Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/10/2024, 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe
- Size 3.8MB
- Sample241012-fb4heaycjp
- SHA256 207dd171e1b55d723f7b988d0595b8baaea2ced19bdd5c66a48de8f510e6b35a
- MD5 9f247f3349495b5ffa503274f2a69293
- SHA1 14d1a52a716968891dc95e23a38eb8e995cce46a
- SHA512 e7196f88eddf821879dfcfe5f8f6f331aada555dadfe6374c8b753ba9f58f42f52a84af5a62434fd90206d89f0d9ca5ee077e6ac08619dabcd22a265c507275a
- SSDEEP 49152:unsEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxiHgYk6:asyfBhz1aRxcSUDk36SAEdhvxiHgYk
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (2443) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\npf.sys 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File created C:\Windows\SysWOW64\drivers\npf.sys 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe -
resource yara_rule behavioral2/files/0x0007000000023c66-12.dat aspack_v212_v242 behavioral2/files/0x0007000000023c67-14.dat aspack_v212_v242 behavioral2/files/0x0008000000023c65-21.dat aspack_v212_v242 - Executes dropped EXE 2 IoCs
pid Process 4200 CTFMON.EXE 3844 tasksche.exe - Loads dropped DLL 5 IoCs
pid Process 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mstsc.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\RasToast 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\systray.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\Utilman.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\WCN 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\diskpart.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\sysmon.ocx 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\zh-TW 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\ksxbar.ax 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\getmac.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\l3codecp.acm 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\runas.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\VBICodec.ax 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\cttune.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\fc.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\Nui 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\migwiz 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\DefaultAccountTile.png 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\gpedit.msc 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\wextract.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\fr-CA 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\convert.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\scrnsave.scr 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\appidtel.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\dssec.dat 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\format.com 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\more.com 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\Msdtc 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\recover.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\runonce.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\cmdl32.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\setx.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\printui.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\ftp.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\print.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\dmview.ocx 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\SysWOW64\edpnotify.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\bin CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\jre CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\jvisualvm.txt CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\COPYRIGHT CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\include CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\javafx-src.zip CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\jmc.txt CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\lib CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\LICENSE CTFMON.EXE File opened for modification C:\PROGRAM FILES\Java\jdk-1.8\release CTFMON.EXE - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\wpcap.dll 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File created C:\Windows\CTFMON.EXE 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File created C:\WINDOWS\tasksche.exe 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File created C:\Windows\__tmp_rar_sfx_access_check_240653812 tasksche.exe File created C:\Windows\pthreadvc.dll 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File created C:\Windows\packet.dll 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File opened for modification C:\Windows\CTFMON.EXE 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File created C:\Windows\pthreadvc.dll 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File created C:\Windows\eee.exe tasksche.exe File created C:\Windows\wpcap.dll 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File created C:\Windows\CTFMON.EXE 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe File created C:\Windows\packet.dll 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTFMON.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasksche.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1928 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe 1928 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE 4200 CTFMON.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4200 CTFMON.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1928 wrote to memory of 4200 1928 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe 83 PID 1928 wrote to memory of 4200 1928 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe 83 PID 1928 wrote to memory of 4200 1928 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe 83 PID 1928 wrote to memory of 3844 1928 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe 93 PID 1928 wrote to memory of 3844 1928 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe 93 PID 1928 wrote to memory of 3844 1928 2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\CTFMON.EXEC:\Windows\CTFMON.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4200
-
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3844
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-10-12_9f247f3349495b5ffa503274f2a69293_wannacry.exe -m security1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wctBDD1.tmp
- Size 40.4MB
- SHA256 3c60d9bedf60d07c6576041b46094cb804c7a5f478c2915f5105db78ccbfe4b3
- MD5 599b62375825ee51a1e36440e00ec344
- SHA1 043c96ed38ff55ad34d81a3d83b38c409c5f01e6
- SHA512 171f65ad265c5b8df419324b099fe071ada56148408c036c0243291856fe72c558e7cb42291db44f8527b230a2689d48704e3cebc3425b9f21785e24e283d3a3
- SSDEEP 786432:2MwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59I:2pQcWxDMPnN+dk65gGUjku4vNjLjI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\CTFMON.EXE
- Size 255KB
- SHA256 5718f52655689f2b8189a937713dabcb5336bff503e069ee542579b3a8862099
- MD5 ab7d029ad331fae765907cb7da3c0927
- SHA1 fa48c3dc685453c35e01615d6e357f9a7e015930
- SHA512 ab3b554414ff6e8a4efc0e5ed99a1afdc2f237b1cfba8ec074f3a4d0fceabd69c8be66308a7b5d564d64a9cec16b9f457683c24357cf07c3cbcc125cac6a2910
- SSDEEP 6144:MKPEWgxo0siHgYdjB4lrWuTRYg6VegiVjF0:8WZtiHgYdjBkWuTRYX9R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\npf.sys
- Size 29KB
- SHA256 fac5bcebde87a261b4fb5a110765e53c96f0ef27b24ca94762f2c2ddb4da4204
- MD5 5c14de7d04d00aac3f03b569f2ea4664
- SHA1 a26ae78a204791548be000824a1ad05524bdd2e8
- SHA512 4bcbc4f0ab7b52f4303206fafd9d0bafea02bb25d8395a80eb6390b30ccc750379fb7fe9e0bf5a4a025cedb9e4702b7655963e360f2f983526dbc2e1efaa814f
- SSDEEP 768:Gi+OBMVFaxgThnmuyYGUHNqHWn4W0ooO3svA1r5hFnoN8i4:Gi+8M3axgdjGG4W0ooHA1TFnoOi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\packet.dll
- Size 32KB
- SHA256 a68c877cd9c7562c66c722b4d0cd9fa366c65465d4c47ab63bf28bd5f1a69bcc
- MD5 f46c27d67c0ce202ebf4b771cb56ec00
- SHA1 f999454d0aaabccfda7a50c8cb0818e50a7a1d91
- SHA512 2b7c6f7e865f88625a05c85226a95319656648029ef1c1b92b3a6c2dea7a4f7cf7d157c09af32c8689c76c6247852cd5af72d4f0dbb4dbcc3fe3c24681d53dbf
- SSDEEP 768:elOJ9Br5AHBaNagbXumH+V3uUuDldkP3BLzx+ha5LY:BJ9Br+IXz+Vur5dwuuY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\pthreadvc.dll
- Size 24KB
- SHA256 2bd8d9dd8739e17828f8a87b73d592d4fd17988bbb0ea4a4d4cbda57129e8e48
- MD5 ea20ca545a351384486cef574b7a5571
- SHA1 a1f01df09df62e933e4ff289361641b06ff31548
- SHA512 64b3dee275fb1830254fa2a95778b26864708c0b5e348cf5919ded013cda3872fe26304c846fa7968b24f60e2b6105c4813ff9e695bd6bb52897318cdecd382b
- SSDEEP 384:EoW6Ek9DO6hFATUpSzezziHg2J6eNBAxAr6+e9Pfqbn1:ZW6jzKTTYiHgY8xnha5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 2.0MB
- SHA256 ea2ad4d3bb98673b88e18eea1bf06c371c206b64246a9193b2a64ba4fe4f4900
- MD5 beb8a27fc024962e045c32aa58d07d0e
- SHA1 796d3613673f323135865c42272abef347add163
- SHA512 e84c03f6f4399b28e0d258b743831f36c621325d9b199cbbdd6982ed51280facfc5a953a2393788bbc54efb653f95c9f75ea29c93c147c9227aff3395f788179
- SSDEEP 49152:XEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:XyfBhz1aRxcSUDk36SAEdhvm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\wpcap.dll
- Size 117KB
- SHA256 afe533c6990520d49a4963bb9ce6d563b02d7b299ff4a9c9e4bca31ca6920deb
- MD5 6d79c447d16b96e7a72b12e450b6fa8e
- SHA1 d2afa5eb9c9ba598f82a6025c1a07d31cb8a30bb
- SHA512 6b96c6e79608256807f37a4b74b264074274642b4e4e09ef870d13246b7706582535c1e4f33f2a61281ab4c0ef59fc03c60a54faa6627aee92df52f356b8d966
- SSDEEP 3072:8T4bRr2uWpgegT+298x/g6B7e0z6dgfiVn:S4lrWuTRYg6VegiV
- MD5 SHA1 SHA512 SSDEEP