Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 19:33

General

  • Target

    4.exe

  • Size

    2.5MB

  • MD5

    079610302f0c449bb454fbd348326fa3

  • SHA1

    35355d776ed07c193243e6eb24d45718a021b835

  • SHA256

    e4249546f902dfcf2a13540b5e843f33e622937d89b081b9959257642bc9e661

  • SHA512

    d9b0bf9bae684a18ced71feaa1ae6019eeab2f7af7008b5f040b730ef44d80e1e6d6b4aed03d75129e9f044b0a8e37bbc7861f4352052888e1836c443d5064e2

  • SSDEEP

    49152:QgwR+ifu1DBgutBPN2q1dNnzbpz7Mwulf+qV8L77hpe3D04dtaa7X:QgwR+vguPP/7NzRMwulF8L/hpe3YM

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\IMPORTANT_NOTICE.txt

Ransom Note
Greetings, There was a serious security breach in your systems and this was detected during our scans. We encrypt your data that you see important in your system by processing twice. As encryption is done as SHA256 and AES256, we would like to remind you that you can not restore your data with known data recovery methods. If you want to use data recovery companies or programs on your side, please do not worry about your actual files, process and / or make copies of them. Corruption of the original files may cause irretrievable damage to your data. If you wish, you can contact us via the following communication to resolve this issue. YOUR REFERENCE CODE IR4beVNncsM8-Z9mwBnn79YzSumzz2csRQ_Nn7Z80ns*[email protected] [email protected] [email protected]
Emails

IR4beVNncsM8-Z9mwBnn79YzSumzz2csRQ_Nn7Z80ns*[email protected]

[email protected]

[email protected]

Signatures

  • Detects Mimic ransomware 2 IoCs
  • Mimic

    Ransomware family was first exploited in the wild in 2022.

  • Mimic family
  • Modifies security service 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 4 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Renames multiple (3360) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 15 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 15 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4.exe
    "C:\Users\Admin\AppData\Local\Temp\4.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3000
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p3168920970217226645 Everything64.dll
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2740
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ2.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe
        "C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"
        3⤵
        • UAC bypass
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Checks whether UAC is enabled
        • Enumerates connected drives
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1036
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c DC.exe /D
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\DC.exe
            DC.exe /D
            5⤵
            • Modifies security service
            • Executes dropped EXE
            • Windows security modification
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1248
        • C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe
          "C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe" -e watch -pid 1036 -!
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1808
        • C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe
          "C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe" -e ul1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2772
        • C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe
          "C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe" -e ul2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2820
        • C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe
          "C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2296
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -H off
          4⤵
          • Power Settings
          PID:2516
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:2340
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:2684
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:2380
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:2708
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:1480
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:936
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1516
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:1360
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:1904
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1856
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:108
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:1280
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
          4⤵
          • Power Settings
          PID:472
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
          4⤵
          • Power Settings
          PID:1512
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:864
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2224
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2664
        • C:\Windows\system32\bcdedit.exe
          bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2956
        • C:\Windows\system32\bcdedit.exe
          bcdedit.exe /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2284
        • C:\Windows\system32\wbadmin.exe
          wbadmin.exe DELETE SYSTEMSTATEBACKUP
          4⤵
          • Deletes System State backups
          • Drops file in Windows directory
          PID:2076
        • C:\Windows\system32\wbadmin.exe
          wbadmin.exe delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:816
        • C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe
          "C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1820
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2256
  • C:\Windows\system32\gpscript.exe
    gpscript.exe /RefreshSystemParam
    1⤵
      PID:1896
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:2204
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
          PID:1944
        • C:\Windows\System32\vdsldr.exe
          C:\Windows\System32\vdsldr.exe -Embedding
          1⤵
            PID:2148
          • C:\Windows\System32\vds.exe
            C:\Windows\System32\vds.exe
            1⤵
              PID:620

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\IMPORTANT_NOTICE.txt

              Filesize

              798B

              MD5

              c7a8079febd7b8a6040d217d659a4b09

              SHA1

              a602c223f63553795c24f8cc5d8722acc338a6a4

              SHA256

              d7606476e2d903b662a9011fc7488466a6dac6433a04643f1e02a3827a25fea8

              SHA512

              5b33ffb02ec2bb9e52ea4a1090a281e941b72b88138425007549149e220525fc75af9a57ee3d5e36e1af7a1d6c392f0869a98cb99c1fa45a1c7511ef0df4bb16

            • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

              Filesize

              174B

              MD5

              a47416ca5a8f258d1f877e6a3ebcaa73

              SHA1

              71975bc6ce2c8fa23a12e54ac1fbb7e1f51fb311

              SHA256

              65d3ebd86e4dc774cf73c093d11c857d62b204c705c0ce1fe504deb6183a5672

              SHA512

              27eff3b6ff4f5de4eb0247287399a6bec7713c22e875695c785dedb09270c9ad7a9cc2f88bf6cacd3a78f98adc839771b24dfbd2983e8531d28c859a27b29c8c

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe

              Filesize

              802KB

              MD5

              ac34ba84a5054cd701efad5dd14645c9

              SHA1

              dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

              SHA256

              c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

              SHA512

              df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe

              Filesize

              1.7MB

              MD5

              c44487ce1827ce26ac4699432d15b42a

              SHA1

              8434080fad778057a50607364fee8b481f0feef8

              SHA256

              4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

              SHA512

              a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini

              Filesize

              548B

              MD5

              742c2400f2de964d0cce4a8dabadd708

              SHA1

              c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

              SHA256

              2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

              SHA512

              63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini

              Filesize

              550B

              MD5

              51014c0c06acdd80f9ae4469e7d30a9e

              SHA1

              204e6a57c44242fad874377851b13099dfe60176

              SHA256

              89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

              SHA512

              79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll

              Filesize

              1.5MB

              MD5

              fc8231d24af5721342e70a9c5bb770c4

              SHA1

              a6fea2adbd6022e230755b259cbf3f09c942d01c

              SHA256

              22cb66ff8946f7e353f1c23b2e17af95fc7a98f87a1ee941ec36b83b7880653e

              SHA512

              d327552bab810596c9d54c1d0ac2e1bf446164fdff0f79cfdd48cfc455a9e86c88bc24aa2e43f890763332a3150bb939354e87d57ef81bd285159977e06ce3ef

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ2.exe

              Filesize

              2.0MB

              MD5

              b04b206674bab7a4229f34b6ac511903

              SHA1

              064ab6347a40cba3bbe594f226baff3772212d61

              SHA256

              2aafc4ee5edb0dd956cbdfbd9c11a23e2e61102986b6428e3e27eeb09e0fba74

              SHA512

              3584df640cf090820fa818073b5299ad0d979eb87d920140697b550d29fa692cbc7d61742e61ce935347c5a3428db4f3ac8d4159c7053fafabf1051b5587420d

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\encrypt.exe

              Filesize

              2.1MB

              MD5

              7ca770cc5f649256a18623245348f39f

              SHA1

              81398374ba4751a61a0d9949cc1fe75f18960741

              SHA256

              07631e96b95b1f01bdc591699ae6bc2e6787387cbe865bc11004bd34c0f9c3a4

              SHA512

              bd70b65f1ef54f1eed3e48013c0332d82370caacd67304e20497c5c8f6d6fd5ef2d838ecc9c4e80dca4e4a107676942495cce4c2526281b32fcad2ee12b33cdc

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\xdel.exe

              Filesize

              350KB

              MD5

              803df907d936e08fbbd06020c411be93

              SHA1

              4aa4b498ae037a2b0479659374a5c3af5f6b8d97

              SHA256

              e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

              SHA512

              5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

            • C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.db

              Filesize

              9.2MB

              MD5

              0efbf5145ba4686aac35cceaacbc94bf

              SHA1

              1a5b92a6c9bce5a2af1829526a9c3b69a93fdc9b

              SHA256

              dc096dfce1cb6d2d320b7256c4d1846641f573c7c1639032f4f79e6c55405bee

              SHA512

              ea3c1f5654d34f62e3beca98c1d1f176cb7afa99d130b342ebcaf4470df464d55b5558de506c89cd06e06ddc9d960e9838c90502138059229d2a08b7a29b2514

            • C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.ini

              Filesize

              20KB

              MD5

              f2ad96ba0f6db08f8840c2e556d05bcc

              SHA1

              36a3157534860d7bdabe71294d54033affc228fa

              SHA256

              e9eeb154859475da56edde0fbf8e0df5bec6e6b2ae10f5d426d621c06ea3ca33

              SHA512

              5c956872935230c85a79ac55aeb20e34df7faafdb266ea189ed820a72f93841588ab8a7af794048d87c6d7eb122fdaa680f3151ecedeb139cd4b9c4a8b7cc327

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MOH6MI4AHJ47NQOR6IL9.temp

              Filesize

              7KB

              MD5

              413dd3fbcfc27f9983fd9b30360fab65

              SHA1

              a30fb46653b7238e77862959389258ae62c4961a

              SHA256

              66e3facf324fd9cfbf16bd1ee5404b4b09bb8e20ab4d800ca9582ced5872812d

              SHA512

              abbdece83d0efd764d78a12da4dfe645bb43f8dca076eb4fd77be15327804516260c4733d95ad0b20f9ca8fa37eb5bf97b18482cb40911ab0456026d16614a8f

            • C:\Windows\System32\GroupPolicy\gpt.ini

              Filesize

              233B

              MD5

              cd4326a6fd01cd3ca77cfd8d0f53821b

              SHA1

              a1030414d1f8e5d5a6e89d5a309921b8920856f9

              SHA256

              1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c

              SHA512

              29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67

            • C:\temp\MIMIC_LOG.txt

              Filesize

              6KB

              MD5

              680c145e4aa0ca70275756d6c93636ba

              SHA1

              ab0c3a971de7029eb356add472b467bb76ba6c47

              SHA256

              e7d9957d9c32738a5c2d7ca2346f74942feb509a7314960c02af1f47a343df0a

              SHA512

              a5bcd273edd23d0677f14c7ec7c45ed19a103d1fc817f010bafd1487e920d2b0e8c6ca7d8dc8273303f304fc63e09b15edb909ab75d22732ac541b24fa0d4afd

            • C:\temp\session.tmp

              Filesize

              32B

              MD5

              7556b827fec4e78503af35eb10d26998

              SHA1

              fd5fe00ccfb62c30a94114b4db7e40777192b719

              SHA256

              ec487d5aafcb9f0cf75c5fc2440e308f9b6ae385f10cfc072e52c2e7f7f9314c

              SHA512

              fdf3ded23bfb5f87bc0fdb2c8d5dc14118144fae59b24b03443d156ace9520abebffd0827cc7d2040edecd1f83812fcd8aa6cdaf2d0ae8f47c093e455beec14b

            • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe

              Filesize

              772KB

              MD5

              b93eb0a48c91a53bda6a1a074a4b431e

              SHA1

              ac693a14c697b1a8ee80318e260e817b8ee2aa86

              SHA256

              ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

              SHA512

              732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

            • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll

              Filesize

              84KB

              MD5

              3b03324537327811bbbaff4aafa4d75b

              SHA1

              1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

              SHA256

              8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

              SHA512

              ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

            • memory/2664-140-0x000000001B1C0000-0x000000001B4A2000-memory.dmp

              Filesize

              2.9MB

            • memory/2664-142-0x0000000002620000-0x0000000002628000-memory.dmp

              Filesize

              32KB