39aa12f07e403f924c790c57a8ed5cc5e02d4598154f22c8378fd082f7000000000e800000000200002000000008b65a63d2b3fe52f35ed76c945148c7f0e044af9d004fb1d72bcd7e5cd93b5e90000000ca12a6d0a54c0e72368a8ed918c45b2dae5641f845c96bcce1a44488edbc24e94bbc98481c5f0ce8b3437742b8acdd9eca51cbc0742092e5f028d6941a9339e1c8e9e94b9688273956da555f3894b0895c9dcf777215fdca08528ba58f8a7691030327aa7f786570a660ea4737af403f60df8e4ee5ed1ce74744f257b96482bdd10b1e76f37e635d1aadc9d2910ce6244000000059d9f70847e1b30e5f1d26d2564eef54ed1f4efe41a0894e051287dc0ccee440437dd613d5073144308b55bdb34b460f3f933ed2e82ffc92202e6850c1385b70	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434313968"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000c419d1f8f8a92c6ccd67198c7cd9ca0c74e8cfb0760940f4337c3cc24b4c1ae1000000000e800000000200002000000038843c42e9aa9b1ff21262f4faa00462c456bd08bebbff30fd612283d74ebcdc200000009fdcf8ba14cfd8ff1156d620187f4cb5b4632f75c9a21cd18f2fe53f97e15a6540000000535b9b0dd50b6b05290726a57e2feb9affadb8292de51273841e8696e93ae6ef2694b42f6d01e749e5fb79941a5e12e8d8be69dbff6afb24422229fa91aaaa4e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2560	WMIC.exe
Token: SeSecurityPrivilege	2560	WMIC.exe
Token: SeTakeOwnershipPrivilege	2560	WMIC.exe
Token: SeLoadDriverPrivilege	2560	WMIC.exe
Token: SeSystemProfilePrivilege	2560	WMIC.exe
Token: SeSystemtimePrivilege	2560	WMIC.exe
Token: SeProfSingleProcessPrivilege	2560	WMIC.exe
Token: SeIncBasePriorityPrivilege	2560	WMIC.exe
Token: SeCreatePagefilePrivilege	2560	WMIC.exe
Token: SeBackupPrivilege	2560	WMIC.exe
Token: SeRestorePrivilege	2560	WMIC.exe
Token: SeShutdownPrivilege	2560	WMIC.exe
Token: SeDebugPrivilege	2560	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2560	WMIC.exe
Token: SeRemoteShutdownPrivilege	2560	WMIC.exe
Token: SeUndockPrivilege	2560	WMIC.exe
Token: SeManageVolumePrivilege	2560	WMIC.exe
Token: 33	2560	WMIC.exe
Token: 34	2560	WMIC.exe
Token: 35	2560	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2560	WMIC.exe
Token: SeSecurityPrivilege	2560	WMIC.exe
Token: SeTakeOwnershipPrivilege	2560	WMIC.exe
Token: SeLoadDriverPrivilege	2560	WMIC.exe
Token: SeSystemProfilePrivilege	2560	WMIC.exe
Token: SeSystemtimePrivilege	2560	WMIC.exe
Token: SeProfSingleProcessPrivilege	2560	WMIC.exe
Token: SeIncBasePriorityPrivilege	2560	WMIC.exe
Token: SeCreatePagefilePrivilege	2560	WMIC.exe
Token: SeBackupPrivilege	2560	WMIC.exe
Token: SeRestorePrivilege	2560	WMIC.exe
Token: SeShutdownPrivilege	2560	WMIC.exe
Token: SeDebugPrivilege	2560	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2560	WMIC.exe
Token: SeRemoteShutdownPrivilege	2560	WMIC.exe
Token: SeUndockPrivilege	2560	WMIC.exe
Token: SeManageVolumePrivilege	2560	WMIC.exe
Token: 33	2560	WMIC.exe
Token: 34	2560	WMIC.exe
Token: 35	2560	WMIC.exe
Token: SeIncreaseQuotaPrivilege	328	WMIC.exe
Token: SeSecurityPrivilege	328	WMIC.exe
Token: SeTakeOwnershipPrivilege	328	WMIC.exe
Token: SeLoadDriverPrivilege	328	WMIC.exe
Token: SeSystemProfilePrivilege	328	WMIC.exe
Token: SeSystemtimePrivilege	328	WMIC.exe
Token: SeProfSingleProcessPrivilege	328	WMIC.exe
Token: SeIncBasePriorityPrivilege	328	WMIC.exe
Token: SeCreatePagefilePrivilege	328	WMIC.exe
Token: SeBackupPrivilege	328	WMIC.exe
Token: SeRestorePrivilege	328	WMIC.exe
Token: SeShutdownPrivilege	328	WMIC.exe
Token: SeDebugPrivilege	328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	328	WMIC.exe
Token: SeRemoteShutdownPrivilege	328	WMIC.exe
Token: SeUndockPrivilege	328	WMIC.exe
Token: SeManageVolumePrivilege	328	WMIC.exe
Token: 33	328	WMIC.exe
Token: 34	328	WMIC.exe
Token: 35	328	WMIC.exe
Token: SeIncreaseQuotaPrivilege	328	WMIC.exe
Token: SeSecurityPrivilege	328	WMIC.exe
Token: SeTakeOwnershipPrivilege	328	WMIC.exe
Token: SeLoadDriverPrivilege	328	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2892	iexplore.exe
1316	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2892	iexplore.exe
2892	iexplore.exe
1316	iexplore.exe
1316	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
1832	IEXPLORE.EXE
1832	IEXPLORE.EXE
1832	IEXPLORE.EXE
1832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2188	1300	CL.Setup.exe	31
PID 1300 wrote to memory of 2188	1300	CL.Setup.exe	31
PID 1300 wrote to memory of 2188	1300	CL.Setup.exe	31
PID 1300 wrote to memory of 2188	1300	CL.Setup.exe	31
PID 2188 wrote to memory of 2560	2188	cmd.exe	32
PID 2188 wrote to memory of 2560	2188	cmd.exe	32
PID 2188 wrote to memory of 2560	2188	cmd.exe	32
PID 2188 wrote to memory of 2560	2188	cmd.exe	32
PID 1300 wrote to memory of 2420	1300	CL.Setup.exe	33
PID 1300 wrote to memory of 2420	1300	CL.Setup.exe	33
PID 1300 wrote to memory of 2420	1300	CL.Setup.exe	33
PID 1300 wrote to memory of 2420	1300	CL.Setup.exe	33
PID 2420 wrote to memory of 328	2420	cmd.exe	34
PID 2420 wrote to memory of 328	2420	cmd.exe	34
PID 2420 wrote to memory of 328	2420	cmd.exe	34
PID 2420 wrote to memory of 328	2420	cmd.exe	34
PID 1300 wrote to memory of 2620	1300	CL.Setup.exe	38
PID 1300 wrote to memory of 2620	1300	CL.Setup.exe	38
PID 1300 wrote to memory of 2620	1300	CL.Setup.exe	38
PID 1300 wrote to memory of 2620	1300	CL.Setup.exe	38
PID 2620 wrote to memory of 1316	2620	cmd.exe	39
PID 2620 wrote to memory of 1316	2620	cmd.exe	39
PID 2620 wrote to memory of 1316	2620	cmd.exe	39
PID 2620 wrote to memory of 1316	2620	cmd.exe	39
PID 1300 wrote to memory of 840	1300	CL.Setup.exe	40
PID 1300 wrote to memory of 840	1300	CL.Setup.exe	40
PID 1300 wrote to memory of 840	1300	CL.Setup.exe	40
PID 1300 wrote to memory of 840	1300	CL.Setup.exe	40
PID 840 wrote to memory of 2892	840	cmd.exe	41
PID 840 wrote to memory of 2892	840	cmd.exe	41
PID 840 wrote to memory of 2892	840	cmd.exe	41
PID 840 wrote to memory of 2892	840	cmd.exe	41
PID 1300 wrote to memory of 2992	1300	CL.Setup.exe	42
PID 1300 wrote to memory of 2992	1300	CL.Setup.exe	42
PID 1300 wrote to memory of 2992	1300	CL.Setup.exe	42
PID 1300 wrote to memory of 2992	1300	CL.Setup.exe	42
PID 2992 wrote to memory of 2904	2992	cmd.exe	43
PID 2992 wrote to memory of 2904	2992	cmd.exe	43
PID 2992 wrote to memory of 2904	2992	cmd.exe	43
PID 2992 wrote to memory of 2904	2992	cmd.exe	43
PID 2892 wrote to memory of 3020	2892	iexplore.exe	44
PID 2892 wrote to memory of 3020	2892	iexplore.exe	44
PID 2892 wrote to memory of 3020	2892	iexplore.exe	44
PID 2892 wrote to memory of 3020	2892	iexplore.exe	44
PID 1316 wrote to memory of 1832	1316	iexplore.exe	45
PID 1316 wrote to memory of 1832	1316	iexplore.exe	45
PID 1316 wrote to memory of 1832	1316	iexplore.exe	45
PID 1316 wrote to memory of 1832	1316	iexplore.exe	45
PID 2904 wrote to memory of 1996	2904	w32tm.exe	46
PID 2904 wrote to memory of 1996	2904	w32tm.exe	46
PID 2904 wrote to memory of 1996	2904	w32tm.exe	46
PID 2904 wrote to memory of 1996	2904	w32tm.exe	46
PID 1300 wrote to memory of 2276	1300	CL.Setup.exe	47
PID 1300 wrote to memory of 2276	1300	CL.Setup.exe	47
PID 1300 wrote to memory of 2276	1300	CL.Setup.exe	47
PID 1300 wrote to memory of 2276	1300	CL.Setup.exe	47
PID 2276 wrote to memory of 2256	2276	cmd.exe	48
PID 2276 wrote to memory of 2256	2276	cmd.exe	48
PID 2276 wrote to memory of 2256	2276	cmd.exe	48
PID 2276 wrote to memory of 2256	2276	cmd.exe	48
PID 2256 wrote to memory of 536	2256	net.exe	49
PID 2256 wrote to memory of 536	2256	net.exe	49
PID 2256 wrote to memory of 536	2256	net.exe	49
PID 2256 wrote to memory of 536	2256	net.exe	49

C:\Users\Admin\AppData\Local\Temp\CL.Setup.exe
"C:\Users\Admin\AppData\Local\Temp\CL.Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c WMIC CPU Get VirtualizationFirmwareEnabled
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    WMIC CPU Get VirtualizationFirmwareEnabled
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://aka.ms/vs/17/release/vc_redist.x64.exe 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/vs/17/release/vc_redist.x64.exe
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://aka.ms/vs/17/release/vc_redist.x86.exe 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/vs/17/release/vc_redist.x86.exe
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /register 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /register
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Windows\system32\w32tm.exe
      w32tm /register
      4⤵
      Server Software Component: Terminal Services DLL
      Boot or Logon Autostart Execution: Time Providers
      PID:1996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop w32time 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\SysWOW64\net.exe
    net stop w32time
    3⤵
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop w32time
      4⤵
      System Location Discovery: System Language Discovery
      System Time Discovery
      PID:536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /unregister 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1700
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /unregister
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2504
  - - C:\Windows\system32\w32tm.exe
      w32tm /unregister
      4⤵
      PID:2724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /register 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:884
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /register
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2812
  - - C:\Windows\system32\w32tm.exe
      w32tm /register
      4⤵
      Server Software Component: Terminal Services DLL
      Boot or Logon Autostart Execution: Time Providers
      PID:1020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net start w32time 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  PID:784
- - C:\Windows\SysWOW64\net.exe
    net start w32time
    3⤵
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    PID:2552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Location Discovery: System Language Discovery
      System Time Discovery
      PID:2180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /resync 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:964
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /resync
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1556
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:1780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get version | findstr /R "[0-9]\.[0-9]\.[0-9]"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1800
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get version
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760
- - C:\Windows\SysWOW64\findstr.exe
    findstr /R "[0-9]\.[0-9]\.[0-9]"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Time Providers

T1547.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Time Providers

T1547.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbf680406d715d9fe2b0cff5938f287d

SHA1
e83b7e84a190f789b0e6800e517299816b9def51

SHA256
0fdecfa6fe86bf48ed8c79d53b97f7e190110644310ee2cfb8882fe20eff78ca

SHA512
c48350d6408de623f3243d7d7e9d70b70242816bfcdb409ee29e7bf1ccef9bc81425a89d97bb308c6682ce310a3507d9416c23f8fd416e9c19d2f08a62eb3edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c8cd8c2ef69f7c4ed3b0b64268b55eb

SHA1
5acc729252a8d0fb0d4217cdf03b128ff04c9045

SHA256
1b26c8299d95bad6ee4dc5a02f672a029aa26eec4c1f245470a39e842d09455d

SHA512
4bac4ab3f1582a25eee6ebccdeaf73e04ea9cf8bea350b13404aa24af6be895c2a9ba385be34bfac8a1a4ae70dbd1b0d1d30c6ef0c580f294a6d5b32602b6b72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cadc36885c2cdb2815dcc256d4b7e9ef

SHA1
d33f9bd35b3561f384e7f918bf20052c8cc3c6b3

SHA256
972a001915586e085ed2c6791748cbbc48d9b49c384e04a25e24030fd2224674

SHA512
d710bbe23bae531360e2d6009e3a0c483eb1bec2ac73b9339e7771a7a702321397f4b2148ea775948fd7a013402c07cb1730b52eb1fa9c46f973cc16e5bb10fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d64f3371eb31d881209aaccc9af8cfc5

SHA1
35fd0e46655a6669d64f3b09dc222231354f39fd

SHA256
68c9e31da3c904a9f0899a7e2965cc6f82ef132bf83f43d590f8dabf9bd6cbc2

SHA512
7a764124023bc6162d9ffdf32f5da9ce68012c7d84e2dff798444845441808b684bbbe1d263c6c4f76dee78009c3350bb230ed13d5e882505e249f57644c1e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
624512bc1180139f8cfcdf22b0376126

SHA1
44f0d34d551c8bad6e8f22f4d9149a2428351fce

SHA256
2e868ee8c1eea1c49acd8c77da9f86b8c80d6a6e490cceab267449b9ffabaa0d

SHA512
18e856205a4a6fa95d46eb17c3a817df2f4e703e70bce55de99611b4e81142ffcf868436cac4bdc9fbb31284efad47e708b5cacd05056a775107a5f22cc89463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
558621154767b47bfe0882abf01e89d8

SHA1
00c61111f24c89bc6629f77a6216778e895a1044

SHA256
f004600729d896d1f44d10c59fd9305a1902c166dd8979034d9aad1009133379

SHA512
ea49b74ae2fdf318028557c3be6d0ada34d8e8d698fac79e5037358ca2fdfd86b58bc2f00783ae6c38cbe3141010bc0ecfeef0cf575b7c7667d6d457b153acf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc0fc43f8119de9cc4e77f532d44b50c

SHA1
8e853d9041d74d554e44294a391703491bac3b9e

SHA256
3c2315d6c2f43ec3eb5bd60ab094501e59b1dc87bf4748b56adcb68e38d364b9

SHA512
c6ebe2979f1c46b5b5c394962e8a1d97988a7aeacdb765fcdeb59d217fd72ae1ccf7a571761d92abcfee864b54572e829bc9e23b70f49d4f999048b6775fb3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a4981b12ef8966c148e1a0e3bc39269

SHA1
8594797157b8d19f61e0543df051aad609747414

SHA256
f9f939b55f5311bffd8e90c67852fc8befe99d2c33fe137b298a0a6a2d61ab31

SHA512
9af20daf777c24dd7e69fad1edc5dbda45e47c45af819b54f1c38feb7baa6818230d1ea060f4c4aa0033aae38145391dfafbbb27790ef9eee06d32401b3431d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73e1b7abaa53798ecfbad96ce75c541e

SHA1
17d4a827cbcfd798ca7328e0c615be15fe5b2ce7

SHA256
2e14982607329beedf3d5ae2af7ba2bd193215c68878bdab102446f34b49a3b8

SHA512
6eaf857254067b86fef786db1c5bca4b1d527371d1529d56ca3721bebc622e67ba31e94972bf4e4e3db1992f78c62b7d7105b8e732b11f4efc0125d5fd192157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
815836b2e8b87abf9b9952f896898ef6

SHA1
92543789551a97acc15104709cc3be82b2f0e525

SHA256
c2db9c0cf5b0f133cdc22208498ddfdfb3e766dc16438dd494f2fbd68e45919f

SHA512
7e956559f5f47d5ff27af023baacc1ab9786b90ae89d2675a9cfef4fefe46635ae07575d3464eca05e4539c7a33fc922fa1bfe2b6ca2fb6b88f2983196cca05c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8831908026e46f4a43860ef0b47c81ba

SHA1
53f31bff64a480a8e2bd1d8398e4e158b453d621

SHA256
cd381cc55002a194283ee70b3ff227c7ad96b013b6c6d5bc4dcc87a6427f45c6

SHA512
217fc25e1a8386b42e0b3f0b5fb1404148fabfaafa74b077ce7012e575cba9c832217460a2b1086a68ec84bc95b8049ad6065960bf5f76ecf9413b3189b9cf20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6830f8455398fa415e6c66a3c6697b89

SHA1
ca16630dd52211f3f1a5714eb827f34fff9a0446

SHA256
8fcce58e35ba9895068a495c7049d94559eda5701680e7b00e2654836fc122d0

SHA512
0dbb13ef3e30ba5d0f25a454b02bd1ae48185412813ef89b81fe8e5c9dde2257908fcdf1a57bf503c0bd961b4c1afc576a71b58d3cc793c1771b3f541f0d93de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd63062ecef7859be353b1c4361993c0

SHA1
ac63398f043cb20b0f4521a66a6b367727fca359

SHA256
3f570bf1e41277b80b044b82f1323b3ef5977db0af303cf12997419ee76659ba

SHA512
89a388ded88a376492fd789db5092bbc3935e76eb0bdbaae21a4c6c08d931ffeab30a3c1e50cc6d7400754c57e3c37690e9469181a658f5dab70534ec1b42542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f90a3e62ce76cb069cc00bd6d661a4d

SHA1
d5d6655c47b70684435602e480c7dc0888d1ea7d

SHA256
3ef54a64eeb55f8db1b18012cc9ffd696c333b93ef773fab1c29b8f2c8952d8a

SHA512
11bb3c7550aaf260520b8edff2a4c06f7617402235bbeee56c9f9c0d175e94aa849517ff4b5edf37de6e38f581c550ee4803efbb3f926abe0a4035a2afa02c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d05fac67f972b087081b2e70cb692d5

SHA1
bd41cd5b52c6e01c47dbbcbaffbeaf34b9be0938

SHA256
ca1d5b85e047668878be98e98821e699f03991db4b4fb4ca1c06b0ecb7db435f

SHA512
5726faef07e7d49513205650ec28cac89615b06dfc6966d3e6c1cec8590195b4f01f480108c45a8b223b9b208abac68839b5a757a6808e112f656b368809f7b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fff0df5be4b6b74a5cd0f2b1302a4d2

SHA1
67aef7378b0a46c03852f2ac582a020186827616

SHA256
ea42becc93be4e87202e08bd175e4535ed8398912a225c34badfc2c99bb62245

SHA512
fe46d5b7dab7c3d2e921f349410dc5e1a391a31ea04801d054263bb3f54c8c74f392c1dd06bd4329f3b2db507e4b0e0177220a53448f011be56ffe29c2ba55f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4fbb87e674d875c2ebfb7c6411e4bee

SHA1
1bc3800029a0410228090da51ad741494fdabe26

SHA256
1ec9daf3cf6bf362be76d80fd08068802c19aaf5fd32ff83a14dbf303f8131a7

SHA512
09feebb6a6ef9100af0fbc0058d447a8fa77c1408dad0291d54b43cce07e0300afd6ac203317bf034a5004bc1fc5b583014524b5bc5d32cd487ca4155256a587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58642f92ec0efeab0a61945e5644beb7

SHA1
dc691927f960c732297a83a7c8be82f8f0bc2cf0

SHA256
654c9ce9a9671e8479cf7da46c0c3406e4eb086a0ba84ad06ba6534defd84149

SHA512
f9b25564333c614922ffa6c1a2a0e303ae57cd71a27d5244b201e6fd53715360661761706372202baa7fa25a0537815dc4d75b6e47129fdbaeac20d2a2cc87a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e43e2a5afcd43a596d35abd815e40fa

SHA1
6bd06c892446d6c268d3aec455fefb1f29ab7772

SHA256
c5c2c61e69df76d24df651bcdf3cc87909e845cf8f37b4a2719985aa93442ea9

SHA512
ce9ccf6a51f5cde46825feb843ba5a082ac1267b139b5fe58fe6dbe522da280b35a791e519edc138f8c09a8d618240008499dcc14eb07ea4d4d1c66194acefb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebe1d36bf80e91172b5e12b05ad498b6

SHA1
3cf2d7e4385c38f480aea122007e307f4d39be35

SHA256
71967b148fdd6a42163404a1397396b0f744b16fb9245ea9ef5a78a0f58cfb5e

SHA512
0907ebc64dfd863d0994a295af4adcc6cfca750ca66e44622bf9566efef13ebc756a9a9bf314d14bf657a3e600bd4d2cf9ac242648ae15978f5fbc94605a89bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6ad76bc5a93ce23678130c9568e2260

SHA1
9b693693924164bf53284e84bf609e7f9d3a57e1

SHA256
02effeeacc5ac567cf7d0892fc4f70885905b9e1fc0eee690417c70eb26ed1ea

SHA512
8a3ae6e94900e6126e0ed162c85a8c798a0fb17bacc02f11aed4a7a01fed97e470613a6b733dcf39b6c178966e14c730281998001a01a667e78e1468dda7db93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c527eb4402b51f07a97bd4ba48f501e7

SHA1
d1f620da40ede4e954d952d6a3d8468dad54659c

SHA256
706d44eeb21b844e04aede1d85f04bf4bbaad9f157df66cb380879da09e8daa9

SHA512
c38b304844be6ab6b843a44320a5000cde576552ea6bd3c5a472ea5863aca107832192810815e3c73d93901f345ba17f0e9b4deaba87e4865ddf3f7a9131fd6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
509c79cc4e15633539695589fb9ed1e2

SHA1
06b774ab3dbdebf1633346c61541c51b3dd54294

SHA256
cc359b976198d2b5d46b14a09b7b0b76acf45afe97a580af057eb92fd58bbd0a

SHA512
823239145cba1ed1ade6920f7a32dd45f72dcd1873a39806e19dc162918b3d42983aa54855225712e7d9dda8fa4783e38493314c5804c4929b369e7a97ba3b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52263d1ba3e6683ec3bbb476c1193d63

SHA1
82b310967dc731f5599388dc137126b0ee9bd1a5

SHA256
f24e6db56e988e30140f023734b381ad7300d9168b85fd013dc52796cad2cb9c

SHA512
453d4a9e74b83b72933dd686ed415e6b378c6f5826a077f429f5ef44161ba09818082c779df3635891a09c3d202e887de1639e894c74781c9accb444d03f507c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6169b80125f5d67e1dba8b2817da0bcb

SHA1
2424d7314e94f87051896f9e976d0c949e15ba1e

SHA256
38a36cf356f377d73429fbe4ca4c614cbe7de54e45357ceee13b1b6aa9569897

SHA512
97b7094634caaa998db37158f7c0ad9e4fccbd7d42cf05af719f4acdc765e25a965da9e263deff3770d94f575ced8d476440e522aa6f039883b86464912519ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc171dfabf6235a7fdb987e37187347f

SHA1
bef00f42456d52cf6c3a590ce640fe05c1bf1fb4

SHA256
503ced1c03a9f2ceef73ae2225366cf41eb93768070a210036861728e399408b

SHA512
1498d331749680ce3aa5bb3faa55ff7cf4b396d221b1f7afdf494965e8f78bf31fc524261c1aa4dcc22f098087e70f48294c223ed446049afb93e00496f1b510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b80bca9264b609f64292da734269abfb

SHA1
0fa3b223a04df28f21f95144c920fbd9f2bbf5b9

SHA256
b6f4b3703883a3f0ed436ac7fe00d92de23b24c127ebb8697a42e22343ff0db9

SHA512
ceef4671fbb0a2c49854a5e42e69defe5e0eb65f942038adab3a4e55762c61364d631379a600f1c3114c5c1e09ca9d1168c21a2a997c2e6f006598bb4cb06f59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9183e5f50f96cb88c952ca1d421e41b4

SHA1
1e4d87d14d3d0547ee4dc069833685cb849517b1

SHA256
058004e60cc077efbb40d0a1d6a2af25225a5caf99bc187bb615816453921a4a

SHA512
7be7282c084b19e6b2299eefbdc450b2c22b5797ea695b96c8c9d1fc15447ee9975540a278c366112d0b153659e317c2d0b3cdda60aa5c9683b422d9a695ab5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9d8515fb9249090558395107a5bfc00

SHA1
285e0eebb6b402a6c73533ad17769ded87767f55

SHA256
c9754d2251a00eaaec885904f6b3d186dc6c1f7960725560006f0a3ed6a93aa4

SHA512
630be73d467c3671e94c1a58e990319a650a2560f11ce4eaaaec587a1c7f5c8fe17a213dfec23898e5a2bcc57f1bfa205e91881257b50abc6bb5e18e1aadc957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7beb475ba77685e767ca54141d1f5927

SHA1
63d02d7cd1cf26cf7d75baf57b30a4dbc83a036c

SHA256
ca028ad3de77fda40a332088123640328c41365794abe15ee7a66e496087c2be

SHA512
7c8dd54a08549d1f46e07c7d7211c60b7579cb3d19ba9a27fede2c86db4c248b055f54b0f87bda3b0e26e2af6c7a5dab38a15df651f03c60c47fe491da3c59bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d07af4f5a91007009eae8db9c9c0a33c

SHA1
ad7620fbf9dbc3f1a7f2ec3ad1f1caff1dc50662

SHA256
882f2e4d9defde8b1182e3baae61a44ef432a89e6a8c208813dd5b4a3e5f8291

SHA512
f3fcf9be06a943bb70c6175a30b621078eabce00ff4f8320496ed47707860d1cc8aa5468d3104063c5de64c19cb62db73eff256368826a1e272a9bb92da689c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a68eaa1357a97394575aed66ad5e5b8c

SHA1
a1b8c76c1f9d096275e74124e2c2c8563513fb1b

SHA256
a7c2639468a2e785d0d6b4e020961847b968009d68f422772ee962202ef769ed

SHA512
9d8dd154ebc550e7b77951f0a9452ebfb4a2664196ba5bc3bbd27bcb01ba599e80621bddd332b94fbf5f9732f953fec81cff806ba0f4e0de1cd1fced7c2fe2d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c30df8d4d08f0a35200860b6a0ec19b

SHA1
fd388fefa73ab43ebff767875cafa7eef9a26e4f

SHA256
59960451a275b2a9f8bb78c0e092b13805bf907e75f4f6fe40f6023f0ff4ed10

SHA512
b5f01e43397ad39aa800002b57483c5c88d91e03c5796db14262bce9ad88966de8309073d62daf170932d46850799369e47ec522999e0dd4db5866f5f90fcffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e25763617da134857fccb3f71e0c869

SHA1
d3b670236c3759ac7881887349cac3abb327c6fd

SHA256
a2379adb3f105d1dbdf3e480072508485d9d63e8bef39fb97c93592521659cbf

SHA512
823cda829e47ca57e21c6a27f74fcc7ac5010ffd8b0dacd2587619b2bac403aaf65f7ecac518f431cc827efc37f1b70248692274d8c69dc178b51332f051f48f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1548852fe0194478caf839480332f2f7

SHA1
d39bea37bb60216ea64ca0cfee6b037de453fed9

SHA256
3eb54f64bb59680419f7557aa50af4274ecd19aec0f1f8b3485e12c7f751060b

SHA512
908ae4c9b20bf533e505dc196b6f737784ddd4a00f86779a33692c769f9486f1335b8a07c52ec3f87c844116c136fb182e112cbd8a969ae70166c7aabcb89ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d380d19c1ef181aaf0e14685d9d9f99

SHA1
9b023d90f3b17940dfae1eab779c0b6ddbe58b0b

SHA256
df90762599a04ababd8c869299f77f9029f53ffe55c4cf52f9b2b7c3f44f89b8

SHA512
15303cc4d94bb138208f91dba898c076a41b13bb2c8eb7324a3e631e004d606f0ae9035f2ad5e37db4cd989fee679209ea6df295cae20253710b0934eddd009a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff0ddb176a239e3db91f54d735c24736

SHA1
c553b86a9f30cc7428456d9ece2a33303ab8d8ea

SHA256
7e714990cbae6942275603410f3eed84fb57a51791d85bb41a87887b0f0e8f1f

SHA512
8a99f1d982e8deb73d506c5cf5870ebeb057959db0e03b0644da39ebaf1eaafe8695abfc0d4d2508570f579e6bea5e1de09c5c92cf627df2f88176d6ffe24fe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
559fc9997298f988befc485742a1c1bd

SHA1
07eb6cf060248326927231b264554e1274c1ba85

SHA256
75dbb40b9d5ca50866df98db459a131b951c4a6479657cc228b97327f7355882

SHA512
abe9aab815cb92f21c855acd8d2e7cd7e6a416496036d6f0741fabb480b8198aea5058b94371a15464d1378784afd2cf4c98d440e8403e9a66ad515c67249c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BC559C61-8345-11EF-AF9A-46D787DB8171}.dat

Filesize
4KB

MD5
428a4b8a914c3e8848c5195103b07990

SHA1
d75f6a43fdd52c3db2d29463bc7c6029e6d61ec4

SHA256
8be522361bfde201824f79fb1665035b8b90f5932bfc2e72a5ed506b008638ed

SHA512
e4a9f96919162d16b121ade01fb8fbbbe72fd815a11d45022b5e443a591addd52bddf8af990294b66b5e254048e2572946949eb7042dcf1adee9210b969f0b5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BC5A5F21-8345-11EF-AF9A-46D787DB8171}.dat

Filesize
5KB

MD5
e3c865bc7f43dcbf2862088509adb932

SHA1
5aaf0ca5132b2af9ba53d268297bca81074f1590

SHA256
d0c78919a6dd78e8cb6f44287050af7db3b4225251f217a83560cac9b5df5311

SHA512
406ed6f8b803a3c55dbae422ca4a623d78106c7ad5286f4a6fc65d2a7cb630a371be66599e3f3ca0842e83d111b59817e469a4f36f85ae58381fd85a113e78a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC0E1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC103.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads