f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Size 90KB
Sample241111-pj7pgazbph
SHA256 f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334
MD5 13dce828817daf262a3435de96e30277
SHA1 4abaf7eeb5fa68deb4662d31b887cf8b6c1e6950
SHA512 5e16471086340adcc349887b9d5aaf78f41e423a136238cc65f9d50467e9a16c08c7ddb2d20130e69575d4519f7c4e4d86d427ae32e0d2711506ca614e1d9587
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTyvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNyvOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 14 IoCs

pid	Process
2512	xk.exe
4300	IExplorer.exe
3220	WINLOGON.EXE
3596	CSRSS.EXE
5064	SERVICES.EXE
4896	xk.exe
3492	IExplorer.exe
3464	WINLOGON.EXE
3572	CSRSS.EXE
3528	SERVICES.EXE
3992	LSASS.EXE
820	SMSS.EXE
4508	LSASS.EXE
3484	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File created	C:\desktop.ini	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened for modification	F:\desktop.ini	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File created	F:\desktop.ini	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\J:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\T:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\X:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\Y:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\B:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\H:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\L:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\P:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\R:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\U:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\W:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\G:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\K:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\O:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\Q:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\S:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\V:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\Z:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\I:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\M:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened (read-only)	\??\N:	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File created	C:\Windows\SysWOW64\shell.exe	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File created	C:\Windows\SysWOW64\Mig2.scr	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3924-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b64-8.dat	upx
behavioral2/files/0x000a000000023b68-106.dat	upx
behavioral2/memory/2512-113-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b6c-112.dat	upx
behavioral2/memory/4300-118-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b6e-120.dat	upx
behavioral2/memory/3220-125-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b6f-126.dat	upx
behavioral2/files/0x000a000000023b70-133.dat	upx
behavioral2/memory/3596-131-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/5064-138-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b68-187.dat	upx
behavioral2/memory/4896-188-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b6c-192.dat	upx
behavioral2/memory/4896-194-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3492-198-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b6e-200.dat	upx
behavioral2/memory/3464-204-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b6f-206.dat	upx
behavioral2/memory/3572-208-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3924-207-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3572-212-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b70-214.dat	upx
behavioral2/memory/3528-218-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b71-220.dat	upx
behavioral2/memory/3992-225-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000a000000023b72-227.dat	upx
behavioral2/memory/820-232-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3924-258-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4508-265-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3484-269-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/3924-270-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
File created	C:\Windows\xk.exe	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
2512	xk.exe
4300	IExplorer.exe
3220	WINLOGON.EXE
3596	CSRSS.EXE
5064	SERVICES.EXE
4896	xk.exe
3492	IExplorer.exe
3464	WINLOGON.EXE
3572	CSRSS.EXE
3528	SERVICES.EXE
3992	LSASS.EXE
820	SMSS.EXE
4508	LSASS.EXE
3484	SMSS.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 2512	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	85
PID 3924 wrote to memory of 2512	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	85
PID 3924 wrote to memory of 2512	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	85
PID 3924 wrote to memory of 4300	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	86
PID 3924 wrote to memory of 4300	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	86
PID 3924 wrote to memory of 4300	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	86
PID 3924 wrote to memory of 3220	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	87
PID 3924 wrote to memory of 3220	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	87
PID 3924 wrote to memory of 3220	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	87
PID 3924 wrote to memory of 3596	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	88
PID 3924 wrote to memory of 3596	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	88
PID 3924 wrote to memory of 3596	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	88
PID 3924 wrote to memory of 5064	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	89
PID 3924 wrote to memory of 5064	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	89
PID 3924 wrote to memory of 5064	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	89
PID 3924 wrote to memory of 4896	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	91
PID 3924 wrote to memory of 4896	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	91
PID 3924 wrote to memory of 4896	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	91
PID 3924 wrote to memory of 3492	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	92
PID 3924 wrote to memory of 3492	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	92
PID 3924 wrote to memory of 3492	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	92
PID 3924 wrote to memory of 3464	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	93
PID 3924 wrote to memory of 3464	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	93
PID 3924 wrote to memory of 3464	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	93
PID 3924 wrote to memory of 3572	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	94
PID 3924 wrote to memory of 3572	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	94
PID 3924 wrote to memory of 3572	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	94
PID 3924 wrote to memory of 3528	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	95
PID 3924 wrote to memory of 3528	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	95
PID 3924 wrote to memory of 3528	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	95
PID 3924 wrote to memory of 3992	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	96
PID 3924 wrote to memory of 3992	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	96
PID 3924 wrote to memory of 3992	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	96
PID 3924 wrote to memory of 820	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	97
PID 3924 wrote to memory of 820	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	97
PID 3924 wrote to memory of 820	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	97
PID 3924 wrote to memory of 4508	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	110
PID 3924 wrote to memory of 4508	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	110
PID 3924 wrote to memory of 4508	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	110
PID 3924 wrote to memory of 3484	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	111
PID 3924 wrote to memory of 3484	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	111
PID 3924 wrote to memory of 3484	3924	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe	111

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe

C:\Users\Admin\AppData\Local\Temp\f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe
"C:\Users\Admin\AppData\Local\Temp\f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3924
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2512
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4300
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3220
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3596
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5064
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4896
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3492
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3464
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3572
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3528
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3992
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:820
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4508
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 90KB
SHA256 96fc552e9c006b5ac91093882af2a101ddab85083d1c6c4e6252e64db58d3341
MD5 d228725095171a426a11e45014b876a8
SHA1 cfabd52d9d4bf414c52d64555192e764e0391fee
SHA512 0f6f30bb8677227b7784dd8b9697a37d33b7c92318f6bb8b44e7f27cfd52c8a71d98614a78362d271f12cc5887addc84e4eb1937c7c660414e88162cf554a1eb
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VT4AvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutN9vOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 90KB
SHA256 e732babe72a6077b43cea4cd42beb59171dfcb07d3af8d833828acd62dce0ee7
MD5 e0638b072e169a2d252e162ab3269681
SHA1 d19b41f2009b5a1b497e13ee2eae269cdd6f9a00
SHA512 3c1ecbc74409326d00cce2f5d901a7000f05c772c9a0f9378af467bfc29486b4dcef38f4bc78d873a08d2a2da3cf58a7809702e197f6c1951d6529a0d9342c48
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VT7OvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutN6vOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 90KB
SHA256 d74e73eb7511ec8f82ddafb3715302c5b06e22b5602fa64cc948b719e0172f8e
MD5 04d586e428cf9a91f491198159bc03e1
SHA1 3176475196dfa840600e179261b926c514ec7267
SHA512 a713cd432871095db644b3b4d7a4a0178d51c7602cb44775bce5b404d94231d67c9c07d1642900d2812657ccb703e93901494d65198855ad75d04c49ff9f85ec
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTOvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNOvOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 90KB
SHA256 88574d628f5455e6bd9cdb658b6acf682132eaffce992c7ba06994db62de09d7
MD5 479f3c9f7c42a365cb35981742cebfb3
SHA1 64f4338fdb40239d5dae8486336c6bd5f1a2326d
SHA512 d17cbc8c6f66c2285214a0324a7ff2edfc729e737bdb47b6e83795c2b7067fdf66537e10b2c5fff09b9f64b043519ccc041caa9389551bb6817c1714f3a48dee
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTWvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNWvOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 90KB
SHA256 0a5f6a05ebf46f9dedf9e03431caeda4ac512a100686840ffa27f4745856df1e
MD5 7998a0c7500008ef65579cc16599bb50
SHA1 cfc6b7983383bf96f1953a92d25ca559b2dee13e
SHA512 fdbad6e58751cd7b84b66087dd4e8cbfcb1a6e5c86a8f67ae0ced2929151251fca5f4a5527f02e669b4e5fc674c24e383898d84f37a575d53ee2b67df802a92c
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTDvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNDvOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 90KB
SHA256 02ea7d3da19f263f781937b4a0b74766ac8c684561f96ce31f30577739a9e10e
MD5 31998847f109e32598ff103df87c75b1
SHA1 a80650d99e86f6f767866756957e027ccc7ac3ec
SHA512 b4a4371691be4dfbd819b7c0ce2b07a641205b61fbfdc8b01849ed77ec6536873f6a69008a9684f116cedad056e87df0ac1d7017fb773715f5b894990c7556f1
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTjvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNjvOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 90KB
SHA256 f313f284c520aa7f0c2757c9b104380a75150ecf97bdf8df99aaa4e8cda5b5c9
MD5 47b57e7271683f99e6e9d6fe6c90c6b0
SHA1 635f4161c04f7ba1edbdc8b9dbe96f8b2d7e3ecf
SHA512 52809f9ded25c06b3c2fa4503ed847410031f478b250d4d8faa6108a6fdbd53d9a3353cb41b8aa8b5788dc77c0ce509b1fbfc7a74483da2ac96c4ddb0cf3d3b6
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTDvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNDvOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\winlogon.exe
Size 90KB
SHA256 f7f30ef25c64595bc462068781ee2e8592930f2351b6dcee38de66bd4451b334
MD5 13dce828817daf262a3435de96e30277
SHA1 4abaf7eeb5fa68deb4662d31b887cf8b6c1e6950
SHA512 5e16471086340adcc349887b9d5aaf78f41e423a136238cc65f9d50467e9a16c08c7ddb2d20130e69575d4519f7c4e4d86d427ae32e0d2711506ca614e1d9587
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTyvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNyvOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
Size 90KB
SHA256 a072ef8ec1056062fd534d83000afa9109347a6c523af913d6e7a0fd4a021e5c
MD5 5d30438f46a3085bd05412bbd38da264
SHA1 790ab8a9f20a2959d827c1df444066ca062112ef
SHA512 ff472e65c3da9338185ee53be7fb07e2bae98b25510a0093bd8212f544d9733ac26169c98a0c508780d54c2e176dbe455448a8ac0282cf4e7e140feaa934a87a
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTsRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNsOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 90KB
SHA256 32ed1470dcd0b6deab2857112e958039928030fbab6913cce61b086cd5b04b08
MD5 34b81b77ad9921bd349df928215b7e8e
SHA1 79ecbbe97ffc4a2aa2bf5c9979b3c267610b910f
SHA512 8f9574419de835625a62da1f2ba51c2095c2aef480a911adb4b066ca303cfc0b54adab2e10c51018df02be5a44d87c39e2545c31c930d21884fa6d9052e2833d
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTBvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNBvOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 90KB
SHA256 d93dde2fc5eaa39c8ff128b37dfa3200417fe8c1c308d1c070e3a3b2bef870e8
MD5 1bb9d2741a35b804063e5f3a2dddcfbb
SHA1 552d606ee44b5f2bfe47e6528732d5ce3814e26d
SHA512 92fe6870664f5b961a33b4805b67d699543024fdeaefca20486144d76008e289535ab35cadc2bfb871139524c475b14a209bcb6a583bf9c3dedd0a8f6dfdfd96
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTmvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNmvOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 90KB
SHA256 4be293f79d6ecc9f717dc57b02221f6ec1bcf33d88ba2957d8db8e3b85e773e9
MD5 cebd07f77b1a16814a64d11b531e03e7
SHA1 5eb69a45ae63261f289900ef820b4babf211be52
SHA512 957a82c8c7cba532d0099fd4b73af137e5dcf3ec8988aa870e3061fb0125cc0e70579a2283f1bae68ac5ebcf6eb6c8378efd83c75ddf68967b82d9f742430e1d
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VTVvRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutNVvOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 90KB
SHA256 51b73e5fd2b78a4bf992e5145e0166aa2211e11b83dc8e8200a14e4a18bdc503
MD5 a34a8faac2771d5ab3519703980886c4
SHA1 35064abb0a26d945a7111f2609f46d332ef8adb4
SHA512 b3f18c7b7a9da4d81e175a6de235501fe8edadada729db1b33d28969f4fa5baaff26a821b42b0bf83e15adbd77ee68661ab76e0d2864468b8e15cd11c68b349f
SSDEEP 1536:ERsjdf1aM67v32Z9x5nouy8VT/vRsjdf1aM67v32Z9x5nouy8VTM:EOaHv3YpoutN/vOaHv3YpoutNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/820-232-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2512-113-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3220-125-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3464-204-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3484-269-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3492-198-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3528-218-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3572-212-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3572-208-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3596-131-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3924-207-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3924-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3924-258-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3924-270-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3992-225-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4300-118-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4508-265-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4896-194-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4896-188-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5064-138-0x0000000000400000-0x000000000042F000-memory.dmp

Download