51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b

Analysis

max time kernel
203s
max time network
161s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RippleSpoofer.exe
Size

15.6MB
MD5

76ed914a265f60ff93751afe02cf35a4
SHA1

4f8ea583e5999faaec38be4c66ff4849fcf715c6
SHA256

51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b
SHA512

83135f8b040b68cafb896c4624bd66be1ae98857907b9817701d46952d4be9aaf7ad1ab3754995363bb5192fa2c669c26f526cafc6c487b061c2edcceebde6ac
SSDEEP

393216:QAiUmWQEnjaa4cqmAa4ICSSF1a0HPRV8gtFlSiZh5ZlZ:bhnGhMAXSmHXFA+

Score

9^/10

discovery evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RippleSpoofer.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RippleSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RippleSpoofer.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2188-5-0x00000000008C0000-0x0000000002540000-memory.dmp	themida
behavioral1/memory/2188-6-0x00000000008C0000-0x0000000002540000-memory.dmp	themida
behavioral1/memory/2188-15-0x00000000008C0000-0x0000000002540000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RippleSpoofer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
15	discord.com
16	discord.com
17	discord.com
18	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2188	RippleSpoofer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000006db3af7ccf00d2167463bd184357464cd054d6b5a316da54b81f630a3975c5dc000000000e8000000002000020000000cf5a8d0e727528387f076ef9ed9db4ceb0d74979343f19b404b7ef8d78a98c059000000097db3479df475bc45a7dea12fd8dfaeb8bca578d77fb6007be9c1178051c751814fe8323dd24c43b6a5933db2b4a863d7d253db1db3b87c42c2b96fcfc3a71a2d1515abbe4c1c759bba084651ccc455c4e981848192dcf45065383e514a6dc7acc1c4bf94c9b0b7ebd3c0895357094d2fa8d00e869cc0157a54a4a7bc8fb76521df33f85aa3aff2f8be95984d1dfb3014000000030dccb78eceff0fd3638baf0951f4190d9f227ebb42ea3b720c1042fc2c6f852fcf8741658ede6db5a4e11c4db04a2ef73f58220628b64a2fd93e9974a8f3806	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000c541738fa5d45e30f51a9452667d29ae8978b6b25eeeffdd37512adf7ac664f5000000000e8000000002000020000000185b812cdf9e8e1a0ff0c3d04f6bd4432d181ef71ca02ea8fea07df2bdc61756200000002df6910d9ff48a160e6c9ddb3fb37b503a87fbd4d190801f2fc1ea5212a3255e40000000e82cd37fe37835b9a8db060041e9bc6c515c541b2705b459094150ef625c84d9710d9b3d0ce571c032afaab709f2d8be7e8cd8468761a45366fbaf302e5bc75d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f33daef119db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8F9C521-85E4-11EF-BBA4-FA59FB4FA467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434602208"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	RippleSpoofer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2716	iexplore.exe
2716	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2716	2188	RippleSpoofer.exe	30
PID 2188 wrote to memory of 2716	2188	RippleSpoofer.exe	30
PID 2188 wrote to memory of 2716	2188	RippleSpoofer.exe	30
PID 2716 wrote to memory of 2608	2716	iexplore.exe	31
PID 2716 wrote to memory of 2608	2716	iexplore.exe	31
PID 2716 wrote to memory of 2608	2716	iexplore.exe	31
PID 2716 wrote to memory of 2608	2716	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/Qt5NMSgdzU
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5b3e51e45bb535f565c2068edd404462

SHA1
3c79fa46ec3bb4be6ec3725fc7c983180f55e392

SHA256
11fd5a222c8cd2b206ccc08c61b8e17326728c0e99757a0cf2da632a8f76c8cf

SHA512
dab081415aba11715e060d283ec995bfc4c70c6662ed2a29dd1ddb2d20365c454af32279cd3213fc5dba7180a2eccf1affdd85d09170fff9ae0ea671aa905bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e47e7d6cd5166ed3255f47ecbe3c352

SHA1
8fa4fdaa34d23d2b3215442fbe49fcfe05dd0436

SHA256
45689c37109a63634dacc01f2375efcae306efb18550de105ad02deaab24de12

SHA512
dbc01e7e1269874ab0e0cacec0b739058350d55ccb0ddbc41ac348d818b0f439bad3f1bdc85ed70abffb6832b704728f50d14f98fe337bce5b338c3b0f88f7d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aa5f8604b890029e7be1ae42af4c837

SHA1
b1fa69b7a440fd61cdb97741a4c65eeffe9d20de

SHA256
8acb5ed457591f302346364ba3e451e0b003a1961297e38cc1f0d148c6fe6591

SHA512
c0f415d7895e912893f71c6385ca547295405a881b12ab8f6c58043e1c453817273b1e30cc9906f911749a474630b8146ad71249353db4eb16a6a3327094db8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf7163a41a215e1dc9d133381a1c4ef8

SHA1
11037c8f2c46128ffa7c4c1deeca4ecb38290cfc

SHA256
a5ef83597964bb76e27e665231244b983d4154b695db99d9b9866a9d24ddce35

SHA512
9278450afacb24bf74ec204b0db418d75aaf54e669324a1a55e78b3d935139b470e04b40aee75c433e6d7b2e52666da49f3ce8897f08a49fd1904a023415c33a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
243a7c3eb47f36d249e30950235b8972

SHA1
e17053bfb19727a363bb43fd9b7ddff568a0cf60

SHA256
dc1309e3cdd4fe44e2b3d4ea30b8bbf2918e311ee8ab1f8a4e399b1248af7d53

SHA512
437db7b3700d7312c6e6c715234039b90312ef9acc1eb5858707d1ef6945310407f23b51631c5fd72ac3d6728106c6d674f3b736bdf0d47a1c70a95e83693595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9a1144a66898a158025b7023ac12dec

SHA1
187d023cf871d0c34771d7a8933880e18e3e9077

SHA256
c529bd36da4390136c211d0aa125ec85cc468a260c384c8b36dcd19f2edfffbd

SHA512
4376afdb730c52b2e871ecd9485b128e66d819c02da59f4f044b087acdab7fd972995e92df796027da5714c78d7fc7c62113ccbd42f05a5c5d4e24be340bd13f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0496170b20b1948e3b111913d80f7d51

SHA1
830ae5c81a1aa6282ba5a2dab43164fd0504ab82

SHA256
d22b6f0338ac1fff3072d491e4f3895615ed8399939364e947315662ed90a298

SHA512
9a1cc29aa76a7db1fcefe4c2551b864a4f3faef2fd75cd46afe1d39701eb1cb5452063a489e895b73ac14a737a20f3e80936dc09e1c040d29479ee4189485177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41c4dea66832773d4c398f64b600db0a

SHA1
7dc8a6e20ce2a4cdc362bd85d719da7599e81939

SHA256
22e5c979a9fae166dab8aa0ad68bd4e114eb63c45aa1f31bc00f01baed83da8b

SHA512
28730be35fe5acc74041e1b706983c963bab4735a8a366d6e2b7379c2dffe8b47791176d0b28a87caeaba4fd7e6bbf105fb68a2994be6ffa8a7c1ac55eb27473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3c344d4bf7fca320b37b055122381e7

SHA1
d89a910bba449e4b403fc08502a2f841c60b5e9a

SHA256
a76d2b9cc8e710b48d11788cc489f66515f1906b805927bb501d64c5835b3d3e

SHA512
2b728fec83a3701d855f8040a662e540d13b4598e22ea5f934f63d34c6097e26cefa8e83acb0484c3125a101b44baa7debd748dedc08ac8038d56b4024d21191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c830e66d46692d4ad19a1d865d7203d6

SHA1
0f4db4fb37d0f2973fc9467ed49b0c0ddff9aff8

SHA256
af56cafbbf59aec64ce75af730ccbce3289940645d91bb180acda4026147c44c

SHA512
e37a0d9b1078c1175b44a3f04542755e9615ad9ed3ea9ec4ae7cbd7bbde2e6003cfb5a49fdf8945ec8d109b280f5bd469c5433ec7bdc3d1a9757136cd1024f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1379e2e69e614d5b8a57353ce8362830

SHA1
b538f75fb322cd11ecbc620267b7911a38091bc6

SHA256
c87de5259f871c0c67b292ee834c932d32ca6371993070e31867027c0c744c79

SHA512
9694b297956fbd2e5f889ef10ec5cd195f250b5b74b86d0661d47fe0b5d561ed579474e23ce612754165a3b4b2e48175a1175ce392fdaaf0192e2d3e68b9b913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e0e3ea8d5a4c63aa2ed7d9d35bb8421

SHA1
168e7346a5db77a045138678b39cc1a17f8f4c88

SHA256
ed7fefef608c0cf68bd481d6e0faa493f4785565bd36f35659d5abfb803c1014

SHA512
cdcc80cd872d14afed397d7983cb3f1a2b2f2b837102e6d7de3a5fde96c23602f4b3b4cf311436e79318a9374bccac8106e23167f6a241cd512ad01be0fdfabb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72f08cde7368403d44502da12ded5448

SHA1
d2dc66d49912b42370da41bb6bd85f6a2dd3d48f

SHA256
73224f64bd57b416d45c42b1d089884d1671280758024ea92684e0722db786f4

SHA512
73117198208644a6e8e5875f23a88b0c4206b4a5d37c358baac8e528903f91b5bc1697630ba821071eb823bf00e138c33aad2c06c3c95267ef83a57cab545aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ec7235c19b136db673aff4f8b2d84b4

SHA1
12e48fc5824d14c9fe2b32dc5306d02282ac7428

SHA256
9b27cfd65f78744fb60d859c6645d2ecc3be9871e024e7f5e630b9aa73589068

SHA512
10eb69b885470eeaf218026fbef5824d0d4ccfb1b1d5da245a578dad3fe084da2ff7688cfc5e582d231db3a7a3001994104eea3e8c66bf1e09686f70ab611fe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94cd48bb7e5e0dc162d2d6f0d0c3fe88

SHA1
570407a8971176022b65f2aa092da023f3d872fd

SHA256
fa81c3b94ad6cedcb9a13454f1a5a2e7698613949d8aa281dc59d8883444e182

SHA512
46a860c01add8ca38d29dc2937b64ae4a2c2a47e35ad314eba8d55ba62aec3fa770f62b4454e90eacdca5e0d05b32a8fff77766b1c2e092f7ce27d942c537648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af89d74a8924b5098ed8311b102f9a59

SHA1
17e5c5cd39a55f02e101eff7c34dc5ee330f8af1

SHA256
c3ce6d5cd5fcd4fd0daa04e7eac35f62f45e1760a4c56fc5e77dc762abda2621

SHA512
ea60063df6c778790acca602ba99954ca22fb47c4561592ba89ec7cd9df307f3fc77d605d0141e8dc5ee7c4d47ede123b0200bd35cd4cb912b9eb6a5470b9c92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f44fb94ed6502db417fc17d492684550

SHA1
aef711545ceacb1e900cb8f4b575d18be520de77

SHA256
cc2aab7a16eed9a09c9cb2821974ea08a8c8264e1a1d7480b1b3dfee02635b31

SHA512
5dad120e875bdeda074eb07bb3361386c5677f357747fc8a3292a6fb504d607bac69defc0c270286ceb6a62c59a5e03f5d09c34b41dfa9beb8b9369c3ebfd321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41c1dacc6a491f9c4c3c1a93a0a12549

SHA1
325ea444e062fdffb0b364dc82e3825440400bab

SHA256
41aece8658db8fb05a2f6163a8f4e76a1076edd05435a012d0d21991869ba61a

SHA512
ae8c000d95d3ae35a70f90d0526d21f337e6248bcb3ffcd4b1e67994244145d02440a68f00d8b58b04b31a99bb59e8cdca4e08c1371bce41264d36468e7986f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a285b6132307efaaded104967d17f08c

SHA1
247737280a1bb9cff563857d924fe45eec3b7ef8

SHA256
2f713a62c1c199d99891e910cc1d48dff2f225f8d51cec34d3dae783204fd2fb

SHA512
1dbe1b002952bf4ef8a1c65c3a249d72743c332f1b00c2ec9727726454959d7275bc61d28efd74c79d61451384ecd5588b13eecab51559f1c2254ffdfd4958fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26750fcca06c7de8016022474031e457

SHA1
a761bf9ac49538cc2c46c13345c5ba658f376cf4

SHA256
08ee92f0125ba62c9d0c634da1766fcd3871c062abbae105f8284f8abd115d60

SHA512
dbb05c31b71b7c8b531a99ed9c0129339871c11db849d2e15f37dab38d5cdb07a97bd2095f1f17f84f8263c581f19680032e58b82ed923efbb3735cec09cfc48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f8d88c614fc4be3cd97407cb100fb4d

SHA1
072272e4d3b6e5174294f2d18f42cf82306cf900

SHA256
2a44ef92aeb61e727527725a37fb181b50c57a6960a8a1a799fc44c50dc687b9

SHA512
65b26cdc43da52a3380820a971433993f6d78040b09b02e0d81dd97f450cf3e91073bd9a2ec08cdcb95867b4ef49dd5a4d3bfe9e00e4d93ec17588abc990824e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b8714d5cefad11b97b7ced4c1f28ec88

SHA1
c3a9d51bbae085d6585da6112eda6c77e56216c4

SHA256
d338fc15f4ca120328b24589f8d83aa22b952f2a36683b6208700e82e08b347f

SHA512
426554658b650dc6518558a2a0ca79abd596df66c7e3d9e0cf1226a41ab35e5e7cd01314f6103600c319878c25219d1ee35cc2c96bab858efe7d6c756236e3c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\gsz3hkd\imagestore.dat

Filesize
24KB

MD5
ec5f6c23c7d09223a2894db93db87058

SHA1
a4769721b0c286f5a4e30ce3d2d4b3f5cfa62a4f

SHA256
55d194d1fcd978828f1868db4a163707069d5b612565397b4208a2fd0fc47341

SHA512
cd1fd790e3b82518470a9337d8ec3b172c0e4e4c7409089def934ed39d919d903c4b6450a4d478992b697279fcc0fd2243b5a7763e0314a19f305162b2ec439b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\favicon[1].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab40B9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40CC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2188-11-0x00000000008C0000-0x0000000002540000-memory.dmp

Filesize
28.5MB

Download
memory/2188-14-0x000007FEFCE90000-0x000007FEFCEFC000-memory.dmp

Filesize
432KB

Download
memory/2188-0-0x00000000008C0000-0x0000000002540000-memory.dmp

Filesize
28.5MB

Download
memory/2188-12-0x000007FEFCE90000-0x000007FEFCEFC000-memory.dmp

Filesize
432KB

Download
memory/2188-15-0x00000000008C0000-0x0000000002540000-memory.dmp

Filesize
28.5MB

Download
memory/2188-10-0x0000000004A30000-0x0000000004AE2000-memory.dmp

Filesize
712KB

Download
memory/2188-9-0x000007FEFCE90000-0x000007FEFCEFC000-memory.dmp

Filesize
432KB

Download
memory/2188-8-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2188-6-0x00000000008C0000-0x0000000002540000-memory.dmp

Filesize
28.5MB

Download
memory/2188-5-0x00000000008C0000-0x0000000002540000-memory.dmp

Filesize
28.5MB

Download
memory/2188-4-0x000007FEFCE90000-0x000007FEFCEFC000-memory.dmp

Filesize
432KB

Download
memory/2188-2-0x000007FEFCE90000-0x000007FEFCEFC000-memory.dmp

Filesize
432KB

Download
memory/2188-1-0x000007FEFCEA3000-0x000007FEFCEA4000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads