phorphiex | 2840a81e534aa9badebe491f4e4a860a137f8eeb6f70e51c6262d832c5f576eb

Resubmissions

18-11-2024 14:01

241118-rbsxfsxpb1 10

18-11-2024 12:18

241118-pg2enswhpk 10

Analysis

max time kernel
56s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20241007-it
resource tags

arch:x64arch:x86image:win11-20241007-itlocale:it-itos:windows11-21h2-x64systemwindows
submitted
18-11-2024 14:01

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

phorphiex redline wannacry xmrig newbundle2 defense_evasion discovery evasion execution infostealer loader miner ransomware themida trojan upx worm

Malware Config

Extracted

Family

redline

38.180.72.54:42814

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Files\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Family

redline

Botnet

newbundle2

185.215.113.67:15206

Signatures

Phorphiex family
phorphiex

Phorphiex payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\o.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\Files\r.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\new1.exe	family_redline
behavioral1/memory/4324-138-0x00000000007D0000-0x0000000000822000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\Files\newbundle.exe	family_redline
behavioral1/memory/4472-1876-0x0000000000A60000-0x0000000000AB2000-memory.dmp	family_redline

Redline family
redline

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

nxmr.exewinupsecvmgr.exe

description	pid	process	target process
PID 5080 created 3280	5080	nxmr.exe	Explorer.EXE
PID 5080 created 3280	5080	nxmr.exe	Explorer.EXE
PID 1164 created 3280	1164	winupsecvmgr.exe	Explorer.EXE
PID 1164 created 3280	1164	winupsecvmgr.exe	Explorer.EXE
PID 1164 created 3280	1164	winupsecvmgr.exe	Explorer.EXE

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 5 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1164-110-0x00007FF6F6460000-0x00007FF6F69F7000-memory.dmp	xmrig
behavioral1/memory/4968-114-0x00007FF6EAF20000-0x00007FF6EB70F000-memory.dmp	xmrig
behavioral1/memory/4968-511-0x00007FF6EAF20000-0x00007FF6EB70F000-memory.dmp	xmrig
behavioral1/memory/4968-1780-0x00007FF6EAF20000-0x00007FF6EB70F000-memory.dmp	xmrig
behavioral1/memory/4968-1798-0x00007FF6EAF20000-0x00007FF6EB70F000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2372 powershell.exe
1872 powershell.exe
4028 powershell.exe
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 9 IoCs

Processes:

NorthSperm.exenxmr.exeOptimum.pifwinbox.exewinupsecvmgr.exenew1.exesplwow64_1.exeWannaCry.exetaskdl.exe

pid process

684 NorthSperm.exe
5080 nxmr.exe
1616 Optimum.pif
1260 winbox.exe
1164 winupsecvmgr.exe
4324 new1.exe
3140 splwow64_1.exe
2044 WannaCry.exe
3200 taskdl.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4772 icacls.exe

pid	process
2372	powershell.exe
1872	powershell.exe
4028	powershell.exe

pid	process
684	NorthSperm.exe
5080	nxmr.exe
1616	Optimum.pif
1260	winbox.exe
1164	winupsecvmgr.exe
4324	new1.exe
3140	splwow64_1.exe
2044	WannaCry.exe
3200	taskdl.exe

pid	process
4772	icacls.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\hhnjqu9y.exe	themida
behavioral1/memory/4868-1825-0x0000000000A80000-0x00000000012FE000-memory.dmp	themida

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

6 raw.githubusercontent.com
44 raw.githubusercontent.com
Enumerates processes with tasklist 1 TTPs 2 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

4424 tasklist.exe
4548 tasklist.exe

flow	ioc
6	raw.githubusercontent.com
44	raw.githubusercontent.com

pid	process
4424	tasklist.exe
4548	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

winupsecvmgr.exe

description	pid	process	target process
PID 1164 set thread context of 1320	1164	winupsecvmgr.exe	conhost.exe
PID 1164 set thread context of 4968	1164	winupsecvmgr.exe	dwm.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\winbox.exe	upx
behavioral1/memory/1260-70-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1260-104-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1260-126-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Drops file in Windows directory 12 IoCs

Processes:

NorthSperm.exeUserOOBEBroker.exesplwow64_1.exe

description	ioc	process
File opened for modification	C:\Windows\AnchorAnnotated	NorthSperm.exe
File opened for modification	C:\Windows\CheckingReliable	NorthSperm.exe
File opened for modification	C:\Windows\ConferencesInto	NorthSperm.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64_1.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64_1.exe
File opened for modification	C:\Windows\GamblingCedar	NorthSperm.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\HardlyAircraft	splwow64_1.exe
File opened for modification	C:\Windows\IpaqArthur	splwow64_1.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

1260 sc.exe
3272 sc.exe
4368 sc.exe
5452 sc.exe
136 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1260	sc.exe
3272	sc.exe
4368	sc.exe
5452	sc.exe
136	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

NorthSperm.exefindstr.exeWannaCry.exeattrib.exeicacls.exe2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.execmd.exeOptimum.pifwinbox.exenew1.execmd.exechoice.exesplwow64_1.execmd.exefindstr.exetaskdl.exefindstr.exetasklist.exetasklist.exeFileCoAuth.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NorthSperm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Optimum.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	new1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64_1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

Processes:

BackgroundTransferHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

156 reg.exe

pid	process
156	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

new1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	new1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	new1.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

Optimum.pifnxmr.exepowershell.exewinupsecvmgr.exepowershell.exe

pid	process
1616	Optimum.pif
1616	Optimum.pif
1616	Optimum.pif
1616	Optimum.pif
1616	Optimum.pif
1616	Optimum.pif
5080	nxmr.exe
5080	nxmr.exe
2372	powershell.exe
2372	powershell.exe
2372	powershell.exe
5080	nxmr.exe
5080	nxmr.exe
1164	winupsecvmgr.exe
1164	winupsecvmgr.exe
1872	powershell.exe
1872	powershell.exe
1872	powershell.exe
1164	winupsecvmgr.exe
1164	winupsecvmgr.exe
1164	winupsecvmgr.exe
1164	winupsecvmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exetasklist.exetasklist.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe
Token: SeDebugPrivilege	4424	tasklist.exe
Token: SeDebugPrivilege	4548	tasklist.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	powershell.exe
Token: SeSecurityPrivilege	2372	powershell.exe
Token: SeTakeOwnershipPrivilege	2372	powershell.exe
Token: SeLoadDriverPrivilege	2372	powershell.exe
Token: SeSystemProfilePrivilege	2372	powershell.exe
Token: SeSystemtimePrivilege	2372	powershell.exe
Token: SeProfSingleProcessPrivilege	2372	powershell.exe
Token: SeIncBasePriorityPrivilege	2372	powershell.exe
Token: SeCreatePagefilePrivilege	2372	powershell.exe
Token: SeBackupPrivilege	2372	powershell.exe
Token: SeRestorePrivilege	2372	powershell.exe
Token: SeShutdownPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeSystemEnvironmentPrivilege	2372	powershell.exe
Token: SeRemoteShutdownPrivilege	2372	powershell.exe
Token: SeUndockPrivilege	2372	powershell.exe
Token: SeManageVolumePrivilege	2372	powershell.exe
Token: 33	2372	powershell.exe
Token: 34	2372	powershell.exe
Token: 35	2372	powershell.exe
Token: 36	2372	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	powershell.exe
Token: SeSecurityPrivilege	2372	powershell.exe
Token: SeTakeOwnershipPrivilege	2372	powershell.exe
Token: SeLoadDriverPrivilege	2372	powershell.exe
Token: SeSystemProfilePrivilege	2372	powershell.exe
Token: SeSystemtimePrivilege	2372	powershell.exe
Token: SeProfSingleProcessPrivilege	2372	powershell.exe
Token: SeIncBasePriorityPrivilege	2372	powershell.exe
Token: SeCreatePagefilePrivilege	2372	powershell.exe
Token: SeBackupPrivilege	2372	powershell.exe
Token: SeRestorePrivilege	2372	powershell.exe
Token: SeShutdownPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeSystemEnvironmentPrivilege	2372	powershell.exe
Token: SeRemoteShutdownPrivilege	2372	powershell.exe
Token: SeUndockPrivilege	2372	powershell.exe
Token: SeManageVolumePrivilege	2372	powershell.exe
Token: 33	2372	powershell.exe
Token: 34	2372	powershell.exe
Token: 35	2372	powershell.exe
Token: 36	2372	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	powershell.exe
Token: SeSecurityPrivilege	2372	powershell.exe
Token: SeTakeOwnershipPrivilege	2372	powershell.exe
Token: SeLoadDriverPrivilege	2372	powershell.exe
Token: SeSystemProfilePrivilege	2372	powershell.exe
Token: SeSystemtimePrivilege	2372	powershell.exe
Token: SeProfSingleProcessPrivilege	2372	powershell.exe
Token: SeIncBasePriorityPrivilege	2372	powershell.exe
Token: SeCreatePagefilePrivilege	2372	powershell.exe
Token: SeBackupPrivilege	2372	powershell.exe
Token: SeRestorePrivilege	2372	powershell.exe
Token: SeShutdownPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeSystemEnvironmentPrivilege	2372	powershell.exe
Token: SeRemoteShutdownPrivilege	2372	powershell.exe
Token: SeUndockPrivilege	2372	powershell.exe
Token: SeManageVolumePrivilege	2372	powershell.exe
Token: 33	2372	powershell.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

Optimum.pifdwm.exe

pid	process
1616	Optimum.pif
1616	Optimum.pif
1616	Optimum.pif
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

Optimum.pifdwm.exe

pid	process
1616	Optimum.pif
1616	Optimum.pif
1616	Optimum.pif
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe
4968	dwm.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exeNorthSperm.execmd.exewinupsecvmgr.exesplwow64_1.exeWannaCry.exe

description	pid	process	target process
PID 4384 wrote to memory of 684	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	NorthSperm.exe
PID 4384 wrote to memory of 684	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	NorthSperm.exe
PID 4384 wrote to memory of 684	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	NorthSperm.exe
PID 684 wrote to memory of 4592	684	NorthSperm.exe	cmd.exe
PID 684 wrote to memory of 4592	684	NorthSperm.exe	cmd.exe
PID 684 wrote to memory of 4592	684	NorthSperm.exe	cmd.exe
PID 4592 wrote to memory of 4424	4592	cmd.exe	tasklist.exe
PID 4592 wrote to memory of 4424	4592	cmd.exe	tasklist.exe
PID 4592 wrote to memory of 4424	4592	cmd.exe	tasklist.exe
PID 4592 wrote to memory of 4232	4592	cmd.exe	findstr.exe
PID 4592 wrote to memory of 4232	4592	cmd.exe	findstr.exe
PID 4592 wrote to memory of 4232	4592	cmd.exe	findstr.exe
PID 4384 wrote to memory of 5080	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	nxmr.exe
PID 4384 wrote to memory of 5080	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	nxmr.exe
PID 4592 wrote to memory of 4548	4592	cmd.exe	tasklist.exe
PID 4592 wrote to memory of 4548	4592	cmd.exe	tasklist.exe
PID 4592 wrote to memory of 4548	4592	cmd.exe	tasklist.exe
PID 4592 wrote to memory of 1180	4592	cmd.exe	findstr.exe
PID 4592 wrote to memory of 1180	4592	cmd.exe	findstr.exe
PID 4592 wrote to memory of 1180	4592	cmd.exe	findstr.exe
PID 4592 wrote to memory of 564	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 564	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 564	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 2772	4592	cmd.exe	findstr.exe
PID 4592 wrote to memory of 2772	4592	cmd.exe	findstr.exe
PID 4592 wrote to memory of 2772	4592	cmd.exe	findstr.exe
PID 4592 wrote to memory of 3344	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 3344	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 3344	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 1616	4592	cmd.exe	Optimum.pif
PID 4592 wrote to memory of 1616	4592	cmd.exe	Optimum.pif
PID 4592 wrote to memory of 1616	4592	cmd.exe	Optimum.pif
PID 4592 wrote to memory of 4912	4592	cmd.exe	choice.exe
PID 4592 wrote to memory of 4912	4592	cmd.exe	choice.exe
PID 4592 wrote to memory of 4912	4592	cmd.exe	choice.exe
PID 4384 wrote to memory of 1260	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	winbox.exe
PID 4384 wrote to memory of 1260	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	winbox.exe
PID 4384 wrote to memory of 1260	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	winbox.exe
PID 1164 wrote to memory of 1320	1164	winupsecvmgr.exe	conhost.exe
PID 1164 wrote to memory of 4968	1164	winupsecvmgr.exe	dwm.exe
PID 4384 wrote to memory of 4324	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	new1.exe
PID 4384 wrote to memory of 4324	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	new1.exe
PID 4384 wrote to memory of 4324	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	new1.exe
PID 4384 wrote to memory of 3140	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	splwow64_1.exe
PID 4384 wrote to memory of 3140	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	splwow64_1.exe
PID 4384 wrote to memory of 3140	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	splwow64_1.exe
PID 3140 wrote to memory of 4952	3140	splwow64_1.exe	cmd.exe
PID 3140 wrote to memory of 4952	3140	splwow64_1.exe	cmd.exe
PID 3140 wrote to memory of 4952	3140	splwow64_1.exe	cmd.exe
PID 4384 wrote to memory of 2044	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	WannaCry.exe
PID 4384 wrote to memory of 2044	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	WannaCry.exe
PID 4384 wrote to memory of 2044	4384	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	WannaCry.exe
PID 2044 wrote to memory of 4900	2044	WannaCry.exe	t.exe
PID 2044 wrote to memory of 4900	2044	WannaCry.exe	t.exe
PID 2044 wrote to memory of 4900	2044	WannaCry.exe	t.exe
PID 2044 wrote to memory of 4772	2044	WannaCry.exe	DllHost.exe
PID 2044 wrote to memory of 4772	2044	WannaCry.exe	DllHost.exe
PID 2044 wrote to memory of 4772	2044	WannaCry.exe	DllHost.exe
PID 2044 wrote to memory of 3200	2044	WannaCry.exe	taskdl.exe
PID 2044 wrote to memory of 3200	2044	WannaCry.exe	taskdl.exe
PID 2044 wrote to memory of 3200	2044	WannaCry.exe	taskdl.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

4900 attrib.exe
2708 attrib.exe

pid	process
4900	attrib.exe
2708	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe
  "C:\Users\Admin\AppData\Local\Temp\2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Files\NorthSperm.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\NorthSperm.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:684
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Surrey Surrey.cmd && Surrey.cmd && exit
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4548
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1180
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 719580
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:564
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "copehebrewinquireinnocent" Corpus
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Utilize + ..\Verzeichnis + ..\Built + ..\Vessels + ..\Cradle + ..\Jaguar + ..\Comics + ..\Flux + ..\Liberal f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
        
        Optimum.pif f
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1616
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Files\winbox.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\winbox.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\Files\new1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\new1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Files\splwow64_1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\splwow64_1.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h .
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4900
  - - C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Files\taskdl.exe
      taskdl.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3200
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 223901731938569.bat
      4⤵
      PID:2980
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript.exe //nologo m.vbs
        5⤵
        
        PID:4104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s F:\$RECYCLE
      4⤵
      Views/modifies file attributes
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Files\@[email protected]
      @[email protected] co
      4⤵
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Files\TaskData\Tor\taskhsvc.exe
        
        TaskData\Tor\taskhsvc.exe
        5⤵
        
        PID:1736
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b @[email protected] vs
      4⤵
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Files\@[email protected]
        
        @[email protected] vs
        5⤵
        
        PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Files\taskdl.exe
      taskdl.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Files\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\Files\@[email protected]
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Files\@[email protected]
      @[email protected]
      4⤵
      PID:2968
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ykbbwuyjdr767" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Files\tasksche.exe\"" /f
      4⤵
      PID:3664
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ykbbwuyjdr767" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Files\tasksche.exe\"" /f
        5⤵
        Modifies registry key
        
        PID:156
- - C:\Users\Admin\AppData\Local\Temp\Files\o.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\o.exe"
    3⤵
    PID:1080
  - - C:\Windows\sysklnorbcv.exe
      C:\Windows\sysklnorbcv.exe
      4⤵
      PID:3344
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        
        PID:3096
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4028
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        5⤵
        
        PID:4960
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:1260
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:3272
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:4368
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        
        PID:5452
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        6⤵
        Launches sc.exe
        
        PID:136
- - C:\Users\Admin\AppData\Local\Temp\Files\hhnjqu9y.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\hhnjqu9y.exe"
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Files\r.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
    3⤵
    PID:2328
  - - C:\Windows\sysvplervcs.exe
      C:\Windows\sysvplervcs.exe
      4⤵
      PID:1036
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        
        PID:1260
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        
        PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Files\Petya.A.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Petya.A.exe"
    3⤵
    PID:396
- - C:\Users\Admin\AppData\Local\Temp\Files\build555.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\build555.exe"
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Files\t.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Files\newbundle.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\newbundle.exe"
    3⤵
    PID:4472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:3248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1872
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:1320
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4968

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3736

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1404

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4352

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
1KB

MD5
1b1afbdb3c685f76e2ad2cdc88a875b8

SHA1
484d8a0ef6cfbd049ecdaf5cfb1e05c2a168a762

SHA256
f7513c14af034b8f78ed3929e80f3fa9b3d3325848fabad930767acb860ffdfa

SHA512
da190ba809209ecb63c8f663d576972dcb8d37e3a300454e90d38f6a5b021baf40d1da76bd80d222e2bfdfb95b3edbfdc4a3c604674a40d4d551addeb9add718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
4764ec833397133003e2e24b080cd7ce

SHA1
03c8926d7afc4e605719aee53ef2ce53f6f314cc

SHA256
88331ffd23c1d6cfef379ab5366333f56ee41ff083f0421915302a492cb2a833

SHA512
e9ad86bc3878f4f3e1a38a191864857f24969e0f11d0636cb76523900e97b06d286c120460c38e7f93039356f45900d32ddda990abffb1958af173dfb1aedac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fe8641a9c93905f937a67527bdb2d056

SHA1
4f7fc06a63e62054e5ea6023e710607eb64f37f8

SHA256
c447bedf4b3819754ea5ad0bb6acb252a020c513cf3f49985065833ae0d50928

SHA512
3eb369f672a7a6d2a6e75888fae7d3f3b40c78e6cdd1397df8d7a7559d3fcbf4a87bce89239655e4f4f4cde9478d2ec9176aaadae55a42e0b41b4ca93c997b1e

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\37a6723a-8257-434d-b871-9db447a53f71.down_data

Filesize
121KB

MD5
c2c241c1111d82bf82a4b92f3313d801

SHA1
f822956f60c463000e5aaaeccf8b99f551179250

SHA256
2081dc0f876ba518493f98bc18988ebe6cc6c23d9d963b5c4bb5c9ecef1f9f29

SHA512
04f745fa497c8115bb76b42bac6e03b7a0edd394f1c4a62f329015c545bba1bc9b517b7941806bcd23e84bcd289316649c1cbd9c6804cc83dce62dc26655cd7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\719580\f

Filesize
619KB

MD5
43ca848d3a9ee13623e355d9ee71b515

SHA1
944f72b5cc721b44bf50c0013b4b10151972074d

SHA256
3d4000a64c1b7be8fcefe59e8f39f1ae12ef1fcd9d30a39158f83b26ee189831

SHA512
e52336e652a69b34c41aa9283d8e2e8e795c5734507b23050f48aa25be4423eafcc416f38bf23463de0602c20a24f0fd75629ec23214119b4c4a98025be8513f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Built

Filesize
58KB

MD5
0a91386341f9d1a371bc735576b276a4

SHA1
a02598ef42cef1443cc94a8310a6c02df07119d4

SHA256
7b857693641ff1ff59e69422b09299a5580d20677acd530c27c7fbc9e3ee3b92

SHA512
b492508575c01689c982a8eb57fac2b5759e4c843c92f99d231b63c25ab4c82fa7fece9d4e9c2cc436a3232b4ed7947baecf2a06aafbf1a3cf243395af71e96b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Comics

Filesize
66KB

MD5
4a3aab84dbfdaf25ae909ac736489f4b

SHA1
76663cb1186f29fed429863013600c9d69355d36

SHA256
2caa4849a4353ca50dfdbc860412e95b783fdcc7e60d8756c9b4bdf2915e1923

SHA512
1c2b0ffa8783bb9e9082eae4214547d8ced58121e717b57884a56042a7ef70c55e702d7f018dea72ca95aa40170c6f24ccec7d56fa3b160237969b5c0473bea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Corpus

Filesize
236B

MD5
148febc94e0f8036a074350ef338b007

SHA1
1be93210e5348f9409fe4162599dfaad797a2ade

SHA256
849892bc358956ee263db6cbddd4a9cca0e1564d6caefe44e2e998d559e610a0

SHA512
72b83e8cb35bf6fe295f1cb84197f3ffb4944e19b9ece9f6664ed2bc4aca40c9c912debf260e891c80feebb4c84935da4c2996b9a100ce94cde177928f31fa92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cradle

Filesize
78KB

MD5
8c59dae352a159e484b0de9603dabc11

SHA1
34992e582081635abf736ec18f1492ae40ca4925

SHA256
3ab028b25bd6bd3ba48a92c4198dd8ff07fe71b4b41c785469d79da422f2fe46

SHA512
cf041cc9470ac479702c19714d875868a5168940a8d56715a98ae3d52f0363ffab160566d7c364b1bd9e8cb263b7e2b60e6719dbac7b6ad12e5f6a87e4f57d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Emotions

Filesize
19KB

MD5
b98d78c3abe777a5474a60e970a674ad

SHA1
079e438485e46aff758e2dff4356fdd2c7575d78

SHA256
2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4

SHA512
6218413866237bc1f6eada6554658a00c9fc55402e104576b33a2e8d4adf0fd952d8cc8d1ae3a02ebcfa030115fc388fc1a6f23b9d372f808e11e1b551064e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe

Filesize
271KB

MD5
564be60ec38590b61733648812b66536

SHA1
881f071bee59ba856b45a1fe11e7ed1d2123b017

SHA256
d9b41aeaaf67efd6370b267ab33dc39f149cbe9fd3f6dec30734f360e8ebfc6c

SHA512
2b6bed6c03b30cb659ad87c47328a853d73ec06cf48dff3472e9d7cf5a91cb7d5bace4b0c96df193a9c624dca796c580f4fd1f782fad2fbce280b8f018272c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\NorthSperm.exe

Filesize
1.5MB

MD5
ff83471ce09ebbe0da07d3001644b23c

SHA1
672aa37f23b421e4afba46218735425f7acc29c2

SHA256
9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba

SHA512
179c724558065de4b7ea11dd75588df51a3fce737db3ebc77c8fdc0b3a432f6f1fdcc5acd2e2706ab0f088c35a3310c9e638de92ce0a644322eae46729aea259

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Petya.A.exe

Filesize
225KB

MD5
af2379cc4d607a45ac44d62135fb7015

SHA1
39b6d40906c7f7f080e6befa93324dddadcbd9fa

SHA256
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739

SHA512
69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\build555.exe

Filesize
2.0MB

MD5
4e18e7b1280ebf97a945e68cda93ce33

SHA1
602ab8bb769fff3079705bf2d3b545fc08d07ee6

SHA256
30b84843ed02b74dfd6c280aa14001a724490379e9e9e32f5f61a86f8e24976d

SHA512
9612654887bdd17edba4f238efd327d86e9f2cd0410d6c7f15a125dacfc98bf573f4a480db2a415f328a403240f1b9adc275a7e790fd8521c53724f1f8825f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\c.wnry

Filesize
780B

MD5
8124a611153cd3aceb85a7ac58eaa25d

SHA1
c1d5cd8774261d810dca9b6a8e478d01cd4995d6

SHA256
0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

SHA512
b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\hhnjqu9y.exe

Filesize
3.4MB

MD5
b45668e08c03024f2432ff332c319131

SHA1
4bef9109eaeace4107c47858eef2d9d3487e45f0

SHA256
4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe

SHA512
538c8471fc0313e68885d4d09140ec3e3374af3464af626195b6387a67b9bae9c3c9fd369d9dc7965decc182d13e8bbf95b4cf96b5ffc78af5d7904d59325bbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\new1.exe

Filesize
304KB

MD5
b5e07492b13633eacab4b4f57853b439

SHA1
673f25d3b8ca435846dc04eabf6f5b412d9e7ed5

SHA256
d86a4ac9ab81a74a638e659821fd1d76d9b240d2a4e9fd1dc25c387d356d9828

SHA512
cc555116a570db59dfae1beb8587ecda1a25f520bc7aa45423a276a56ab89d21c84cb60df336dc114e388760798399451f1431a9e290b2b4a4d078164bdab999

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\newbundle.exe

Filesize
304KB

MD5
58e8b2eb19704c5a59350d4ff92e5ab6

SHA1
171fc96dda05e7d275ec42840746258217d9caf0

SHA256
07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834

SHA512
e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe

Filesize
5.6MB

MD5
13b26b2c7048a92d6a843c1302618fad

SHA1
89c2dfc01ac12ef2704c7669844ec69f1700c1ca

SHA256
1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

SHA512
d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\o.exe

Filesize
84KB

MD5
a775d164cf76e9a9ff6afd7eb1e3ab2e

SHA1
0b390cd5a44a64296b592360b6b74ac66fb26026

SHA256
794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979

SHA512
80b2d105d2fac2e56b7ea9e1b56057e94ffe594c314ea96668d387ab120b24be580c58d68d37aca07273d3ce80f0d74f072102469f35cb02e2295817e1f16808

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\pei.exe

Filesize
9KB

MD5
8d8e6c7952a9dc7c0c73911c4dbc5518

SHA1
9098da03b33b2c822065b49d5220359c275d5e94

SHA256
feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

SHA512
91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\r.exe

Filesize
96KB

MD5
930c41bc0c20865af61a95bcf0c3b289

SHA1
cecf37c3b6c76d9a79dd2a97cfc518621a6ac924

SHA256
1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

SHA512
fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\splwow64_1.exe

Filesize
1.3MB

MD5
2b01c9b0c69f13da5ee7889a4b17c45e

SHA1
27f0c1ae0ddeddc9efac38bc473476b103fef043

SHA256
d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

SHA512
23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\winbox.exe

Filesize
36KB

MD5
7f79f7e5137990841e8bb53ecf46f714

SHA1
89b2990d4b3c7b1b06394ec116cd59b6585a8c77

SHA256
94f0113ae76742bb2941e823382a89b7f36e6e0de37a63cf39a76c6d1ffbe2da

SHA512
92e1c29c9a375e95cb4307ab9b6b2eaac8b7aea9be9523bdd905baedf8e8ee77bad886076a9b5065fd1ace21e5087358a2fa4d3d2506346139dfb0e580e6df0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flux

Filesize
92KB

MD5
523fea93bbf3f0b9ddd4d1a432b624c9

SHA1
578ccd6f97455881ca61fddf068695ab0daa8918

SHA256
f4e881ea8495c993e2f008e9b5fc082bc2cea97812fe944dda293f3b02fb60b0

SHA512
633474c0d83e92171d09ab5849b83a9bcd613f630ec54ee44ad42ac8102d25c987f9e3ec71ea6c2d3542bcc9919ded6e37c3754a8f074aeea9704f16770692f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Folding

Filesize
872KB

MD5
67ff730b62d42030058393ab3f0dafd1

SHA1
79215f079836dd43b4f7b1e66739bd7dab9fb6a3

SHA256
95d53427ef46fb44354a0253a611e342a30428101acaf83215f5b21432afbff1

SHA512
6e7d6f12686b0b30c96eebe01546e4aee1adee39a7467409e8f41de9a37c65daa010ebcefa6c452d4849e7ba0bec9be55be1b38250420b40e2956c151478d973

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jaguar

Filesize
93KB

MD5
fdadac1c5944e618315f608ad2f02714

SHA1
debe3ccc5a4abc326dbcb4a86ec8074671a3417f

SHA256
49687025dce701973b47fb6caba71f1443471e64551f41967a6a3275ce1e93d5

SHA512
92d7da5ef3625157acb00752b74fcfb80c588bc3ddf8b7fda488f68d0a6cf332aade539ee92139a26c5dc3549c8a69471ca24fcb1568068d5293b8988bbbab58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Liberal

Filesize
38KB

MD5
524c0177830e8a3624062be7eddfa277

SHA1
0a830e50e9433d530094edf3577b7ec5c5d1c5f5

SHA256
aacfabd8f6dde87949cbafa8eab7536dc5377e726064445e62824d10584eaec5

SHA512
79ed8be7d451a885befb7001c52a9f0db3977be8e16abd7db9f7742d520270a650ac77ed72e512a377d8f888bf05643f6bce3fea2d4dba8f37c7fff73a70d0cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Surrey

Filesize
14KB

MD5
721cde52d197da4629a6792103404e23

SHA1
1f5bac364c6b9546ba0501f41766bb25df98b32b

SHA256
66627eef98fb038f1d22f620bc8d85430a442d08313602eb02f0b158b5471812

SHA512
63a6786227915bc450ea9ca4df4962126b4194a1fd5c68fe3c686da8175726d4efdda5e88aedea7b8e4e758816b9b31981fa79e37dbe51028650def5042ccac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp48EB.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Utilize

Filesize
83KB

MD5
4bb39f0bce8a4f7b640ba76ecccaf87b

SHA1
c0c7feca88b0fc3fc1f20d1963ae25388a1f4c12

SHA256
96af995b201e5392293f2d7272b1c9a3f0eb671d62aeafffb4b0bbbfed0e3560

SHA512
ad2752281067584233cc19b3d0bbd0178dc3907af71c8dc3c37afe35f417afe1b1fc4d9ad2d99506d53100afde8ddb692e93669b8c9398782cb03dc22a04e1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Verzeichnis

Filesize
61KB

MD5
6a5ab833602af088d60d3d7f89b77229

SHA1
32f9fe7c6ba035993a627a78491651f02d0dfc97

SHA256
41586643456496d40c3279839a1cb1528428c19deefb4c702bd58f1467a1a1d0

SHA512
0598b2b38270a8d282ae2325330420b467be203047dffc2e85626fd78e78f81c5084487eebfbefbcb36115732a6670a9857655c18803388c02e37fbcf51aaa66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vessels

Filesize
50KB

MD5
d64ef3bbcca2c221c0bcc85a7b6d5209

SHA1
5c3cf9d492c7021e19e103fa14ab3965fd1c6ba3

SHA256
c8c35545936faa3b0e00aa1b907952e97fffd9c1958045253863b4c2fad7f295

SHA512
2b6713646373b5b233295930a46fefbd499b607a94051c6294d3dce12f58b187c98f22f7f0b1243f22611a82c659b1d95f70a7858247b8f0853a1765d449e611

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zqtkfwlj.kwi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1164-110-0x00007FF6F6460000-0x00007FF6F69F7000-memory.dmp

Filesize
5.6MB

Download
memory/1260-70-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1260-126-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1260-104-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1292-2772-0x00007FF7D95D0000-0x00007FF7D9832000-memory.dmp

Filesize
2.4MB

Download
memory/1320-510-0x00007FF7D35A0000-0x00007FF7D35C9000-memory.dmp

Filesize
164KB

Download
memory/1320-113-0x00007FF7D35A0000-0x00007FF7D35C9000-memory.dmp

Filesize
164KB

Download
memory/2044-242-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2372-82-0x0000022D7E4E0000-0x0000022D7E4F0000-memory.dmp

Filesize
64KB

Download
memory/2372-84-0x0000022D7FD50000-0x0000022D7FD9A000-memory.dmp

Filesize
296KB

Download
memory/2372-72-0x0000022D7FDB0000-0x0000022D7FE32000-memory.dmp

Filesize
520KB

Download
memory/2372-83-0x0000022D7FF50000-0x0000022D80052000-memory.dmp

Filesize
1.0MB

Download
memory/2372-78-0x0000022D7FCD0000-0x0000022D7FCF2000-memory.dmp

Filesize
136KB

Download
memory/4028-1877-0x00000000050D0000-0x00000000056FA000-memory.dmp

Filesize
6.2MB

Download
memory/4028-1867-0x0000000002490000-0x00000000024C6000-memory.dmp

Filesize
216KB

Download
memory/4324-182-0x00000000068E0000-0x00000000069EA000-memory.dmp

Filesize
1.0MB

Download
memory/4324-140-0x0000000005200000-0x0000000005292000-memory.dmp

Filesize
584KB

Download
memory/4324-191-0x00000000069F0000-0x0000000006A3C000-memory.dmp

Filesize
304KB

Download
memory/4324-188-0x0000000006880000-0x00000000068BC000-memory.dmp

Filesize
240KB

Download
memory/4324-138-0x00000000007D0000-0x0000000000822000-memory.dmp

Filesize
328KB

Download
memory/4324-183-0x0000000006820000-0x0000000006832000-memory.dmp

Filesize
72KB

Download
memory/4324-176-0x0000000006D90000-0x00000000073A8000-memory.dmp

Filesize
6.1MB

Download
memory/4324-139-0x0000000005710000-0x0000000005CB6000-memory.dmp

Filesize
5.6MB

Download
memory/4324-170-0x0000000006610000-0x000000000662E000-memory.dmp

Filesize
120KB

Download
memory/4324-141-0x00000000051B0000-0x00000000051BA000-memory.dmp

Filesize
40KB

Download
memory/4324-156-0x0000000005D40000-0x0000000005DB6000-memory.dmp

Filesize
472KB

Download
memory/4324-1784-0x00000000073B0000-0x00000000074B2000-memory.dmp

Filesize
1.0MB

Download
memory/4324-1783-0x0000000006B10000-0x0000000006B9C000-memory.dmp

Filesize
560KB

Download
memory/4384-2-0x00000000054D0000-0x000000000556C000-memory.dmp

Filesize
624KB

Download
memory/4384-5-0x0000000075020000-0x00000000757D1000-memory.dmp

Filesize
7.7MB

Download
memory/4384-1-0x0000000000A90000-0x0000000000A98000-memory.dmp

Filesize
32KB

Download
memory/4384-4-0x000000007502E000-0x000000007502F000-memory.dmp

Filesize
4KB

Download
memory/4384-12-0x00000000061B0000-0x00000000061F0000-memory.dmp

Filesize
256KB

Download
memory/4384-0-0x000000007502E000-0x000000007502F000-memory.dmp

Filesize
4KB

Download
memory/4384-3-0x0000000075020000-0x00000000757D1000-memory.dmp

Filesize
7.7MB

Download
memory/4472-1876-0x0000000000A60000-0x0000000000AB2000-memory.dmp

Filesize
328KB

Download
memory/4868-1825-0x0000000000A80000-0x00000000012FE000-memory.dmp

Filesize
8.5MB

Download
memory/4868-1808-0x0000000000A80000-0x00000000012FE000-memory.dmp

Filesize
8.5MB

Download
memory/4968-511-0x00007FF6EAF20000-0x00007FF6EB70F000-memory.dmp

Filesize
7.9MB

Download
memory/4968-1780-0x00007FF6EAF20000-0x00007FF6EB70F000-memory.dmp

Filesize
7.9MB

Download
memory/4968-114-0x00007FF6EAF20000-0x00007FF6EB70F000-memory.dmp

Filesize
7.9MB

Download
memory/4968-1798-0x00007FF6EAF20000-0x00007FF6EB70F000-memory.dmp

Filesize
7.9MB

Download
memory/4968-2314-0x00007FF6EAF20000-0x00007FF6EB70F000-memory.dmp

Filesize
7.9MB

Download
memory/4968-111-0x0000024F795C0000-0x0000024F795E0000-memory.dmp

Filesize
128KB

Download
memory/5080-89-0x00007FF71B870000-0x00007FF71BE07000-memory.dmp

Filesize
5.6MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads