8f9376e37bec823803c286ebc6d743c91b50f8f020575a9274fcb7b103479fb2

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

theworld/theworld.exe
Size

1.4MB
MD5

b2f6a7a6051c4696e4a6ecad392dacce
SHA1

8279e73a3629f7c9602ace12cf613b378b2cab48
SHA256

c0aca9426db1c9edaa1c74495f01bb73f7c8c30be9f0ea1fe5c064bdefde6ce6
SHA512

1b86a3b66488038e8ce21b370b396da893dd37522036f79ea41c9e180f5d6fa1ccb0ca628d0b99181223394afb2e260a66c52abdb7714add20ba446fdbd58e39
SSDEEP

24576:1KPRGCmOTybrPjgFMMJHrx9xTOITPJbCSsTMBPTA2GLDCZ8uvcT:1Jwy6NTOITPJbVTAtCZ8uvi

Score

6^/10

bootkit discovery evasion persistence trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	theworld.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	theworld.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	theworld.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	theworld.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	theworld.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\theworld.exe = "1"	theworld.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	theworld.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS	theworld.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	theworld.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\theworld.exe = "1"	theworld.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DOMStorage	theworld.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	theworld.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	theworld.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\theworld.exe = "0"	theworld.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS\theworld.exe = "0"	theworld.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DOMStorage\50ya.com	theworld.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DOMStorage\50ya.com\NumberOfSubdomains = "1"	theworld.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	theworld.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	theworld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	theworld.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	theworld.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	theworld.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	theworld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	theworld.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2036	theworld.exe
2036	theworld.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2036	theworld.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2036	theworld.exe
2036	theworld.exe
2036	theworld.exe
2036	theworld.exe
2036	theworld.exe
2036	theworld.exe
2036	theworld.exe
2036	theworld.exe

C:\Users\Admin\AppData\Local\Temp\theworld\theworld.exe
"C:\Users\Admin\AppData\Local\Temp\theworld\theworld.exe"
1⤵
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39064a8008948ab5d7828032e4cd0dac

SHA1
e04586aacdc9ff3ed22d324d6bae8ddbc074c31e

SHA256
7ca45c424b21b9e7392ecb934eccc49d5def7cda618c011999c19118840de508

SHA512
736f5dc8a15307c291148b2e65f7cddce67ec218bd47cfa43ad1b40babeedc848b4e26dac34c649a9df4e52870893af608d826b000f2ad44120daed1584d6fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fb3b536a8831090ad90cf4f931c7753

SHA1
c78a86a34e94b78290dbe7f480587eccfb09b8b6

SHA256
28d5c588bb5cd3da1a74ccf44291016c71bc25d64e3d46d8c96e95af032775bc

SHA512
f098785f9c0cf6654a8186df84de6bcb37b1e542dd48fb8dfab5e5851498c6518b4e8694ee9d681dfce903abed65d3421da6481c45b8f1ed788dfed5dbcd8d0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3e91d5feef525c16c217a84a8a7d69c

SHA1
332c12ec81a75c2ff513bcf5e265de5a6f1bb07f

SHA256
6ce5fd2d2287fc4758f901bfb11be709fdfd5bdf6bd0dd4eda602918d1e46d0a

SHA512
dce73693fdbadf2aafec6d01aa139418c589bd296fc1f180665390822324afe8f4a5ca3dde85d3a0cd71c231b0d22e8376136061da06d30901668d986322fe2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16b9bc95cd3672a48e6faa48956ed3bb

SHA1
55a18e5ce4fb3f426ed6ff9f26768c726ee9360d

SHA256
a824ae9d5d59f59006b0c8e9663a70b1c244a773d761565ad6ef95b4e6d9c417

SHA512
e0b788a2e3cd1cb5cd642618a26198546776029f8eac72646813252610415bf1713b5abb8a5511f4111a2791831d942c3eb5823a43f4ba99d3dc4b5f8f42a2b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
806816d489b879a02feb99961aee95ee

SHA1
fd19ddfa245164f6e874dee18ec2e2f13495d3a0

SHA256
cf7e7351e80e68395c3665aba4a92d3f779927258dd7eba6988be50b24a48284

SHA512
a8db20326f621c9ed76f701d0a6608710e061c1b308d5ac9debe4ea1c31e40fb04c3b6bdc096dc47f742d84bfaed05a971f2f63e21de59613c78447b7bce678d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
714988a3f78c25a1cd9f0b49237515bd

SHA1
a607fbf2ce97b425a8403e0ef44b339bc853507d

SHA256
ffda58697dd4c8c11140d7a6dfbda727d1979cfb907c40b56de9c62a03cde1cc

SHA512
ab3d47ea0c71bd3ea74fb71224e5ce6540ea88901adf20677e6e70f41b15d13f04deb43a1ef365fe8d8bc84696b6fa1b68772f52cddb0b0349bf278be083fd36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad596351d06108466ab2401da0a0802a

SHA1
9fc53be6936ec2aac8a9fe33e7d4b076c74edb2d

SHA256
52007366a707dd3aa364db3a6b4853a3e7f42b186ca1caaf55e565af39954b3a

SHA512
b679628b59c9b4f0ebfaca2ed709966d188a0378df25d20f9abf27a91b7e827858d227f1e0ccb666f472a9a37de517e31ee7d4bfb7fbcba2f6be3207f783f7bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fcce60a1bdbf2cc23c7c098f10d5fc7

SHA1
75febf156d01abbbe0e41b33becd2279d967dc5f

SHA256
edf65f6c107c8cb3c32971252d31855b41ad54e54bbf5fab1f0865abb3fb1589

SHA512
7cfef6f78c50242c9b2a56ea406f5f581f43c39a0afa038b04f3d3819692feb0832de7e87982912b1d34437c959b713d38be6806452e7901b4ecbeae82563cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEFFC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF05D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\theworld\theworld.ini

Filesize
11KB

MD5
df617dceb167e3f0ae126b717cf3f0cb

SHA1
ec9ea355dd118ac1a439dd77966e1af0ddba1c3f

SHA256
9ef54bb7f04d4990f1997688736393c41e9c2b93e5989221a8ce60911896fce6

SHA512
d0f90535417620931a3e32f6baf1e1ba12cab533b7c4564081d696269fe3138ddf4a8b94070d92462e65a1091290e7430b1c35acdf0969ecc90cc052a3951112

Download Submit
C:\Users\Admin\AppData\Local\Temp\theworld\twcache.ini

Filesize
596B

MD5
0ef5a0a0f98670af037620dade9ffc15

SHA1
024fad6a6898f6168f10839fcafefd6ed475fd0b

SHA256
3257fd4736f6cdbafe8db1472c237610c876df0bf36ef9d52e9c29d323ac596f

SHA512
55ae117bf8944f2a8bd6e5f26ed6a52f54c8b7b517cb58f0747033c540a2c9d23420e0f6254bc5192812a26f8522fa7e82be17fa8a8e2448a4aaeceddaac2b21

Download Submit
C:\Users\Admin\AppData\Local\Temp\theworld\twcache.ini

Filesize
704B

MD5
ab52ec2985b5f294784606fee3ab1ed2

SHA1
d3b2663471c676970ef1847abdff617b0fc19ba3

SHA256
8d7fbfe8a0fb333b46f85175aa55cfad1f28cf8919faf1f98991bd792037da61

SHA512
306a07c099c30f1ca16a5424428220c6b291d24189bc3b09b3264934a1f4a3673d37b09c5930c704af59609b870593e5f0b9f9470f10b6e8c8c020adc5b0b0a0

Download Submit
memory/2036-636-0x0000000075300000-0x00000000753A0000-memory.dmp

Filesize
640KB

Download
memory/2036-638-0x00000000755C0000-0x000000007620A000-memory.dmp

Filesize
12.3MB

Download
memory/2036-14-0x0000000005570000-0x0000000005572000-memory.dmp

Filesize
8KB

Download
memory/2036-5-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2036-4-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2036-3-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2036-2-0x0000000075434000-0x0000000075435000-memory.dmp

Filesize
4KB

Download
memory/2036-1-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2036-634-0x00000000749A0000-0x00000000749D2000-memory.dmp

Filesize
200KB

Download
memory/2036-0-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2036-637-0x0000000075020000-0x0000000075055000-memory.dmp

Filesize
212KB

Download
memory/2036-639-0x0000000076970000-0x0000000076ACC000-memory.dmp

Filesize
1.4MB

Download
memory/2036-640-0x0000000076AD0000-0x0000000076C94000-memory.dmp

Filesize
1.8MB

Download
memory/2036-642-0x00000000751A0000-0x00000000752C4000-memory.dmp

Filesize
1.1MB

Download
memory/2036-641-0x0000000074630000-0x00000000746A2000-memory.dmp

Filesize
456KB

Download
memory/2036-23-0x0000000007380000-0x0000000007569000-memory.dmp

Filesize
1.9MB

Download
memory/2036-876-0x0000000076970000-0x0000000076ACC000-memory.dmp

Filesize
1.4MB

Download
memory/2036-877-0x0000000076AD0000-0x0000000076C94000-memory.dmp

Filesize
1.8MB

Download
memory/2036-879-0x00000000751A0000-0x00000000752C4000-memory.dmp

Filesize
1.1MB

Download
memory/2036-1008-0x00000000749A0000-0x00000000749D2000-memory.dmp

Filesize
200KB

Download
memory/2036-1016-0x00000000751A0000-0x00000000752C4000-memory.dmp

Filesize
1.1MB

Download
memory/2036-1014-0x0000000076AD0000-0x0000000076C94000-memory.dmp

Filesize
1.8MB

Download
memory/2036-1013-0x0000000076970000-0x0000000076ACC000-memory.dmp

Filesize
1.4MB

Download
memory/2036-1011-0x0000000075020000-0x0000000075055000-memory.dmp

Filesize
212KB

Download
memory/2036-1026-0x00000000751A0000-0x00000000752C4000-memory.dmp

Filesize
1.1MB

Download
memory/2036-1040-0x0000000076970000-0x0000000076ACC000-memory.dmp

Filesize
1.4MB

Download
memory/2036-1041-0x0000000076AD0000-0x0000000076C94000-memory.dmp

Filesize
1.8MB

Download
memory/2036-1043-0x00000000751A0000-0x00000000752C4000-memory.dmp

Filesize
1.1MB

Download
memory/2036-1039-0x00000000755C0000-0x000000007620A000-memory.dmp

Filesize
12.3MB

Download
memory/2036-1063-0x00000000751A0000-0x00000000752C4000-memory.dmp

Filesize
1.1MB

Download
memory/2036-1061-0x0000000076AD0000-0x0000000076C94000-memory.dmp

Filesize
1.8MB

Download
memory/2036-1060-0x0000000076970000-0x0000000076ACC000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads