hxxps://drive[.]google[.]com/u/0/uc?id=114V0buQLSEn0UNRWuiXdJXfyU8pyBvVj&export=download

Analysis

max time kernel
840s
max time network
844s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/u/0/uc?id=114V0buQLSEn0UNRWuiXdJXfyU8pyBvVj&export=download

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
5	drive.google.com
6	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d0cb9aae8945db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c91e454d2b879f47b8beb4a11bdb01ad0000000002000000000010660000000100002000000067011a5d01cb8ea9b7788083c7d5bd852f447df91aa83be98d777220aeea9f5e000000000e800000000200002000000041bbed9e8dedb683a1d1d97bfd0218341e6b5be6e6ddc47fd9bd1bd2253848c4200000004bcd4e577108787a8691fa3f28119c99bddcafa37c59e1a88618a476755cad4840000000c9bf3f860fbdc9ee4cf5394fac3a2a3adb813fef35a7e1d520c0ba2b15b1659bd4989bb5d29a6d3f8616f6c8f07c2c63376c056b7186e6a3763791bd9ea4634c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E68E01B1-B17C-11EF-A2A3-4E0B11BE40FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439395415"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a4d4bc8945db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c91e454d2b879f47b8beb4a11bdb01ad000000000200000000001066000000010000200000003c8dab46450e56be152e7a28e48881d04a75eb986d58d716458063dca4bc1711000000000e8000000002000020000000b0893bb3f97f8a07ecdda43f385b83f5897903602bff48bba3d75d11161e85c290000000c2979f59442d038dde59f88aac8d84541322c62621fb459774070fa9726f623d98fe1cf1955340a36991c61b9e7cd31b6212b84231137cfd13f9a67f508e0178703269a8c22b51b89c64b2aac4e7976f5856fa62b225a3df38e71938e09271dd2d1a9e3dba0656f72d18e6ed93146a6d14672dd6a63449e7e9ca6a925001afb1f9538f82958b3df6efb0799e594276b04000000076b3324681389df0fbb33e0503f648c389b509f7c838acada1c349db833289a3c6379d105f0c53857034ef1ba4a3453e92e6c7579eedda907dfce8770bb4dc30	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
356	AcroRd32.exe
356	AcroRd32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2792	2268	iexplore.exe	31
PID 2268 wrote to memory of 2792	2268	iexplore.exe	31
PID 2268 wrote to memory of 2792	2268	iexplore.exe	31
PID 2268 wrote to memory of 2792	2268	iexplore.exe	31
PID 2268 wrote to memory of 716	2268	iexplore.exe	33
PID 2268 wrote to memory of 716	2268	iexplore.exe	33
PID 2268 wrote to memory of 716	2268	iexplore.exe	33
PID 716 wrote to memory of 928	716	rundll32.exe	34
PID 716 wrote to memory of 928	716	rundll32.exe	34
PID 716 wrote to memory of 928	716	rundll32.exe	34
PID 928 wrote to memory of 356	928	rundll32.exe	35
PID 928 wrote to memory of 356	928	rundll32.exe	35
PID 928 wrote to memory of 356	928	rundll32.exe	35
PID 928 wrote to memory of 356	928	rundll32.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://drive.google.com/u/0/uc?id=114V0buQLSEn0UNRWuiXdJXfyU8pyBvVj&export=download
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\WinXP Horror Edition.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\WinXP Horror Edition.7z
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\WinXP Horror Edition.7z"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a947f74abf70fb38cb05082e90940e18

SHA1
1a9b28e1501626ebea33bf80a5824e284548c1dd

SHA256
2a8756dfe319029718516d607ece4429993d23f9608714adc6e05ec959901bdd

SHA512
d70cc4a8074f2065bab0a7f85304610fbdd003e4f26a4a7639716d3f535a73f6d7222eb16a58631cf4e15cd586ada000dce0671179c9fcf8139e0c371b5f6590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06ac901d2121a7d48b3567ffb55d4d88

SHA1
914907d693812b0b6e8eccc6458c442bf1f12872

SHA256
cd424404a6dbe237723c7d8db47a2f8d7deb12716df5ca4f6f4b1d11b3481017

SHA512
c3c3ecbc0534058c77f6c67245aa6c765b404abf4553e837df4158c39e1559e328630d1266525d0c2ecc0a4e288d7dbd3bea976ab2c72bbfa8de84cb3a0fc090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acd1b75d67cae0dd89e00ca2dcd36bc0

SHA1
b3662cfb8325d56915310c12ed6b38d5d821647e

SHA256
921add52fabcdc3e8d93fabab0b82ebca05d343161d2ed4e2133490ab1a76373

SHA512
c583205f2e51219f00581be509a0dd3f260528102660da4f578bf1dc63cbcadc8deeb209b5453d14d8c3cdd3057a77d41867cec9d6808581c3d5a5bd56399283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdc7fe22663cfa2b92f328e85c3f04dd

SHA1
c0ca3d0733f4016bef04c3e05f3f2ef28d3bd09b

SHA256
e8674e33f1dccd7815a0dff79a291c63156a99d055c543eba05d4fa81726a754

SHA512
2beab3515240f2a0894490244c4852817772e28144fe9570f578624d9da5e3f514288fb83a7ac7e4fe361e38ee0b23e003738028123c31d74f2ff4f88b362884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f5894ece5733d5c0d018bfc70ebec55

SHA1
d62d1608795e1329560a7f0529c13134b386a606

SHA256
cef7c2117cf5c2ee1351f7f23d04a693b533319b5ee24eb6a95ce051bdafcfc8

SHA512
ac97de6895d4cd430af373e59b907a6f56c4d2bb92ba71966796d98684ada906347c300350f7621db4d71b1db93c26f36e22d9ccb73adb81c448c1417e9922fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d7b19d56b2675d6d40dabf8b55da471

SHA1
c9057434f6eaa01e3a0cd1a8798f58d48904ee70

SHA256
2283a9e5e028c9cea3d72237538c6a2f245bde346a7f57ee74900de03e8aa1bf

SHA512
54ee4636ecf9661b1c349f5af00b6a9b081a6b6fc4b09c5211bdc95e5e525b2accc8797ed801007e4d73258a6761c45944ec74679ed14fd652c6d23030f1215e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83062dde5c053da45a5b9ca245061573

SHA1
6f1d8f63d296a6dda5dcdec6c86680eeb30d211a

SHA256
2249f22b815a43b8fdc1fa9303e1fbd2f35ac5ed1b7d83660fdb50837809428a

SHA512
69a9bb00cbb57c8223cb4bbe06b0637188cc8e776dbf0ca3b10e1b2e2c0c5e1d1d52698076b9d47cfe6d42ef984fe34d0c1c692acb20d867d2a7b77f7c03bc9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35e6b7133e15345169cff255bb82d152

SHA1
aacb5c95fb8a2fcf3150e44933822e4945de4ebf

SHA256
bb2836141a7e990d29f6705ea08116b69edabada6013b07c77f4844dd8850296

SHA512
a046186d3e1cef28420910f87899300d2be7e9012d0fcc2e427296606fd445c6a8e4a1bd707be2eca02365a2c756fb18d97150772835f5de78ef86de2c19283c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0bfeb7c231cfaebe1617ce624e623c1

SHA1
c128f52d1842750be3e2376377e3793742b529ac

SHA256
5c00a13ca8c3ccba56e8ac0607b9d1ea934bdf2398ef722a886c121a6a9f2289

SHA512
f0aa6bd3c0ca4d7209340ee85c7f676ac27627c34f8569e91d0d3c0df6f5cafc6d43ed3dfb111ad931a25f69ecebcf8a02bffca49a54500e7f0e4510c9ceae09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c91c25f32a7a3a63faae2fa613a7e641

SHA1
7d5f0da17d8cfd206076c34b4255d95e5e7506e4

SHA256
db1bcf0358aeb3d16f01063d4f83ecc7ecf2feb7df1abe89983cca62bfdf35df

SHA512
e03c91e752aa03036160f12adee29cb7f7d7b0bd9f2d60f108dccaa84dfb879de9c2d1bed9cd8d555b0c9096feb91c0be0acd13bc2646b3079b17d56be5ac482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b52c96eb8ebb7190f04d8b123722f4c9

SHA1
0e44d520c73cef7f25e07eec32a3dc56cc4b208d

SHA256
f6a1e04f0c79d926d3a50f6449638e42e359cfdbec84f930ddd23f87832ebe33

SHA512
011886c5fb63487014c6075316ca56a6d1d39d4e190bb1288c4f18637006a92a656e7ab1008d2c629173716e83beb1b4363ae779a6f0217f6346a4efc15ca450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30ff858b91c6367300b7df8ff730c717

SHA1
b4875da049b3a3a5770996ffe8cd70f5f4cbae78

SHA256
fbdabbf4c2707990f130531eee5b66f1d66278ec16cda0f73771f623b750e76b

SHA512
d32a32e5edfe8df13cdaf524b69418576a16dce17f99f8c3474f84379577d77de8fc3ecef71e0a9db4f2275db30b2cdde4186395b30363458dbe5dc3631247f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
604c4176036bfac8789c8a27540bae81

SHA1
93ca6cc88e2793e7132f6f724d945df26cfccb8f

SHA256
74bb58422455c8bde9da50ba554dd4d038bbdcab43586737f5cbebce0896df03

SHA512
d695a7b2d1c7d58e5479ccdb5dd1daf70030dd4c02694b26413bc3527e73ad81f86eee88fdee13864570abfb961d0cd5cdf37d5472317fabfecaf913fb3dc8d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caf1e80d10406e9e447e70d653c56c18

SHA1
6a64178bee6128cb0955313319705714fa2a5f3f

SHA256
5d4f401cb9a344a67ac8c9560e5a34eca82e49657da2f7182e53a016583d9114

SHA512
4bf7a0b4200e2bf7d235650b7f5ca27fcc49343e818549db8f0e48ba9c2f7946df49ddc58e50b92d2b1ac076b7081d3c5d96fd1f947e0da28712abcf83b74095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b7ee5e7bbc3e5b01846e1d9edf50d0b

SHA1
180283d0044cb309894dfbc3b80f8be5a85d4cf8

SHA256
a78eaba19e1abd27c8a7939b342a324c3886d00459a894528f574568d8f4ddd0

SHA512
229242b26667171c24a5a6b09e2b91e678cc0a81b61fe8ae9aa1a0aa7dc1884b8415a790a46f8a3bf31621e4aa11ad79115096f0abc9547b8a8a5039e28b3c9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
733a3d1be333cec3f6b1ba22ae9a3c91

SHA1
ad86c1a6b2eccd4ca94055fd42f302cf911f5926

SHA256
57e193929113bf7190fa9191f306a2c12bac1e2e37f634ec916cedbf50e326ed

SHA512
8d03500aa7e4170f8c5fd1dbcb9f8f13fec0d3cdb373ed094205a90a048188fad80a80cf3ecf2e655be0cb3727337dd9290c50fda736ba7f75f2f6a0b6c1c8aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9f20c8bf0b8eb9c9a1f81aec032d9e1

SHA1
06b46f79492264eb792d75cf229d94ab3eabf131

SHA256
cdbfb00ae3b14d6f9611b7090767eb87f08bfba0b7af79216d8bac09b9b33fc7

SHA512
81edf66a6e6e33902c7cfcbf0f306c674f08231204cab39ef822d58fc906ae306089f8c35366122fb589620191beda68cf257ab5fa9cdee1380e0e9be4b77408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f76880993add2f432a60d69be58ba688

SHA1
97df72e22d5a0888087d35b7fd4590bd633cc67c

SHA256
797514a99232e6a022e1ce168a7a726c3c0d56cf94ca91c4b803049a5ea486fe

SHA512
eb3402437c24058d0f5c5619077e7ccd2439e3fdcc338263fac5f7954281c711289f4a6d6666f9080c63c4ec8204b2670f4d6d3277260ba41a9581ecb4213535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1844378a5b13fcd7fc86aacda8e9e79d

SHA1
c26b214744b051a9725011d6ca2d5ee3b287182d

SHA256
3f26e5586dc94205d39b3d31c02302625606c67fd419437cebd1dcbe3e75df85

SHA512
1fe701a05a38e2a9b224cd91d025b5c6b2f03a1e89be007840296d2a948b8d71b7804680cef07d5f4a8bdcd15f46c2fc135c25172dda075f43c29f50b0dc8a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
718267bc6a247d698c790e09f37acee2

SHA1
bbb333efd4e067b5b6fcd2a2a11a07f51b853d76

SHA256
69f50774ba72829a73d3b48f6dd76f310b1b6e4d23113eedee394679d1dfad90

SHA512
34d8cd1c88ab15579ab6feff24012b181cecfae561a8a80281bf19b5814b811dafe190a6d1d6111450b02706d1cd4bda9a2e3b17932ab8ccd1fe113192244d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bf8c0b080f62b5bb5f0df9f16d8286a3

SHA1
6c306d6fa64bcd3e178018eb106b7fb5ffc2a1b3

SHA256
42568995511b3be4f362476769c4e150e92223e8868e1fe5c4cef780de79e086

SHA512
92f34551aa82d7d31ac148c09996dff4423db78d954b1bcdf1d86aafc9970b272a2867abc864a1ac84262421b5c6a648ea7d5470d0fd0814f631fc78e6760980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9fajjbh\imagestore.dat

Filesize
1KB

MD5
27885d8d9bc61a95f935ea4d2a5659be

SHA1
27ccc746295d3f70de72f409592a2df4246cd1ea

SHA256
9ee4fdce8315e5de44dcd66de10ff38cb41af4f322db992e88247effa7a5780c

SHA512
3abd3c49db345638522a38ed8846659085b57987b60beafb3301a01aae22f927d180f5f3fb3c777ca305e46fadbfd61237863ff9f2f41370273565a2e3351926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\WinXP Horror Edition.7z.k44n0ue.partial

Filesize
44.0MB

MD5
aa45d1d70efa630ee7b64bf5fd0a493a

SHA1
454090d52076c121ccf858291461805f0272d559

SHA256
0c0267932bb202aee030f44277881680dbe0f9a9387a2b1c601dad2048243454

SHA512
a1fbe8ea113fb3e4cc266f3aa50c46e87acfa129e08adf98279da2ab7dfc52da963bf7ab179fdc68e23e5bf8ff5fa3ee7e277e885f719c23e831fce714540248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\drive_2022q3_32dp[1].png

Filesize
1KB

MD5
c66f20f2e39eb2f6a0a4cdbe0d955e5f

SHA1
575ef086ce461e0ef83662e3acb3c1a789ebb0a8

SHA256
2ab9cd0ffdddf7bf060620ae328fe626bfa2c004739adedb74ec894faf9bee31

SHA512
b9c44a2113fb078d83e968dc0af2e78995bb6dd4ca25abff31e9ab180849c5de3036b69931cca295ac64155d5b168b634e35b7699f3fe65d4a30e9058a2639bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads