Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-11-2024 20:43
General
-
Target
fijewh.zip
-
Size
36.0MB
-
MD5
7e6d7c0df23672babd30f9543916ca52
-
SHA1
0571efe4079a95cb118d79f8c87cdb8694193973
-
SHA256
ea5e0d5f12deeb25573cc7fcade7327945d5e4778c1569e189dc483e96583cbc
-
SHA512
010799374e9bb476c248ecd326ef67e076959b92da685c538b7f4bd4b94570a3e3cf43d64cd52b2a127dc15e2f11b41e1ea2d8c32fd9019f7272538311baf8c2
-
SSDEEP
393216:dGRv1cKZdpkm4SNOFXT+93GRv1cKZdpkm4SNOFXT+9ZEcnTXHfV18f49bWUccq:G/dkUsTD/dkUsTwECL/nXbW2q
Malware Config
Extracted
socelars
http://www.nicekkk.pw/
http://www.nextinfo.pw/
http://www.allinfo.pw/
Signatures
-
Detect Fabookie payload 2 IoCs
-
Fabookie
Fabookie is facebook account info stealer.
-
Fabookie family
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
Pony family
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars family
-
Socelars payload 3 IoCs
-
Detected Nirsoft tools 5 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
mimikatz is an open source tool to dump credentials on Windows 3 IoCs
-
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 30 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
NSIS installer 2 IoCs
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Runs ping.exe 1 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 61 IoCs
-
Suspicious use of FindShellTrayWindow 14 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_win_path 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\fijewh.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\fijewh\412433\" -spe -an -ai#7zMap15012:84:7zEvent253871⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\fijewh\LonelyScreen\" -spe -an -ai#7zMap27052:96:7zEvent54811⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\fijewh\LonelyScreen\LonelyScreen.exe"C:\Users\Admin\Desktop\fijewh\LonelyScreen\LonelyScreen.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\fijewh\412433\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"C:\Users\Admin\Desktop\fijewh\412433\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\whhw.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\whhw.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"6⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7S25V.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7S25V.tmp\Setup.tmp" /SL5="$20324,1223153,733696,C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Users\Admin\Desktop\fijewh\412433\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"C:\Users\Admin\Desktop\fijewh\412433\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen.bat" "2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\key.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX4\key.exe -txt -scanlocal -file:potato.dat5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-3.exe"4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\keygen-step-4.exekeygen-step-4.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\RarSFX5\whhw.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX5\whhw.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\RarSFX6\setup.upx.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX6\setup.upx.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX6\setup.upx.exe"6⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX5\id6.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX5\id6.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX5\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX5\Setup.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-3PEJ9.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-3PEJ9.tmp\Setup.tmp" /SL5="$50350,1223153,733696,C:\Users\Admin\AppData\Local\Temp\RarSFX5\Setup.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX5\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX5\hjjgaa.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Program Files\Mozilla Firefox\private_browsing.exe"C:\Program Files\Mozilla Firefox\private_browsing.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -private-window2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -private-window3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1936 -parentBuildID 20240401114208 -prefsHandle 1964 -prefMapHandle 1956 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8abe7d5-13c3-4bac-9f56-227d06b88662} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2460 -parentBuildID 20240401114208 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6ece4a4-7077-4fbc-869f-cfeae8d24ef2} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" socket4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3060 -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 24665 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12a4bd5e-acb3-4d69-a37a-763465a18bce} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4032 -childID 2 -isForBrowser -prefsHandle 4148 -prefMapHandle 4144 -prefsLen 29014 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31597b1b-210c-4118-a5f2-ab00e2c6dbf5} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4940 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4724 -prefMapHandle 4776 -prefsLen 29070 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3647019-e360-4e3f-a7d6-ad999848fa49} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5356 -prefsLen 27023 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dce6d464-e880-4c3a-97cd-9ff74be9ce8f} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 4 -isForBrowser -prefsHandle 5484 -prefMapHandle 5488 -prefsLen 27023 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d92de53a-3634-429a-98a0-dbb93ad89497} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 5 -isForBrowser -prefsHandle 5672 -prefMapHandle 5680 -prefsLen 27023 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ab7cccd-9b09-41be-84bd-466c015f80d3} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1304 -childID 6 -isForBrowser -prefsHandle 6132 -prefMapHandle 2364 -prefsLen 27104 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9bc8a26-bc91-4611-a12a-0997b6d262b9} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab4⤵
-
-
-
-
C:\Users\Admin\Desktop\fijewh\412433\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"C:\Users\Admin\Desktop\fijewh\412433\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX7\keygen.bat" "2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX7\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX8\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX8\key.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX8\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX8\key.exe -txt -scanlocal -file:potato.dat5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX7\keygen-step-3.exekeygen-step-3.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX7\keygen-step-3.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX7\keygen-step-4.exekeygen-step-4.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX9\whhw.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX9\whhw.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5a182561a527f929489bf4b8f74f65cd7
SHA18cd6866594759711ea1836e86a5b7ca64ee8911f
SHA25642aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA5129bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
-
Filesize
19KB
MD50fdc1f287a6756d42c95bedd953a5b16
SHA15cac2a0fc55aa2352625bcdc8aca14a935505b9d
SHA256459e3ba8dc3f9bc029cf4c6d7dc97c15c5b60c0f92d3d9620ed03a8fc217e179
SHA5126c186112ff79f1bad1c46ee7e67bb93d435d4420096ae8c450315b78f1aaa59e7923dfa48e61a2ebf29114bc97cac70680676d255b2072c736fb93f961ea0435
-
Filesize
13KB
MD5f99b4984bd93547ff4ab09d35b9ed6d5
SHA173bf4d313cb094bb6ead04460da9547106794007
SHA256402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069
SHA512cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759
-
Filesize
1.7MB
MD565b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
Filesize
1.1MB
MD520f5a9440a46acd791f3e14a51168709
SHA16228ed232ea25299e4ec54654bed013d8022c6ee
SHA256838b3a60041cef51e5e5ef385c9753d3526fcb0429c322374bb14d08512683a3
SHA512f847f68789c9d02b14fadb6f0f6d402d2aaf6f866a56a1837d100c17eb1006f47b0f2a2f9e68e106fd420d0279e542679816182b2c9181be87b83ae4e20bc812
-
Filesize
10.6MB
MD55152124e9780ce8fdaffdb2ecf01f147
SHA1fd5c673082d3c82f84cdc9ef9aa3ebf167588170
SHA25670d612145ca07e3f272a8c4ca5f5bdc1c2e52fe5833c537d9d1d437e746c7c65
SHA512087790afa61f8d384185b5febeaca93a836d6ec9159282a328f47810a2c2cf6fde2c8bf27817748501cc37e3beacf618fb330b4d7e5f2d3d447b021e84da51bc
-
Filesize
97B
MD5362a98ff358cee4c06aedf4c8e6f8770
SHA1376b001129e2e64ecee89e27a343195f50c196a3
SHA256c02a8b5cd85868da0523b58370bc5b6f8c24fa5ac8e59d874f8ba1c21f4ef158
SHA512d60822a56650f91b3e108b9053558ca3367ce008b3972707e68986c874a856137efce7578def798248cea0852b664f429581e66c3ef67bb0e338e91501c76ab9
-
Filesize
1.5MB
MD512476321a502e943933e60cfb4429970
SHA1c71d293b84d03153a1bd13c560fca0f8857a95a7
SHA25614a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29
SHA512f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc
-
Filesize
58KB
MD551ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
Filesize
503B
MD50bdd93df3b5ee96569a2f22f9d617b8e
SHA17f8704c83cf599bb2e739698766f05089f70a5e2
SHA256c1d3be98c494f08e6de80f6e38ab94368cd33b199700ee5bd62e9d6d15063d1b
SHA512483714eff806aec59033e326b887a9f1cd7256cf49e88ca873a014fe95d564b0b29d18bab47f788be09d6bfe520f14e09c8c682d3275825c4145f833c72a7a9d
-
Filesize
1.6MB
MD5634fbe95ea4ef2e799b3d117dd9ec52e
SHA109533551abefbc922b87d1c2553329abd328c387
SHA2561ba4bc4f000dd9263307357ffa42d83eb01f59bf28aec16ef2eb74e24683412e
SHA5127d3857623c2d6806ed56e436fba2aa72ee57978ed8261894c3d7bb97a9f747d87866ca1dfaa2bc21ea22de1544fe7daf223565b7f16d894d02219ea9a690b7cf
-
Filesize
1.8MB
MD5e818a2384a90a03d8314cc4cf1cad1e0
SHA1a28e0df0e8853596db4508925e9b93f4b8e2e902
SHA2560585a29ddcdb6a4f0d23d4d09304768877ef1ae500c9664af9c21a6aff9d330c
SHA512e96d9fe81aff387b7ce844552fba43f20d3833cf75078855d6fa3d15b58a5486b7cec71d7499d82165425dd3ac25a624aa918251cff6044b4df3cfe096a02569
-
Filesize
3.9MB
MD57016ff8fcb9d9451139d7a7541512597
SHA1bf20fea9aa80a94531c4c3af8549b3e32bcada77
SHA25697d21bc11812933a88c45cec4bef20e346952fc4a4144c93b19a205d20420a57
SHA512b1ceab00b09c6feb716658e19b3021a8fe2d79ff06888b94376652907931aa67a451bb775ed0fc53fbd661f8b3ecaf98b8304604c1341df4ef21e9feac035e99
-
Filesize
2.1MB
MD5d9ec2bce43693cd8c042abda75cc2f82
SHA1fb270d5ccecdd9f18b01438b371e1caf72548fb4
SHA25661271188de7b7dc646c38eb9aff1e5582b7d8981f19af2c8684ca12902bc3454
SHA512d5bb890b4e344e090023bc100778fe557b8972a3640b3c2a5528523c44de26b5524523dbad3ba1bf05b1a3154f5c5d6f98411f2866e66368794427d0ca2127c9
-
Filesize
498KB
MD55af346c85e6a347401ebd8798035df35
SHA1036e6513eccaee195ba637e85683744a8dce09c0
SHA256e7129b9545ead3dc009bcf40b5368eac467705889478cfac339cfa129631b87d
SHA512117338b32f8610facf930748b4d916bb9cc90dba1c72f2059e52219726d19f8dc6314c46505e80e492104ac7b4e5222419036c8ceb9477da12fc9ce32fbdda77
-
Filesize
5KB
MD5ee8ec729ed8d9c47837b12eefe91e699
SHA1eb5aca5d1ab3924850714f920ff799348b38a09a
SHA256921bb19943f8eb02ef6ef5836fb42509b94c2e08f957457e4623bfdce1566745
SHA512187107c6e8481b8af967da57cfb8d7388989b60211527ab4847430edb01765749e4ae3c57329d41d9583d7cc35c81567234599a48051a1bc3eb7b1669656e6f2
-
Filesize
2.4MB
MD537942174e71daee7d2c01d854fb0f099
SHA1828efb5608816121a21291e384c8cf95967214af
SHA2568c841a5c438dc26b0249081c0ecc1e2d0a6f25392084b26a0362e0a88b52a37f
SHA512c0f724ff4c827943b6ef30a66929875c7e7fd9a16d3004da892c8172c3e983754bdc04807019ba5bce430e2ca785d01114ec4f00c014edc4d8f66acf6bf42174
-
Filesize
1.3MB
MD52fb5455dab77dd4d793aafa3df21b013
SHA1453ef895e9edc4b22cddd9d4881afa19295ad2c0
SHA256160785406249aae0e5f2bd62dd5daf64a15ce9bbb36c57a6f8f5c1ddb6390d9b
SHA5122e5d7eb6a881b8e7d8309dd2cbe8c57c06c2acc2e2a50004717a9354b372a694d511bd197730d8528b4d4fc446134fa95fc0ae496feab33c854e14e9c8574c0f
-
Filesize
528KB
MD57d72db8aaceccd5cab82e0f618ce9d81
SHA1c690d1e3a90499ce1b63ee9388dfaec786751e1e
SHA256a8374f4efacd0d4ace4f78a781baf7a1e0913edaceb8feddcb82d07b68a1bcab
SHA51288ff9256d7bfe8d724e42f59be08e51e70244d546ac8ef6466864d2466e52aac5d84acb0ea552168701e5e1d1eceee0696a0e3a40de2d83ab720e0e69de0d6d2
-
Filesize
610KB
MD56331d170c7c2c06ea9ecf289987a8db2
SHA1e938ff9b901d2a51a076688f0a8af8b241433600
SHA256b452a777118ad0153b13c0aa7d141c34f9f7c212d082998c071f69ce10f09234
SHA5127ace643fa9e0320c8aeabe57c725868a0ed654130a89e1b799f03de6f19ad0a273c5bafb27ff3afc1dbc438fb37cc304abb188a25a7259e508e70753cf160944
-
Filesize
44B
MD57b24665f2db82f311bff238f05eb639a
SHA14001fddab3079c1f50207c6b19e782cfefa059c5
SHA25681c2e1e08984f45a9fcd8a5e54087b5b2160ed553b584bac7ef589c0867e4478
SHA5125cb0ae0a5a5e995adf21975b25b121103e56d6ad2f5bef5759d93e389f00ac62c4a963bdd80aa9e703e285dfe8acc9ca036e03b9b3d445ed516021397467d2a4
-
Filesize
377KB
MD55eb7d1110a6268092d008d93701a08b5
SHA16c1d846d8d01ee31f18c3bca5ad0245aa6a056ec
SHA256b858e24eac464afd49d6bf782557f946b03e5e97431a1987b09b0203b5636c97
SHA5128029b8f196d4030589c8e2ae8de5ff13892ae0619da35f600b028e8ca0c7bb76b9d5c0f623ce97c674d9e6ca5b9e01f6ab6f9b1313d87654797e247eca2fd669
-
Filesize
1.8MB
MD509bea173fb3f7244bfddaa3b110761a8
SHA15a4a6b0d01643616121cf258c671b22b65c91e1f
SHA256674a3e21beb7da6768d1484ffdbddf88a2f7cbebe9355c1e7646e6831795c894
SHA51209cf74fbee32eb13751000868eafb32a0008d469536db9a97ff924191842684de55910b513896d9960e159a06dcd9009631fdac7349ce36735d126c0c6561fb7
-
Filesize
44B
MD5e56df68ac513d0d1bd4e36b6fd24f710
SHA1bccae5ce3fae788789115d9963d7dc70598c76db
SHA256fb2696efa485021c577b6d6966e03e35dc7dd0f3f86825e17328eafd95a3c777
SHA512f84e4fed8ee4df08a61c23b5911e13335ca07912ca1011acaafb7bc3756d60a7ff745945663b2f1bc2f267997bfe6ebe5777ca505509f3121e25053e5098b9f4
-
Filesize
31B
MD5b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
Filesize
1KB
MD5c7be3c661dc1ae8c3c5cee7c5463b8b7
SHA16bc151f7473448fc7ae464443be9e6ca0343bbd3
SHA256ffbc54f9854804b7a5b12dda41be1af202b4ee0f39be12ec57e2ab0860d3e1bb
SHA512096861535dcfe6dd7420b2139f5b79d46baac47e7aab86d0bdcf3dd9403d34b7da4d98d62aae5e03a8c4ea6536d1581750d944078eb2d30643ae392741f4cd7b
-
Filesize
2.4MB
MD52f7b6979529e98725c226681b9431206
SHA112a2e01e39f79997b1fd71f33da78c672b37b590
SHA25622241dd602bb54f1d16db7723c5033d1bd88b2b8218b7e36eaeef746ad0c9823
SHA51234d380be583b27f39b8aeb93f9944370cbe9857699976535fff230e43883d4c497216ddf3d5501d9daf436aefb8f57b8d88a7e6933e2f243defb45aa476851b1
-
Filesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
Filesize
103KB
MD54d4c98eca32b14aeb074db34cd0881e4
SHA192f213d609bba05d41d6941652a88c44936663a4
SHA2564182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f
SHA512959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf
-
Filesize
6KB
MD59a20e75b4583cbf9c1018d79ffefc7ef
SHA1ebb4336dff312e65fd15074088d532ad50b6bd54
SHA2564c0743e51f9236c9ccee5e83b709096f51e06a17cb3bc8eb69d88878641abbf5
SHA5125681ae1020b9aa0cf48472eb842ba7a0e573029e1651d821cc7248a1567f8a825bb44aebfe637a1eec5ec0cfe6d2c4fcde08e72afbb987ddc86e9e00112de78b
-
Filesize
6KB
MD58b2c4a7dd08f12aed19ec10998b40d32
SHA1aaa7214a19d638ed18a9ad03189a7f3aa58730e9
SHA256bb2358fc0baa751568d162bed12ca7f34f2b9abe33821396546bc7dbc509b53c
SHA512634df8da027274ad7ee955d5285a4dd17dbf413db5e5b21555722c7b1998f8c0f0ab16210d87bafb9a242487f4fa6d96026e3da0faf46ca3efd9f985e18a915b
-
Filesize
5KB
MD5e7c07b62c73089e7921181a87b7f1755
SHA1cb989207fa7c2727123b377d57c953836c28c8f2
SHA25658c8c7ff07cb54c6f6c568cba1048367a00502ff40f9a06070a0e7976dbf3a97
SHA51263870100ed91d8c2d028af450b25774a986000f34c81b8a335688b9516d19936c83948e8fd2f1dae41f8111bc747a899c2f41b01abb4a1ee03f0d19127769fe4
-
Filesize
6KB
MD51b24142087d59fd4049932d3ba089c63
SHA1c91440d73716d347f7086ab0de05eb1c0cf22e42
SHA25668e24ba310b9cd999210900204e12c770b56aabb9ca36efb948a37cbe4b2c457
SHA5125b557ba6dd8d6b1cec00bfc47b557484af855c2962fba7a41b9db2f64e0eb6d2807d4112024892fe473fb5547d955d818e8d3b1303e3e6f25635c2fc13b0e4d0
-
Filesize
982B
MD5c7a895997138b293aca452110a961dd4
SHA199156ca9682a2c29d26d77a069c3ea324dc7014c
SHA2565a322d97f1edc59f433c4e24148cba2756ff5161e1a5add050853ee7c8ea0b18
SHA5120cbd7351c509839de35f5041252e0e2c3e5f1023e577f02cc1170768a6cb52c9130f75d16520b967a28526e173ce508026e79217c8442986ea9ce143968ab9d2
-
Filesize
27KB
MD5a867e6365033fb80ccd0967b657205fd
SHA14a298f4a67b9a06f75cb8b9df54514f34b674b10
SHA25692cceade0c6935e4148c8e639e450773f29d03e05bcc206ef73cb40875ed34bf
SHA5123201afe111b0d4e3dd78339b0016f52318f9ce4d2f2c258ba53f0d28d34cee28696db380fb26e4bdc34ee1244e3950aa15dba9539ba5a55d58412d632ce6af87
-
Filesize
4KB
MD5dce7201e71cf6fbe3700fcb5dbc3a672
SHA103b4a2ede47af8f33793926abf1430c40291252e
SHA256544357b3f1e2967cd8e5a95e315993cbee324506389e70c1f61552292de82b41
SHA512ccaf6ea126a782a1e5b49e8876644ac3b1bb285eeaa2dcc7b951b6e10756d209ff8aefad33564badd6210918965ba544f31793aa160c627dd4451e558f43a6ed
-
Filesize
671B
MD5a4ee991a6bb43261a26273d69674f44d
SHA1ed4e1e9b664e988d0b0d584ef129a3d0d90a9c97
SHA256f5d77df364c9d1975b42df24e3d0c713de84aa1e127c0501d98354df14290ea0
SHA51278b8d534c744e573c92f96955f7f3c07811b6ed149527a6789a8859d626ae571431f7c1645b0d1b3f41a5e81dbb5f980b291d911c5eef7de181049ba0faf0316
-
Filesize
10KB
MD5e14cdc1591f60563ff1396c644c3d963
SHA1a1d89c88e035b8541d4bc80ee9c5f607dacc9ee4
SHA256988f4f655a4cc2d5ef6f61ce369074dd2139c2f86a03b50c68b2d7f1c50b3c00
SHA512f17a243fb5eb8bcc6b30e80c531422035347216f61cd199108d66493a129ea515c70e37e394a44ab54284535ab67e8616c0ffe46afa0a9c5ec408342a011699a
-
Filesize
10KB
MD551ce66ae2497d368b8ae047989680616
SHA1f55c3629ad9ec0d2a4ed9568708b8ddfbd176a6b
SHA25623e5940a4cfafe399c4a9525a00dc50ff39958e69273cf5d9edad7b690344ed9
SHA512adbf6dd2a0acdb41b62757d794478373cbe2f28c74cde99bbc08c934dbfe32e1f501c7caa41f96da356bc4ea28efd9e07207026055f192005f721de3fdc1a400
-
Filesize
26.5MB
MD5a803f82431678efa91e202dfc4e59dfa
SHA1aac1594ee4bc7d91b640c2d5b66c64e7b7671cc3
SHA2566b2816073c1bd747fe54b0e1876ef261a93af763bc4e8754d389d265afda1b04
SHA5124f2965a6f7edbd23d4aa317b66fc4aa2bf46e5a0905cd48fa63920c7e859f46aba0bc3759fcde66c523e4b615a367e789857349d6d8a029e5ffe746cbaa01053
-
Filesize
13.4MB
MD548c356e14b98fb905a36164e28277ae5
SHA1d7630bd683af02de03aebc8314862c512acd5656
SHA256b2f43148c08f4fe2a0902873813fd7bbb9b513920089939c220826097480396c
SHA512278ae5723544691844aae917938c7ab835f5da9c01c59472497112ca9f5d326a2586fa0bc79fbd0d907aab972b3f855c0087656c5e10504adc760b756ada221b
-
Filesize
13.2MB
MD55aaa5c6788ccdc89c2d393ae139a1479
SHA1d176526637cabd9af128ae485363731c73016b97
SHA25647e2d401491fa349aff65afd36809607588a13555a4353b32fc37ba812ce553f
SHA51288fd03792c8e3c3c89f5ad82a99ed5a90175969b7c90bb82c57887d49c2781b2b0aa7954e3e252fbfa46440de17d44f88cdaeffec79c311bf7525067da7d8651
-
Filesize
9.5MB
MD534cbb7645c079ba403250edea20ad34e
SHA1feebf5bd2332cd26ae6bc3770725987da19befba
SHA2564fc6b36e62dd4619193a22c3aa43dd905895d5bd2c8aa8ebf5098958dbef988e
SHA51280d64d20a119d1bbf83c8a417216e6171eb8c786cb7f0d03ab5da41ae76f57486c1ac5fed01a0751ae19be8dfd661e25c3ac4da9873c840ed06c4e1f4ae30367
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
908KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
6.4MB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
908KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
6.4MB