51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b

Analysis

max time kernel
125s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RippleSpoofer.exe
Size

15.6MB
MD5

76ed914a265f60ff93751afe02cf35a4
SHA1

4f8ea583e5999faaec38be4c66ff4849fcf715c6
SHA256

51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b
SHA512

83135f8b040b68cafb896c4624bd66be1ae98857907b9817701d46952d4be9aaf7ad1ab3754995363bb5192fa2c669c26f526cafc6c487b061c2edcceebde6ac
SSDEEP

393216:QAiUmWQEnjaa4cqmAa4ICSSF1a0HPRV8gtFlSiZh5ZlZ:bhnGhMAXSmHXFA+

Score

9^/10

discovery evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RippleSpoofer.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RippleSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RippleSpoofer.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2748-9-0x0000000000FA0000-0x0000000002C20000-memory.dmp	themida
behavioral1/memory/2748-10-0x0000000000FA0000-0x0000000002C20000-memory.dmp	themida
behavioral1/memory/2748-20-0x0000000000FA0000-0x0000000002C20000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RippleSpoofer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
17	discord.com
18	discord.com
15	discord.com
16	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2748	RippleSpoofer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601f0600793ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A5DEF41-A96C-11EF-848B-7694D31B45CA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438508619"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000ade5425014a68246ffc0b56dfeaa85769faa0e1ec9c48450b5bb7bbad27f1b53000000000e800000000200002000000063aaa869df333ff7017af37e2a062a2198eae228e445619d27aca8cdfbb223f19000000016b16087c3ebdeea6ff62ba8915d6417cfb8b6a63b4237ebf8f6578eafcbe596d0eeca5bccf645227ef6816480c2446384554541b465e77185fc7a580f5221fc408626c234bc7987057ed9f50b873b29b9df0d96ad201f91c2da0216d19a1ed7d63a18c03c11dacddcb1825814c9caef8a5101308fcddb765e811cd0bb46665c1d5ee18e0104beffe50f17932bf2ea364000000046f693b811a472c1336064d73b66937b609af226492559a74dea3a75f4b660a6c34a3c0318c9a3d849bac850683f17b6b60e812ad83ed7ad08077f65c7811bde	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000003b166f2a7fd575a4a1aaad0325922c3a09944faaa312da041c4247592c84bafa000000000e80000000020000200000009f04dd1eedd45997c90ec13611b38e67a3f476310a4f410644cf30d608f0d81d200000005bea30fe1c3845a8dae65ad0fe8187cdbfd0928fb3265b3e44d406c51a5ab77a400000002d7aafddbc1a43e7f97ad71d7c0efed59a5713c022b73e6f26fb0700fda2c1245311a1b1891afef688d4b29c6b1dd0fa5b8de277cdae7486cc1f6289454ea950	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	RippleSpoofer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
572	IEXPLORE.EXE
572	IEXPLORE.EXE
572	IEXPLORE.EXE
572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3052	2748	RippleSpoofer.exe	30
PID 2748 wrote to memory of 3052	2748	RippleSpoofer.exe	30
PID 2748 wrote to memory of 3052	2748	RippleSpoofer.exe	30
PID 3052 wrote to memory of 572	3052	iexplore.exe	31
PID 3052 wrote to memory of 572	3052	iexplore.exe	31
PID 3052 wrote to memory of 572	3052	iexplore.exe	31
PID 3052 wrote to memory of 572	3052	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/Qt5NMSgdzU
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fe3cfa8f1ae4a4a33e8f0a2fd27dda6c

SHA1
45904416ef0d376606b5482db63e2a0e182905a9

SHA256
b44832822cdecfeada9cc2be9e2f8feba4e55907c100db0167dc4b6d48f95c04

SHA512
3e77c70af0879459b14ebc37505516715d724c08d7a326acb12180e6a6f876accc424a166889cff44d8a7a71eeb7b045241e766318a4e64b872cf52a4ca62a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7433b738950807826bfe19eb1d777a17

SHA1
d7e7154ab0fa73c394cf4ab1fc7d0c915870ddca

SHA256
30d75c1b651b054569264b2008e8142a0c0d4286a18a9a667639e9ed492cc865

SHA512
c806eafc7459415fb807f0ce74340d19104fe779e99237a91b4101ef4ac028fe04ad5f434b50b7c4056ed25788f6896dc93b446a7e07cc150083794e25bb05b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cbfad59d5585ce73864f561f44e6f18

SHA1
6bcfc82fca509eb9256723f161dac5896feb0908

SHA256
64761bc611873a72b54e1f4b83a5275f41a4f329fc1b3670804ce044747b33b0

SHA512
fd3118b70bd1867110782d1dd336b8000331270649583ced56e3ab991efb45827626a68bdcfb61ef637f284343d5c2a036cc15539921c0abaa672a6426c8f7b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b40f9b529d9cb44038482482319c6240

SHA1
2af949441aee5ded7022ca33b74e9ccc1e5afbb9

SHA256
af9d48cfd41d0587652c0cfd9801d5f9a4dd4d3460e4a6996b53732fdf3b6949

SHA512
4c7621d71fa2e071b47c8968b56a41daba3d953bba3657e7bc72047d57bd155f3ef51f5cfbad09070ce7ecc69b35cc3ebf8836e8da1e180cce408970bde06035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c59620de66333a921cd6949d639f209c

SHA1
5086b748aaba5769c92d856d8bb1023fb3ae3a76

SHA256
2f4b0e1816c908e3e1934f8347e7f509a4c8160bb090f5c3f0501dda4a843fe6

SHA512
a4ac22fbf605afe91488d8b5ecf1294220a3f729d38dd96dd6902f60c4270d2ecc2401f1f142832132c51a79f458525c0b2be14125f3d5258bcffbebaafd3abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e978bcf0719e8aa499363861d2b8a3d

SHA1
07361eb01782578ce2154a2bdeda243e9a9d43e7

SHA256
a9e73d404dbc4a54733b617b274ba119cf5cfdc72567d7b5cc1702939544e09b

SHA512
caa418abdfee011ec32dc7694ed579c315bd2bb8ebc61dbadcc54e7c3ee8855d6f72a40bb5e73c63182db0a7ec9781590a9bd4216c1e30001308995d63e83fcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c2c2592d5d92fc955897246c79de938

SHA1
2ee6c9db940f7837fd86bfe0a213d48ccdf6c2c4

SHA256
6f6d210be4fa7e82edbca4ac8464ca9c5864a666d0c18d701bfcab0f4a727861

SHA512
0c4c13ccd16c40be0304dfc558cfee2649b718aa12cdc450877ed8cac5ba5945e4839bd8f782aae9ec93e6f192f6280ecb7fc55229049dbee2dd93d3e4a0b08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
765500f1c55913d0aed3d854f1d2fd24

SHA1
6bd28a67244da85f01053ef08d775f8d71872485

SHA256
a26698188c5cdf70b1678195b3a2140e6dc4579991e9266bdd2deb047dc59bbf

SHA512
29f85418022ae2264c644c5d98ece115c30b7259934a4fae337e76e07a79dd0693c8767b9656eaaef9fb443e1eea3cfbd002dd281a94ddc1c4a28c651b0f1ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4baae971283974297a67bc4cbcbc13ec

SHA1
3cf65da66c370367d65c3958688df3bb5cd9a42a

SHA256
165107039147763edc5c3184fef44f3c9435b5a4255039bac1034234096debed

SHA512
7d8b4ebbab3487d0f13c6883b31e2f274db0f0d1359353a7af599bc915c58f4a306aa7cdb704c8051543a1a3c5f1211b6fa3bbd0ba094e80e1c70d85290a70f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a7ac2ed9d002cf305518faade999bf9

SHA1
c69a3b3d97c908ff04c8cbae22955a40bbb074f3

SHA256
c870acd3b8c6ec81da248673211c93dda78a8a6901bc2174a3806f9cda58dc46

SHA512
1b48987c7df6718d5dde65e598b80ee6e37140253a770f4b9a676f74daeb57f1c339dee3250e28f6e6a828f087c956a7211abd028a80729cf9f19b0e1321d1f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04ca8d573ce0dc8a04dd6c00698cc6f7

SHA1
94c2944223803161d9f1392b812418f73079a5e8

SHA256
be7b3ff0af8d983f892538e259790ac5580db01d10af26ae11436c0f18e071e9

SHA512
58e85c13d9d7bdf4713bcb058f59f8af4ca2fcdd177010f3a7cec45c45054fbdf7b00fcb4375ef9c5b6ebb98b0c9084aaaac715e2cc2fe8b268c22bb00dcf14c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5581eb1a727c32e22e7197f16eedd48d

SHA1
42deabf8392ad46f82a15b9b75a26353f63407bb

SHA256
aa3af2ce94d3a58064f5992ecd90c4b0590b56d160ed7520f77ffdc872a02c7f

SHA512
ad58a580f5ac378f0005f62ff8dbfc5f761c37d74ab34e3c6589e3f03e77a984db70be9e4d1746c48e612375c1a9832fb7d2c442217c6079f05dc3473cb4f360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ded8d87895138238060077b4bd949fe7

SHA1
562878c4ed8f7381cb1e953b49585ad815593737

SHA256
724023302ede3c7a9a97cf098b1e38b0873aa656e63f5e68abca5f4229c176f8

SHA512
b67784246136f46280f8d0e070c32f1e0cffe3fac889303767b764395e41073ee4f46d019033deb0a846f45266a74d9c5962ba39a14caea26e0eeb034f8fdc08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efe2ce7679732c19299868a1a758f13b

SHA1
2d56b7eeef6fb6c0299674fb69a8d8a93853679e

SHA256
f1ae51b725ebb5d3f37206a5e861055a0db8c0eb019fac7c6d7b6046688c5bdc

SHA512
dc630ce1a7ea62a90bd74cd49212d17babc75d73b19532227794d017efda39f3a0377c05ebb242462d66e353e30f9fdccf3c0ef5eb6abdd29b553dccd639960f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b081b3d71c26d06fffc54b181b151f9e

SHA1
5cd013a8711c68bbc1eda5e34e4145a177ed951f

SHA256
576896ee2c7b80c713076eb65bfc8ad5ee7ac559aa51fcb463c65746595a49af

SHA512
d9b017a040e654880e3699ea88175ab4ca1d32e7ad8268054c9be79f3cc9a1e0da6d054fbcca29c8ac76ffd2e363d37620de6259ad71f101b0f56a9aa3785da0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eff0b931cc432817a0fc276c95a7da5e

SHA1
3f8fd79b9247ca506241c96166d61ed7d226c451

SHA256
8a6b4538180df9154a8434e33e20b154cdecc7e911276f4671cd8dd65a537798

SHA512
1c55aee6b7dfabd2fc83e14fc6b072c2201e3750f526d107a5ee44f88db8c9908945b01d6a4b402f8c14a2dc6d98c14714378a47d0adc3451dae419259ccbbb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab8e8fdf93ede99922a13b016cf9322c

SHA1
2b347948bdb8e06098585f82e42a177f9b37632a

SHA256
4d60efb6560028bef0690432d08e3f4c3d62da7a34d248875a56f9cda7a66126

SHA512
ab9571db9b3f6add1b4a16843615950680bfb8db625f86fea2b1183a2a508152ef9f0f1830e5f217845430182a40cb85dbba9b0fa4adf9b711fcdfde89c03fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bce968283804848a3471bc94785b341

SHA1
04633bc0448b3f14d6a2e056956af6ef6289d93a

SHA256
b82b2745b16c8156fedb1344cbcd3ea14230878cfddd6f40e45d4758aa7b3db5

SHA512
fa3905e50c342860d0a676f169e36e3c3d0f560a52d30f0210dc89b5559087334f43138180d7ef3fae7ed36d074c6edcfe6654a31e4e3437dfbd396125d088c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d9ff68a64ccff080cfb20f665dcd90f

SHA1
9dfc89eb0880bdf32fa70d4e73102d555bd31696

SHA256
4967857118123e2b5e1394eafaf1652ec3830cff30a2b989fc994cd2d88ae675

SHA512
698e46834daa8ec1085dd2361ff6eda83aa9dda02494dcf9608a2ef6712c0da322ace29deccc242711dc10c7fb33c8e9c69b37cfd8c12f4eda0dd0a76ed4653f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19e8e9603e6057c5013ad3fa7df1196c

SHA1
8400216e19dd640249eacf1778c5c422db592de8

SHA256
0f921f89bc383bce62f80c514e71ab2866618b62f099440c404ec20464f71e65

SHA512
3d4f1ac9c13da1f9519b7f895950e65ff9cb495fccf753a2d25f51b0286c59e8f135ffbb9c55c3fa863c86c90fc7b395b8169d46341899a351a20ff8d79c1995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8aed1f83f12d5316e138fb6cd264413

SHA1
27649509dfcc780a7853d95256188c770fccebe5

SHA256
e8b7a92b7f15eabb923eb3e7b0e6d9d96220879c82874716573c23ee74ec400b

SHA512
471a8d5867b81eb07d5e3f9ab3dda172b03535aeb2f9980b5366750cf9a343f72db931a9dc0d94561569c0cf83d376cbf4be3655d2bb0d644a71a65e58ce252d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8120ad061a98c618cf4771d625f54c67

SHA1
83e86d70e44c7f177dfe75f6611cc2ef18743c18

SHA256
2ec599984df91180a04e1d529015540181d1363556f44f545b8596422b47bed0

SHA512
0a8983ea9ffd2507021f1b5f9f2e5c450fd083a534ff7a40cbc186dd7494d1faa2cae2c80a7f3ac4eaa5c310b25a1947a1f8549d956f85231260f8ba81d3351f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\yiu0yt6\imagestore.dat

Filesize
24KB

MD5
457897ba58e3b3c4e33e6003b7203f36

SHA1
028c2fd7c02d09f040ddc8ef5fe616618889751f

SHA256
1c25923e31519efa7546499c908ed31589c63323a51c9ee234addb1fb58a18ae

SHA512
2a85d09f2ca23bbb044800b0aa6a237c8edbea39d0ebb24412f76ead74d9d8283c121d80d78d29da71c283257f06788c74058d93d597d4e51cf1f95051aacb0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\favicon[1].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F0E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9F11.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2748-13-0x000007FEFCE10000-0x000007FEFCE7C000-memory.dmp

Filesize
432KB

Download
memory/2748-19-0x000007FEFCE10000-0x000007FEFCE7C000-memory.dmp

Filesize
432KB

Download
memory/2748-10-0x0000000000FA0000-0x0000000002C20000-memory.dmp

Filesize
28.5MB

Download
memory/2748-9-0x0000000000FA0000-0x0000000002C20000-memory.dmp

Filesize
28.5MB

Download
memory/2748-17-0x000007FEFCE10000-0x000007FEFCE7C000-memory.dmp

Filesize
432KB

Download
memory/2748-15-0x0000000000FA0000-0x0000000002C20000-memory.dmp

Filesize
28.5MB

Download
memory/2748-14-0x0000000004A20000-0x0000000004AD2000-memory.dmp

Filesize
712KB

Download
memory/2748-0-0x0000000000FA0000-0x0000000002C20000-memory.dmp

Filesize
28.5MB

Download
memory/2748-6-0x000007FEFCE10000-0x000007FEFCE7C000-memory.dmp

Filesize
432KB

Download
memory/2748-20-0x0000000000FA0000-0x0000000002C20000-memory.dmp

Filesize
28.5MB

Download
memory/2748-16-0x000007FEFCE23000-0x000007FEFCE24000-memory.dmp

Filesize
4KB

Download
memory/2748-8-0x000007FEFCE10000-0x000007FEFCE7C000-memory.dmp

Filesize
432KB

Download
memory/2748-5-0x000007FEFCE10000-0x000007FEFCE7C000-memory.dmp

Filesize
432KB

Download
memory/2748-1-0x000007FEFCE23000-0x000007FEFCE24000-memory.dmp

Filesize
4KB

Download
memory/2748-2-0x000007FEFCE10000-0x000007FEFCE7C000-memory.dmp

Filesize
432KB

Download
memory/2748-3-0x000007FEFCE10000-0x000007FEFCE7C000-memory.dmp

Filesize
432KB

Download
memory/2748-4-0x000007FEFCE10000-0x000007FEFCE7C000-memory.dmp

Filesize
432KB

Download
memory/2748-12-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads