crypvault | 17b4d01d32c64a62e36496829da323fe308437048ca87143de7365fabd4194fd

Analysis

max time kernel
293s
max time network
301s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Size

182KB
MD5

1105f1e5cd13fc30fde877432e27457d
SHA1

108f03f9c98c63506dd8b9f6581f37ae5c18de23
SHA256

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d
SHA512

49e9e4b02f432b9cc8f36913ce275f1d13672be627119c183713b5d6fb9fe27fd2cea67421560a463aaa16db35feb15df7c45258e2d102b5f70edb02865d9373
SSDEEP

3072:nO2W3zwMGWxLNjglP4cdkYsxSehTr76bJnhL:O2izwWlFuPP2xSehX6Fx

Score

10^/10

crypvault pony collection credential_access defense_evasion discovery evasion execution impact persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

pony

http://hollandfintech.net/api/gate.php

Signatures

CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
ransomware crypvault
Crypvault family
crypvault
Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

vssadmin.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 2656 vssadmin.exe
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2656	vssadmin.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

tasklist.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IE40 = "C:\\Windows\\SysWOW64\\IE40\\IE40.lnk"	tasklist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IE40 = "C:\\Windows\\SysWOW64\\IE40\\IE40.lnk"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	tasklist.exe

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

2948 explorer.exe

pid	process
2948	explorer.exe

Drops startup file 3 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	svchost.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	svchost.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

mshta.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe

Drops file in System32 directory 23 IoCs

Processes:

explorer.exe

description	ioc	process
File created	C:\Windows\SysWOW64\IE40\api-ms-win-core-debug-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-core-sysinfo-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-crt-convert-l1-1-0.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\IE40\IE40.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\IE40\IE40.lnk	explorer.exe
File created	C:\Windows\SysWOW64\IE40\IE40.exe	explorer.exe
File created	C:\Windows\SysWOW64\IE40\accessibilitycpl.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\aclui.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\adsnt.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-core-localization-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-crt-environment-l1-1-0.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\IE40	explorer.exe
File created	C:\Windows\SysWOW64\IE40\advapi32.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-crt-conio-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-crt-runtime-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\IE40.lnk	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-crt-heap-l1-1-0.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\IE40\accessibilitycpl.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\aeevts.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-core-file-l2-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-core-memory-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-core-timezone-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE40\api-ms-win-core-xstate-l1-1-0.dll	explorer.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2940 tasklist.exe

pid	process
2940	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

description	pid	process	target process
PID 2608 set thread context of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2264 904 WerFault.exe svchost.exe

pid	pid_target	process	target process
2264	904	WerFault.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

explorer.exesvchost.exeexplorer.exeIEXPLORE.EXEdffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exewmic.exedffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exeexplorer.exetasklist.exesvchost.exemshta.exeIEXPLORE.EXEexplorer.exeexplorer.exemshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

2080 vssadmin.exe

pid	process
2080	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEmshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000326f9175d9e962bf1e5ee52f3625634383096902fbff0c31a9ae32a28fb9ede8000000000e80000000020000200000007304a5cac2cc03b30dc2783bfbbfacf0ba33c99bbcb503a34cafe447359fdafe900000005e221916ff889f8aec7fd036bb4a4681557abcded03b57fb4f85f604b4aeab838c84ead9f9a41f05d19361cd9c045805fae12e810e3642d5fef3da53a05c2aa78abd53b69594fee0a496719029259e997c571357f4878806762c11e38dbe2550db1778c97d5eb57afd7862624639fc63d37d0f385f7bd52c71819d75e078173af99fbb1d74225565d75a1cf18e2c80ef400000000c6e6437bfff56a20d0309a5ffd5784032212131c127848f683267fa186828a0079e43dd54c654f765a59e7d2677e0d57b04a62fc9d97a1c46f7928a98487a75	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438408108"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000586234e3d34c42b321e659266f936d17f1bc40cedc159593f6733290d80613fe000000000e800000000200002000000056d1a39dde4123f15d4058876650c4d4d915660813924f527458da07c0a95621200000009d4e4cabee26f468482d2c20d1442f06bed5c7a9675ac7cb6b47110c54c5bf4240000000d452367bf379b354e998709bfdb7a78fb0e66ead28fd8f080fc520aa53250fa0a7e7e1bd6758bddb6640f8350d367ca3813ecb2a6d903167342031b7d11d8e8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24C6D501-A882-11EF-8121-F6D98E36DBEF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10479cfa8e3cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exedffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

pid	process
2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
952	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exeexplorer.exetasklist.exeexplorer.exeexplorer.exe

pid	process
952	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
2948	explorer.exe
2940	tasklist.exe
2704	explorer.exe
2940	tasklist.exe
2940	tasklist.exe
1184	explorer.exe
2940	tasklist.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exesvchost.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1324	wmic.exe
Token: SeSecurityPrivilege	1324	wmic.exe
Token: SeTakeOwnershipPrivilege	1324	wmic.exe
Token: SeLoadDriverPrivilege	1324	wmic.exe
Token: SeSystemProfilePrivilege	1324	wmic.exe
Token: SeSystemtimePrivilege	1324	wmic.exe
Token: SeProfSingleProcessPrivilege	1324	wmic.exe
Token: SeIncBasePriorityPrivilege	1324	wmic.exe
Token: SeCreatePagefilePrivilege	1324	wmic.exe
Token: SeBackupPrivilege	1324	wmic.exe
Token: SeRestorePrivilege	1324	wmic.exe
Token: SeShutdownPrivilege	1324	wmic.exe
Token: SeDebugPrivilege	1324	wmic.exe
Token: SeSystemEnvironmentPrivilege	1324	wmic.exe
Token: SeRemoteShutdownPrivilege	1324	wmic.exe
Token: SeUndockPrivilege	1324	wmic.exe
Token: SeManageVolumePrivilege	1324	wmic.exe
Token: 33	1324	wmic.exe
Token: 34	1324	wmic.exe
Token: 35	1324	wmic.exe
Token: SeIncreaseQuotaPrivilege	1324	wmic.exe
Token: SeSecurityPrivilege	1324	wmic.exe
Token: SeTakeOwnershipPrivilege	1324	wmic.exe
Token: SeLoadDriverPrivilege	1324	wmic.exe
Token: SeSystemProfilePrivilege	1324	wmic.exe
Token: SeSystemtimePrivilege	1324	wmic.exe
Token: SeProfSingleProcessPrivilege	1324	wmic.exe
Token: SeIncBasePriorityPrivilege	1324	wmic.exe
Token: SeCreatePagefilePrivilege	1324	wmic.exe
Token: SeBackupPrivilege	1324	wmic.exe
Token: SeRestorePrivilege	1324	wmic.exe
Token: SeShutdownPrivilege	1324	wmic.exe
Token: SeDebugPrivilege	1324	wmic.exe
Token: SeSystemEnvironmentPrivilege	1324	wmic.exe
Token: SeRemoteShutdownPrivilege	1324	wmic.exe
Token: SeUndockPrivilege	1324	wmic.exe
Token: SeManageVolumePrivilege	1324	wmic.exe
Token: 33	1324	wmic.exe
Token: 34	1324	wmic.exe
Token: 35	1324	wmic.exe
Token: SeImpersonatePrivilege	1664	svchost.exe
Token: SeTcbPrivilege	1664	svchost.exe
Token: SeChangeNotifyPrivilege	1664	svchost.exe
Token: SeCreateTokenPrivilege	1664	svchost.exe
Token: SeBackupPrivilege	1664	svchost.exe
Token: SeRestorePrivilege	1664	svchost.exe
Token: SeIncreaseQuotaPrivilege	1664	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1664	svchost.exe
Token: SeBackupPrivilege	2232	vssvc.exe
Token: SeRestorePrivilege	2232	vssvc.exe
Token: SeAuditPrivilege	2232	vssvc.exe
Token: SeImpersonatePrivilege	1664	svchost.exe
Token: SeTcbPrivilege	1664	svchost.exe
Token: SeChangeNotifyPrivilege	1664	svchost.exe
Token: SeCreateTokenPrivilege	1664	svchost.exe
Token: SeBackupPrivilege	1664	svchost.exe
Token: SeRestorePrivilege	1664	svchost.exe
Token: SeIncreaseQuotaPrivilege	1664	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1664	svchost.exe
Token: SeImpersonatePrivilege	1664	svchost.exe
Token: SeTcbPrivilege	1664	svchost.exe
Token: SeChangeNotifyPrivilege	1664	svchost.exe
Token: SeCreateTokenPrivilege	1664	svchost.exe
Token: SeBackupPrivilege	1664	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2400 iexplore.exe

pid	process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
2400	iexplore.exe
2400	iexplore.exe
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
792	IEXPLORE.EXE
792	IEXPLORE.EXE
792	IEXPLORE.EXE
792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exedffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exeexplorer.exetasklist.exeexplorer.exesvchost.exeexplorer.exesvchost.exeiexplore.exe

description	pid	process	target process
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2608 wrote to memory of 952	2608	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 952 wrote to memory of 2948	952	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 952 wrote to memory of 2948	952	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 952 wrote to memory of 2948	952	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 952 wrote to memory of 2948	952	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 2948 wrote to memory of 2940	2948	explorer.exe	tasklist.exe
PID 2948 wrote to memory of 2940	2948	explorer.exe	tasklist.exe
PID 2948 wrote to memory of 2940	2948	explorer.exe	tasklist.exe
PID 2948 wrote to memory of 2940	2948	explorer.exe	tasklist.exe
PID 2940 wrote to memory of 2704	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2704	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2704	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2704	2940	tasklist.exe	explorer.exe
PID 2704 wrote to memory of 1664	2704	explorer.exe	svchost.exe
PID 2704 wrote to memory of 1664	2704	explorer.exe	svchost.exe
PID 2704 wrote to memory of 1664	2704	explorer.exe	svchost.exe
PID 2704 wrote to memory of 1664	2704	explorer.exe	svchost.exe
PID 2940 wrote to memory of 2972	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2972	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2972	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2972	2940	tasklist.exe	explorer.exe
PID 1664 wrote to memory of 1324	1664	svchost.exe	wmic.exe
PID 1664 wrote to memory of 1324	1664	svchost.exe	wmic.exe
PID 1664 wrote to memory of 1324	1664	svchost.exe	wmic.exe
PID 1664 wrote to memory of 1324	1664	svchost.exe	wmic.exe
PID 1664 wrote to memory of 2428	1664	svchost.exe	mshta.exe
PID 1664 wrote to memory of 2428	1664	svchost.exe	mshta.exe
PID 1664 wrote to memory of 2428	1664	svchost.exe	mshta.exe
PID 1664 wrote to memory of 2428	1664	svchost.exe	mshta.exe
PID 2940 wrote to memory of 1184	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 1184	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 1184	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 1184	2940	tasklist.exe	explorer.exe
PID 1184 wrote to memory of 904	1184	explorer.exe	svchost.exe
PID 1184 wrote to memory of 904	1184	explorer.exe	svchost.exe
PID 1184 wrote to memory of 904	1184	explorer.exe	svchost.exe
PID 1184 wrote to memory of 904	1184	explorer.exe	svchost.exe
PID 2940 wrote to memory of 892	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 892	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 892	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 892	2940	tasklist.exe	explorer.exe
PID 904 wrote to memory of 644	904	svchost.exe	mshta.exe
PID 904 wrote to memory of 644	904	svchost.exe	mshta.exe
PID 904 wrote to memory of 644	904	svchost.exe	mshta.exe
PID 904 wrote to memory of 644	904	svchost.exe	mshta.exe
PID 904 wrote to memory of 2264	904	svchost.exe	WerFault.exe
PID 904 wrote to memory of 2264	904	svchost.exe	WerFault.exe
PID 904 wrote to memory of 2264	904	svchost.exe	WerFault.exe
PID 904 wrote to memory of 2264	904	svchost.exe	WerFault.exe
PID 2400 wrote to memory of 1732	2400	iexplore.exe	IEXPLORE.EXE
PID 2400 wrote to memory of 1732	2400	iexplore.exe	IEXPLORE.EXE
PID 2400 wrote to memory of 1732	2400	iexplore.exe	IEXPLORE.EXE

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_win_path 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
"C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
  C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Adds policy Run key to start application
    - Deletes itself
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\SysWOW64\tasklist.exe
      C:\Windows\SysWOW64\tasklist.exe
      4⤵
      Adds policy Run key to start application
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2704
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        6⤵
        Drops startup file
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        outlook_win_path
        
        PID:1664
        
        C:\Windows\SysWOW64\Wbem\wmic.exe
        
        wmic process call create "vssadmin.exe delete shadows /all /quiet"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe C:\Users\Admin\Desktop\VAULT.hta
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2428
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1184
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        6⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe C:\Users\Admin\Desktop\VAULT.hta
        7⤵
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 360
        7⤵
        Program crash
        
        PID:2264
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:892

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x144
1⤵
PID:1900

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:799747 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9e6dac6edf857d9d77aaf7703b57b110

SHA1
b08483b1e542065898740249a1fea2ca788ef8fe

SHA256
66ce5011ca9d26e6ffe6cac43ba10612e2bd3c5a3a518c171d413f2dce154141

SHA512
866102eef37b7a4ca77cc2e73400fc0dd281e0263020ef50352d52eb9ef0712295fcb031bf52390e8cc3b2660058f88bbcede9a29592b6b93e421e11f6e66091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8732eafdeb837d38886b3664f83647f

SHA1
4fef3bbd354700358476fa98899f4bd0c9684cf5

SHA256
7c98e34238c8678fa127280de56fc9eb32ddc09f96b43ad8e507c98f9a581e72

SHA512
3d1d2ae50f2d06551659936d1657b8cd172da1afc2703f50d651c0dfef9b8ee6ed7fb35ce2ebdc4c4bd011472407c4f80d8c06620b302cd52025620343beb0ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
580231b481b6d66887f199dbb9ffc794

SHA1
00bb81f2a6950e0d7c33a59ec1c299a3d164b1e5

SHA256
89364257fc5c28103858f8ff15f924a4c4e524351e6ec557530ffdf7d64e834a

SHA512
3f44d4151f7e98426c036397e40591883ecf62b29da891f767f8fd422386eb3a3a7648666badf3b40a907ebf9c3e91d5fbe5f587af881917e00d670c45d4cb69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0edda84df659f7c4c76376fd2865bd3

SHA1
f08cd42f24785852973f93631065a6707ff03bf3

SHA256
ea107ffa0e4f492cf99973ce028a479e089f648d58e986c58bb27303888e6d37

SHA512
cf0d38716cac9a4e9b79702dc2d76291e71d66be1d196ca704e627e9214fa9bf65b538741837429dab7399a10ea9b331b099a020dbc759dbdeab98d5e5901718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e84e84325111e1fba0c34c0e973c3a25

SHA1
5ebc1d4066af770a14a748d9dfb46c75495d2445

SHA256
5fcb036d34c0f50e385475e20df5296712c34f783926c887336435744f2507a5

SHA512
f10629c238e286d94d5b483e557097c6e0a1852d516cd8d5fd7581d0efc819a96c6a840aae090e773866d2d716dfeb5fea124415b336a55ceab405b35676116d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
019265762520bfa5a420bf8dbda4a39c

SHA1
6641392911bb4172d7d7a82797f95493ffc2c594

SHA256
3a6a90db5c7c42fcf0790524044b0faa77427a79196095e4ae129ea5d365bf39

SHA512
4607d4d108dc036ab61a70ac67ac72cf78e35cc638b795d95b005875f049dd6ace5465d9b595bb44698ccf422c249b61a4f8105fffcc2f9daa6da6bbb37643b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2645e718c21732c67abd997586a63f0f

SHA1
670b3ef67c19984d1cf610fa92bd72498fe8e831

SHA256
f84d5ed2efd0c82090c8d348c1c620f4d47cd34d30755ee84ce345f64e476ff2

SHA512
a70c0c4261509349b0d31fac480f1c37c2e97de3d1b2d13d9b1a3d3839229bfd3fe8664895776869c67d4e482bdbdfa269219dec50addf3cf40042837b04514a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0516470ade2b168b69dac600484432a1

SHA1
82c9b14d84ae685357fcafe3e523ae30b3e97253

SHA256
811efbf342aa78862c97a52908141b9a22422bcba7a613300b7cb603ab2410fd

SHA512
a80429adab73c495b3e553f84611a9a2ea749824ca6703d30248996a82ee16f3f025567ef10dbd3cbef55fc3f132412c5105459c91834cda12f921cf8103ec6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8bc252d9f1bb04412b8665cd44c204f

SHA1
4e7cd57b396a28090c49d26a2963da3a3b8d6f44

SHA256
1da9413856d1dc1b772bd3133fd3ebe1894e0c414a2637147c33bc7982c02206

SHA512
b9fabb310c7934190bb1a0474c6ffd7d31bd6e5058bd7a470ed1f9e8e5d2838b88072562673b7d016149a630ec9f5939ff4e967820bdb6af766fdb37b787ab99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d147bc36293dae1b753b346f74bc26f

SHA1
7a01ef7c5d30aa9628e14be6a4823cb52b935037

SHA256
bb80dc19b8b6fc4e5a924ad67a4eeab26a2e1e3dbbd9087172ca37ebb0194d07

SHA512
4dc334f5e1b9085ca9a82a84b01d7784222bc9d330f80fa1bac4217eadf400a04ce50330d24df93ab46589909a315465c2e880dc7343ba23d45e6e9efa646726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e45b3f0904a597adfb77e802cdca3180

SHA1
477d5258635230065984ba9c03e9b51cb706f54b

SHA256
b851caaecb4159ae737089522860fac7d8aa0415bf536ac2c59f7593727de010

SHA512
dff8e151e58c9a251cd060b889e920e55f3f270f06f92826d3a72b7bd6dbf954d58c0f14b817f3fd5073b94c5bb43688101a76f0acf473d92361a21275c34d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6B2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE96.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta

Filesize
4KB

MD5
ca834cc56015bce8e010e356c69dc9f5

SHA1
b55ea373d3f5d583c33803d80059db5ddccf7038

SHA256
1b5feb1b9bf79a857330fc891a65824953ad5d72ce38b4fb41755475775c65bd

SHA512
66c6370c538567286641e2ca3438d28572a78b4d2a15912f9d55cc65f9c7491d16e3f277c9f1385ee6773ef400e1a47e7abe5208aa4d7f75b8db5c816e6531a8

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
3845a244ebeb5b99f17edd8faf69222d

SHA1
0c8d4ee82cd459213f75840cb53d2d18ee604fe0

SHA256
9f20177b0f8e2dbb16005665faa054b84ea94f4e44c6323670baa9c919378c73

SHA512
4404954d4a8638fc99a1f8bb0f6bd4f0064b548c0137ed6b0015fe6ad67b13a41983a4161d4053d855d2e87c620ff5c0174d09237028bd6e563982528003afb3

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
355b1007c5c4f8cf5406659c743979dd

SHA1
84b6fdb7e9152073aa8473e449470e60ed1f811e

SHA256
91eb89d9bfec90fbac7166286c8fe088adcf73fde43da9533473258e563da4d7

SHA512
c223b50827f6dec4f94c113c445f4a63aafc5f4ffe27039deb424a0131d3dbd9e93087a56b169336b40e0279307d87007c6e87e10a6d02efdc15ef84f9235d52

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
8cf7e067d131fd292131b946be764885

SHA1
11595bc007c8cc977fd3374f2a4e928c622ab613

SHA256
29911d545c7a2761b11598d4540e1285eeba2984a058aa43366dbbe3f0d9dd15

SHA512
96b91add2c487f9e017b4662b086dca9977e85409732894c4c40c4c937b0da65730fa6c81bc0a0b6f7f5f6e8537408d508b29ec6d7f8f4c01d84814d88b7680a

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
d0bb3b77558032e96658265be9248608

SHA1
25fe6f92a547b314162668f4f53b74a69b8474e5

SHA256
41a7993f4f39ca1ad124281f3b99aab777e5f8283679f05419bdfb9448dabbfe

SHA512
90693f61ddaa72ba89663e7029473d41d9e674a01cb087bfae59c520c173592fffbb3cc3ef0c221d66bdb2c22de6531b283154db29bdd38777cca1359c3cdad8

Download Submit
C:\Windows\SysWOW64\IE40\IE40.exe

Filesize
182KB

MD5
1105f1e5cd13fc30fde877432e27457d

SHA1
108f03f9c98c63506dd8b9f6581f37ae5c18de23

SHA256
dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d

SHA512
49e9e4b02f432b9cc8f36913ce275f1d13672be627119c183713b5d6fb9fe27fd2cea67421560a463aaa16db35feb15df7c45258e2d102b5f70edb02865d9373

Download Submit
C:\Windows\SysWOW64\IE40\IE40.lnk

Filesize
1KB

MD5
9806686e57400e9ce3e7ea7bd0e32c81

SHA1
b2826f7622301d9d5a8467d830cc1b593290e0f9

SHA256
b837c51903478330dd5813fe61780df530559851e88e14b54c5d1fac945b511c

SHA512
cb547e30c500decdd36292a83496827b45a327e0191aff2489704e0cd2268019e245fdaad140598ea60cb7319d339df68bbf5b7ae79a5c7c51bb4bf211c35ce7

Download Submit
memory/644-209-0x00000000029A0000-0x00000000029A2000-memory.dmp

Filesize
8KB

Download
memory/892-178-0x00000000009F0000-0x0000000000C71000-memory.dmp

Filesize
2.5MB

Download
memory/892-179-0x00000000009F0000-0x0000000000C71000-memory.dmp

Filesize
2.5MB

Download
memory/904-198-0x0000000000C60000-0x0000000000C68000-memory.dmp

Filesize
32KB

Download
memory/904-200-0x0000000000130000-0x000000000015E000-memory.dmp

Filesize
184KB

Download
memory/904-173-0x0000000000130000-0x000000000015E000-memory.dmp

Filesize
184KB

Download
memory/904-172-0x0000000000C60000-0x0000000000C68000-memory.dmp

Filesize
32KB

Download
memory/952-2-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/952-16-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/952-6-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/952-17-0x0000000000400000-0x000000000040F1F7-memory.dmp

Filesize
60KB

Download
memory/952-1-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/952-8-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/952-18-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/952-10-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/952-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/952-12-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/952-13-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/952-5-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/1184-170-0x00000000009F0000-0x0000000000C71000-memory.dmp

Filesize
2.5MB

Download
memory/1184-169-0x00000000009F0000-0x0000000000C71000-memory.dmp

Filesize
2.5MB

Download
memory/1664-58-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/1664-56-0x00000000000C0000-0x00000000000C8000-memory.dmp

Filesize
32KB

Download
memory/1664-164-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/1664-154-0x00000000000C0000-0x00000000000C8000-memory.dmp

Filesize
32KB

Download
memory/1664-150-0x0000000000100000-0x0000000000112000-memory.dmp

Filesize
72KB

Download
memory/2608-0-0x0000000000420000-0x0000000000425000-memory.dmp

Filesize
20KB

Download
memory/2704-52-0x00000000005D0000-0x0000000000851000-memory.dmp

Filesize
2.5MB

Download
memory/2704-53-0x00000000005D0000-0x0000000000851000-memory.dmp

Filesize
2.5MB

Download
memory/2704-54-0x00000000005D0000-0x0000000000851000-memory.dmp

Filesize
2.5MB

Download
memory/2940-50-0x0000000000F20000-0x0000000000F36000-memory.dmp

Filesize
88KB

Download
memory/2940-49-0x0000000000F20000-0x0000000000F36000-memory.dmp

Filesize
88KB

Download
memory/2940-48-0x0000000000F20000-0x0000000000F36000-memory.dmp

Filesize
88KB

Download
memory/2948-21-0x00000000005E0000-0x0000000000861000-memory.dmp

Filesize
2.5MB

Download
memory/2948-22-0x00000000005E0000-0x0000000000861000-memory.dmp

Filesize
2.5MB

Download
memory/2948-24-0x00000000005E0000-0x0000000000861000-memory.dmp

Filesize
2.5MB

Download
memory/2972-64-0x00000000005D0000-0x0000000000851000-memory.dmp

Filesize
2.5MB

Download
memory/2972-66-0x00000000005D0000-0x0000000000851000-memory.dmp

Filesize
2.5MB

Download