Analysis
- max time kernel
120s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
29/11/2024, 04:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe
Resource
win7-20240903-en
windows7-x64
21 signatures
120 seconds
General
- Target b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe
- Size 614KB
- Sample241129-epdcpszpaj
- SHA256 b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63f
- MD5 06bbfde2da97ddffccb592fec69dfb20
- SHA1 3bd6b405555d5c86b754cfdee7d3d404be620783
- SHA512 952e52bd241411b271e6571e439bd75f8538b1777a83c0cba0b3389dbb58310ef45bb8ee4a3660476909fff15cf14f51d91f02e2755324ec128b2268a27d177e
- SSDEEP 12288:xO9D/ZLx2KXaP4svzvF6TUhWnWEGNuO6DpSp7YPjiWJtu55fPlQhFfvGFgntWm58:xO9Rzagczt6TrnWEGNuO6DpSp7Mjiwul
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Expiro family
- Expiro payload 1 IoCs
resource yara_rule behavioral2/memory/1072-2-0x0000000000400000-0x0000000000658000-memory.dmp family_expiro1 - Disables taskbar notifications via registry modification
- Executes dropped EXE 5 IoCs
pid Process 3724 elevation_service.exe 4872 elevation_service.exe 4276 maintenanceservice.exe 2032 OSE.EXE 1816 ssh-agent.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3442511616-637977696-3186306149-1000 elevation_service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3442511616-637977696-3186306149-1000\EnableNotifications = "0" elevation_service.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe - Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\X: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\P: elevation_service.exe File opened (read-only) \??\Y: elevation_service.exe File opened (read-only) \??\H: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\K: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\T: elevation_service.exe File opened (read-only) \??\Z: elevation_service.exe File opened (read-only) \??\U: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\V: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\G: elevation_service.exe File opened (read-only) \??\M: elevation_service.exe File opened (read-only) \??\Q: elevation_service.exe File opened (read-only) \??\N: elevation_service.exe File opened (read-only) \??\V: elevation_service.exe File opened (read-only) \??\W: elevation_service.exe File opened (read-only) \??\I: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\N: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\Z: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\I: elevation_service.exe File opened (read-only) \??\K: elevation_service.exe File opened (read-only) \??\L: elevation_service.exe File opened (read-only) \??\R: elevation_service.exe File opened (read-only) \??\U: elevation_service.exe File opened (read-only) \??\G: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\L: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\W: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\Y: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\H: elevation_service.exe File opened (read-only) \??\Q: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\J: elevation_service.exe File opened (read-only) \??\O: elevation_service.exe File opened (read-only) \??\M: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\R: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\S: elevation_service.exe File opened (read-only) \??\X: elevation_service.exe File opened (read-only) \??\E: elevation_service.exe File opened (read-only) \??\E: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\J: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\O: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\P: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened (read-only) \??\T: b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\system32\sgrmbroker.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\vds.exe elevation_service.exe File opened for modification \??\c:\windows\system32\dllhost.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\windows\SysWOW64\pkigfogp.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\msiexec.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\windows\system32\badmfmci.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\perfhost.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\windows\system32\hipfohea.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\Agentservice.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\vds.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\Appvclient.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\windows\system32\enfpcnji.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\spectrum.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\windows\system32\WindowsPowerShell\v1.0\dbpoinpk.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe elevation_service.exe File opened for modification \??\c:\windows\system32\snmptrap.exe elevation_service.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\sensordataservice.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\windows\system32\openssh\oobgmjaf.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\Agentservice.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\windows\system32\mhekpmma.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\msdtc.exe elevation_service.exe File opened for modification \??\c:\windows\system32\svchost.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\Appvclient.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\windows\system32\nlaniioo.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe elevation_service.exe File opened for modification \??\c:\windows\system32\fxssvc.exe elevation_service.exe File opened for modification \??\c:\windows\system32\vssvc.exe elevation_service.exe File opened for modification \??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\windows\system32\jejfbnag.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\Appvclient.exe elevation_service.exe File opened for modification \??\c:\windows\system32\dllhost.exe elevation_service.exe File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe elevation_service.exe File opened for modification \??\c:\windows\system32\lsass.exe elevation_service.exe File opened for modification \??\c:\windows\system32\Agentservice.exe elevation_service.exe File opened for modification \??\c:\windows\system32\fxssvc.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\wbengine.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\alg.exe elevation_service.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe elevation_service.exe File opened for modification \??\c:\windows\system32\lsass.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\svchost.exe elevation_service.exe File opened for modification \??\c:\windows\system32\snmptrap.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\spectrum.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\openssh\ssh-agent.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\locator.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\sgrmbroker.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\alg.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\searchindexer.exe elevation_service.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\searchindexer.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\system32\locator.exe elevation_service.exe File opened for modification \??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\nimidobm.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\bhlnifll.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\bin\phgiobhi.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\lbkhaemd.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\nklemblo.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File created C:\Program Files\Java\jdk-1.8\bin\poeojoof.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fjkphpcb.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\akaajeom.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\bin\idddgalc.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\program files\common files\microsoft shared\source engine\mljopial.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\bin\chlmfebj.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\djgnqiea.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\bin\elmcbqaa.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\gelfoimp.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\bin\fnkcikpn.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\7-Zip\7zG.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\7-Zip\afaqkaok.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Internet Explorer\aglddoil.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\bin\kefbfhkg.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\bin\edbponjd.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Common Files\microsoft shared\ink\jiianoje.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\program files\google\chrome\Application\123.0.6312.123\idbakenb.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dmkcmlkj.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dliebeel.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\moiajbka.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created \??\c:\program files (x86)\mozilla maintenance service\pelijdlj.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\bin\qqlagjep.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\knjpmnmh.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\bmmoojdm.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\elaqljie.tmp b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe 3724 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1072 b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe Token: SeTakeOwnershipPrivilege 3724 elevation_service.exe - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" elevation_service.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer elevation_service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe"C:\Users\Admin\AppData\Local\Temp\b4d6eaa6fb791e405cc9f5831932251bcb98cdd07cab88d4e09285648914e63fN.exe"1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3724
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4872
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4276
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2032
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1816
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 2.1MB
- SHA256 2b25cdc90e71316dcce9cf7fefc77de0a608f28a22d5ee827da1e016235e966d
- MD5 38bafba84262d070b910af49c38d9ee4
- SHA1 e9454248c45dc7f37e182a4eeafbe97942ab0af1
- SHA512 9f5f952222f88ffc3eeb1c04cc66f79ed6a8944c3d944ac59453da316b56751c5b4251dbc3ede78c2b0606bc50db4c36b9940c0c9fb0926f4edcbbe85830f489
- SSDEEP 49152:YuYk3H5koUjfTqkkYLO/W2buywzMbOX+T7z5Zncs:YbfTqi90bVc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 781KB
- SHA256 af03e20c6e41699a6dcc538dec8ac5f47c34af14a6ec6035af7f2af82520a43e
- MD5 5694eb0c0414ebb62427e6f09fa741c9
- SHA1 c3c04b8da00758c0e34e83871f9fbdb78d2a8fef
- SHA512 3f25256ee3ae559dc513fd5c29aba5f0ef9d94bcf964ce50015f1fd9ce8704e43984b1c6d6b88947de567050395095ac6dc75045d7414510e6672d9729aca893
- SSDEEP 12288:ysixPwEsHuXz3XMtqHW9vK73Hi6b71OVtWliCACnWO37Fb4/l5NhNCBUjxVtj:yZFwVuD3c4T7X9vWw8/l5NhNCq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 2ccb3e613850dd5722abb6f82ca6110aa9f1e754d789f68f82814fe4d52e24ae
- MD5 d17fd677490724d557951589ee1b4db9
- SHA1 857aa30124c0aba6d118d916ad2c92bba18ed0a8
- SHA512 e7438e8aafe6b6c3d12452fbc7ee78178dbcd87fd42de0aeaa6c9e30aa4c78674f0bbcce9c8fe33721e5438fc9b34dc86d6bc53fe89cff973170a10b7a1df2e4
- SSDEEP 12288:y7a3iwbihym2g7XO3LWUWfh4CozUr2cWLI1u6uOgCM+8HxkelBFJa+mjqhnyj0cw:b+gkEofh4CoC2cWLIEcgJxkezmMyjf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 e8580b901eb9f5300e2322ab305d957c911cd3538002d650596ceb4df7ee3fae
- MD5 b58a736e030f82dba773d9e5f614f62c
- SHA1 31e89a48c8e4f8bb6d80b389145c7210875bff82
- SHA512 2318baab9f718bac6f34183a20bd2519819a6f4061dc2ffa2e5c3a8c4b51980a7ad2e095d7fb58ec338f8b33527cf973d872d7ca6ef9eddcf5ef8eafb43f8de4
- SSDEEP 24576:oBpDRmi78gkPXlyo0Gwjrzzzh126j4H5CVIVkrf+Djy1ZRC:8NRmi78gkPX4o0Gwj7P2Qy5wIiaDjy12
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 9107151a26f30c9a9beba23266d7f28d11ac5ec291a155cd6ca8db5b9bf4f74d
- MD5 379e93522a602720f3f6a51b1c4c2f9a
- SHA1 d73045f1dcdc48b9d5fe8ca3e04af20f95103de7
- SHA512 02e9c041da7d41758dea3c338a9074018d222f9d01a691a9aeea866e3cec2abdcadb4e4a1f62ea0b55052c124d5f269eca9135bb0434f179289aa8e92eb7159f
- SSDEEP 24576:8LOS2o/PIXVQn6YTQChshX3Zpu6BzrRsm6i/Qo:E//DpTQ3jzremdQo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 832KB
- SHA256 5a4a341e7431431adac6d45b408815312c7cd8f46c195cbd564a94914133a1e8
- MD5 3146eb31879ef8ba4e2e0e50ca0b8a4d
- SHA1 259f15218b71838d84adb4eb10e81396ba413969
- SHA512 9345505bc1dea5bb18df770e9a1ec90542749cd076a1b671b38f8e07746b0d108a215fb9f3efe61c95b48950d414db0eec37fb26608aa5c572b3043443511cbb
- SSDEEP 12288:DeBNUbTVO86UVNoMP8lJaiKJNkWdKPCg7UOa:DJIUsDJaiKDkSKPrl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 f717da8d3e7d0220652cf6efb542701e502ea2d8cfa9e03772808a5a95e68fdb
- MD5 b5a9becc4757ce0c77fcb307e3bbb569
- SHA1 2e1227fd7016de28bcbe92166a6407bdb64f002d
- SHA512 cd6bf4c72977e938ce400a6c171b63c1407a76d0c21366756f0291de3ce7e1dd13f63844e987d4eca36cecf80b01df3ea2846196f0232b86ec411c597fc54581
- SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJQ9DN5J8NRV3THl:mQvGAdlCEL8c/QRNw5CHB5uy1zrv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 898KB
- SHA256 0c3a100a039dbdd2121c1ae58ac79b2dbf68292afc2791b60c2bdf798fbd3865
- MD5 5ebae32143fa36903412e6509db0d000
- SHA1 389959ad9b7d8cc115a25afbe379aa417ef3f252
- SHA512 0b1b9744f21c137b684b0e33e78c10b73122e7aff62f77d42a9824587606de6961b38c087ff2d4426eba38a946aca8ae3408a1b891c9318381f059d7b563720f
- SSDEEP 12288:ZAwSfxL/2Dc38DLLmt0LDQewsAj2zfe5i8d2p25XxEQgueNLZUIN2e70ZRARUvJM:KpewsAjSWFJlxX1eNtR2YbUG/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 c2a7403952eb48a495514090d7e1b48e78c99b5743ac90a18b92d4a931d412e2
- MD5 e94807dfbb2e2d531d817c3b47f37861
- SHA1 1c8a5c2042978edf38efaf884387d51a82e6e351
- SHA512 ba5669a4249ba5ae01009cf8e75020e61476c1bdc797140a07e320e2b4bf2c1076fa8d67e50b5655a34ed3fe84d7d0f0a267ded1307e78d4dcc31dc489b9b171
- SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHA:8UEtQevvqc2W1cpV29I32A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 26c12715bfabe05353f91a41e8e81099ffbc4b77f1961876fd8a96f04dfac02d
- MD5 e73d9fbfd0701f55fc0c7f8ef23d4d4c
- SHA1 5c189498c213a3be90710b1e2991a386a06717fe
- SHA512 970353174c31d3eceff8016a371f679f3af941911c320eb70c7a082de8c1097f078737eca518a2da937ca67a05120bc6db60d127b75def4d6eadae671c31b3a6
- SSDEEP 49152:DCbRquA/m2yL5zUfFiV+XenmE3/z+Lp9H9PsG:8oqpVjnmn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 797KB
- SHA256 422fb14bf7d675474d954d088159e2ba6b328d2ec6cff4bc406e85c5d35e01b6
- MD5 ed6971701e86d6d78828cfc68d2f4b7d
- SHA1 bf0648d26eca23cca0243aebc7e20d7821dd8729
- SHA512 1be8bdb2cba7c549e4bb51629236c5718628ad88806c977ff5212dbc55241d2e1af09d707ac73944ff66a0eeed74679cbf587b9ea684f3a3e14ec69414838de6
- SSDEEP 24576:bwuJOWTQhZtCqQmrLHt0Vx9HGvTZLd7XDNARk2dIFcXJbOo758cS3jFEpP:bwqONwjbBOo758cS3jFEp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\cpkcoelj.tmp
- Size 4.6MB
- SHA256 c1546e5355e43e7f94391e7bd4004d55147b0033e8f6adea84eb4dd8643dd44d
- MD5 f5865b210673032b26375fcba4cc2b44
- SHA1 53ac11858a6c785534bd119afd8ed7c728d6a5fa
- SHA512 ab683d54e5b76e297b1f155e874890e8192fe423cde7ea4cd101ec081b47a6bc9652a045a44917dabe45c0c62e3ea4e7ff1f19069ceaf36f4070acb57dc93309
- SSDEEP 49152:tyEKQ5E3ieGR0PEtBFUow1b89eX61P+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEW:xq9ceqp+2xl/SSayW/C1Aaf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
- Size 2.1MB
- SHA256 451322b08e1d4114491177b6cfe300d45fc5c735e72ea63c3a93bf8831731ccf
- MD5 cb25445bfd186d7b78f41cf4c7e23638
- SHA1 7a7550de416105037b261573682b8b1132458ea2
- SHA512 0cdd4acf0eeb84fa6efc3c9cad9ed259597c44308e640deca61f27089072bbf623ae0637aa82300bacbc964333683e76971ff0e153acc27e568a18861a1d44ff
- SSDEEP 49152:G59PYHvI7wi/yIKuLFrFXlMWGxbghlzXM6Lp9H9PsG:GGgyIKgMoVx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Internet Explorer\iexplore.exe
- Size 1.3MB
- SHA256 1b214ed62471e00a3dae9c79df716b96955cf5172e57648df1d6d3217c4d0722
- MD5 3007aca54b363d218548f4a7e09fdadd
- SHA1 7ea3d5583779799b51c7804011051b259758f0ac
- SHA512 aafed0c4e3400c7f8c09ed147b136b10795d4abd5a5bcc3a36ed3ebd56993dbc712b525b4c920d62a633007c71be96fc44ae65a2215a5fb5b8c81ecff87a94cd
- SSDEEP 24576:mDf4lGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMMVW:mBMMHMMMvMMZMMMlmMMMiMMMYJMMHMM4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
- Size 978KB
- SHA256 c178af291c2c7c7eb3b335e0f240ef26da4caa736ef4e8ebbb82b3b17ea344cc
- MD5 3453dd41c1822f650935254d6e4827d5
- SHA1 bcad24fbe7014e9a7e575945e6364e7b200509e9
- SHA512 bbc97e2f2d7c12f8ef6e9938011431f8f756612095c5e1ac422d51175b692ab4e1c0afd0bff8ff4770a628be3688bf50d5f1d10b809b4c83d2da734d60a31700
- SSDEEP 24576:x5ZwW2KjJ4Td3kJnbsPhnzq+ldMJEI94JssYPcc16C1U:FbnJ4Td3mbsPhne+A4Ssucc1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 932KB
- SHA256 7983e9471157da0eb7f123220e95fa7b264c5a2b1f0080c66c940735951112a9
- MD5 c0dc06688fb935a61dc3f3af0f792855
- SHA1 4beb6f283a84c8f73bc3388d8d938036d748ff5e
- SHA512 82d16f33c40683d5d2f1ca3aed7924cb92575c9a56d2e3f286c88ce49636e1459fa3ff5574f4223c10b8105b5669eb93c18513fb15c158b9e06ad06ef4e3195d
- SSDEEP 12288:gObSA4LWOsvAYFTwYO3zveyD70XTNPXR/2dYbxs/0zFxiFp:d6L3UTwh3zveyMXFXV6YFmYF8j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\enfpcnji.tmp
- Size 1.3MB
- SHA256 f6e0cb49e151811bfe18fd506f65342314b22edc6b82fae88f940ff657837b11
- MD5 ba06d410ed1d67262eaf09ef005e6448
- SHA1 e0bf0bd9bd60fee659b561520ad39af2a3fe64d2
- SHA512 7c7f5436934a9630cf10250abf8eee54d8197b65348b4ce5a381769b4290ec539befdc2d446126fda286df3beb04aff58168445bc4952d891322b337a3843784
- SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYqjMqbeOzhBhRhiVX4L23:lTDxR+N5YzT0jM/OFBhRh8X4LI
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files\windows media player\wmpnetwk.exe
- Size 1.5MB
- SHA256 24c64776fafecd41af9bb19f016151fa31bfc76edc6f1abab83c8c47c1db0411
- MD5 e5d17e9ccee6cbd8c799226dd23b0483
- SHA1 d7e3d0ee94e3d011f70ed17f23ddebd0c918e0dc
- SHA512 be92dcd3ef5ea2f3c4cf0f59c1bb7f79ba74079be7e03b66bd6f1accb8fec01799a95682beda2e6dd893f716103a827c5fbd8adf209809f56001eb8112c3fe8b
- SSDEEP 24576:9cP4mcvIjkGOxhKP2l71zNKbrh/8KBsl/+piY9wv3GZpNrR:CP4m4IpOO67u8KqlGoY9K3GZ
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\Agentservice.exe
- Size 1.7MB
- SHA256 8c71df38ead72901016ff6141615e9a6e70dd512f0cba3300475bbdd505c1164
- MD5 e4c2c16c8d3ad06f857a9fde02f0a422
- SHA1 5c0ea8d22383b7fdc2021f92c55bebac49b52061
- SHA512 723e8eb6a782978ecb919b776b0487a3a06b3e4c26eae6800d57f7a1afe8b16c9a033b69e50b913196af0c2f447eeb469009120641b35f64ba10f91701edea64
- SSDEEP 24576:RoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBz9EzwwXg/bIES5eQ:Ra0h2GEkuAe73q3ppF6zwwQE2/H
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\fxssvc.exe
- Size 1.2MB
- SHA256 fc388b86334d7668e03273aa904c87305a4d5d8e84f11a163e0e80f09b000927
- MD5 99c4547f7228e01d14ce01c4c9ebf4fc
- SHA1 343b653335662cf52f11efda0e45c1bb8fdf700f
- SHA512 ec0dde52779e3ed79d997d3878da704c099db485c035dbf794d21008fea7c77a86a9725c7627753bf14d7cdd022ef956ec90428e2904cf76f90fd608d484b278
- SSDEEP 24576:E3YgnJcRTk4yti+R5d5R/mXUS0RqL0XA54QQThTG+300gD:EIgnaTk46p5R/BEsn
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\msdtc.exe
- Size 700KB
- SHA256 0642ef0c466b8ddd6102066c79c912632782771ecceacb2a94226e78119754dc
- MD5 75d523b018482f927870a383d62a7d0a
- SHA1 09741bb817c3376e52eb493641f89c3d951c5af8
- SHA512 98f1a536b8d120960b5a4bc72429f50b2f516db44a5f42864616954df21508f0d3d01b26166408b929e17143b2a580c99b1b74ab69292c487d5531dbcd2cf96e
- SSDEEP 12288:BjkyHoO2eTxWgmcqPGqShwApLL0SBe73aIcYghvpZL4jqytue:BIyHoITnmvGqShwABLajgTqjqyM
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\msiexec.exe
- Size 623KB
- SHA256 721891dc91578c2662df2bdb99fab38562ffadb8a96014e7442dd16e5046e601
- MD5 3e440efc87e4470f25c8ce73e030106e
- SHA1 1b2465d5503da7ca8fef990ec5403cf79dbbb524
- SHA512 d6cd908226914ce25443a7bb2f36c07f7f33139c66d62d873c8dae928247c1228ac7864a399988fec85e51d22a87e3bbde8df626deed4f6fac294549b292ff49
- SSDEEP 12288:a4P10elb1zcNjjTkIbrfcmdEAeFuh02TL2AOrwercuHogL7sF5v2R:h1dDzcNjjTk0k0EAeFuO2TLIH/HosAX
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\snmptrap.exe
- Size 572KB
- SHA256 aaa986db292e5062f60e151c6ebf178ab2a87933cc78089d554a40f0a3e7bf60
- MD5 7e89a5099aa8a25030258d6405fd02b0
- SHA1 0e502b831157d7700c6165ece934ca8456d4cfd2
- SHA512 5058ec7f824e51414c1ea5dd7da4d5bffdfd7fced1340a087ea2f49fa4f83ae451caa157520ed6847e6791ff9b9884bc699d2f4d5c38efcd438d8c5f584e0898
- SSDEEP 12288:Zn2TUAoXLMPLD3bQfLJ/ts+4OPs+b2ieTfjuwq4OlrYKAPbq:B6UAoXIPLD3bQTJ1PJb2LTfjuwq4Olxn
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\wbengine.exe
- Size 2.1MB
- SHA256 f935f2165cd161e7175565efdfcb03cf99fde93e0c5713674da6b8cabf6730ed
- MD5 52f4c71de27c98e60403ac12a48b580d
- SHA1 8e60ba497d923dba5cd1080edb5b0a286f4bb2a2
- SHA512 f6239e245395fc235d4e13883c25389cf2b8dc7dd9f3763014fb9040c3f114b46f9488cd5b67dbf98941fa65de67a1b61c469d5737866fc66c2e31e7df9289d8
- SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK3IKvrPB6YElFBYUvSSaG8Tgn6CwdkPk:a0zuNIIrPB6YElFBYUvSSaG8Tgn6Vok
- MD5 SHA1 SHA512 SSDEEP