neshta | 16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602

Analysis

max time kernel
141s
max time network
136s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Size

9.3MB
MD5

bf9bab6072fe8ebcaecc1963583c2889
SHA1

8fefe9a419c1573ec3a32d1955f45afc5da1106b
SHA256

16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602
SHA512

2b57663d64e1f9b9fd9dd61c27ad79645bd476e4bdc000a8eda5bc5b81a9a684ae9c43cb0d7f7c13966b735759ac75b025b6d017bfb39c8c0c71b12bde25e057
SSDEEP

196608:2qMS5A8r2wSwfhK2eilgTo3+jggWUCatEEZvZyMR7NZ:2g5x2hyK2e4g0TxatEEh8IJZ

Score

10^/10

neshta discovery persistence spyware stealer upx

Malware Config

Signatures

Detect Neshta payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0001000000010315-13.dat	family_neshta
behavioral1/memory/1100-143-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1100-444-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1100-488-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Executes dropped EXE 1 IoCs

pid	Process
1592	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe

Loads dropped DLL 3 IoCs

pid	Process
1100	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
1100	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
1100	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000015e8f-2.dat	upx
behavioral1/memory/1592-16-0x0000000000850000-0x00000000023DC000-memory.dmp	upx
behavioral1/memory/1592-144-0x0000000000850000-0x00000000023DC000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazonaws.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b96000000000200000000001066000000010000200000001c5fadcd200ca397b0f67942825952688d809c54f59dadb1fe9183b3a7a3aaf3000000000e80000000020000200000007017ec6e74d84bc70e2da4fe544571570324218559b92d97bfec45206c3a8865900000007ec6d08eeaabe5ea14e0263bed8ab56a41a66925aaee7776a0f982895f25c762bb3a77c23c60c9ec4f748d32d05df25482216f3cb09ef804bf579d4828c59e4eec358536968f03e4cb11f1912af47a92c01e32042362be84f81add5d1a9419aeba88a7e8358d202b540c4f7f230b544be1fde70fa10040ef0fb2329d3d1af628c6b80c5f4fab97348dc18006422f2a10400000007ba16f9ea414763fd4a41f45e5c198ac98e59c2a6b4e266e7f66d3c1ead6ff5bf79c99ed00879567845fb86f8c7fc3e9f3c5b5c0894697fa867e26204bcb7d56	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440023027"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d342053f4bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\s3.amazonaws.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\s3.amazonaws.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazonaws.com\Total = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000cf9bead240dc5c6c6e7fc5a5079d2ce5ba91b24236623282ea6b5f5e47e8e30e000000000e8000000002000020000000e15f1d53a40315ebdef0bea1e68298370a438833f36e1570b3b21ce68d9401f1200000006a3ee6b131e9341e384c7790c923d2e589e73f05e884bfc509e64455d346682040000000b1cae9ebbd73419e831447cd8a1506a9a98dd293080d0eb5bb1719c2d562cb891316ddb4d94e128877612e702a79b53b6fcdf75c6f1944caf5f61fad909a321b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\s3.amazonaws.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BE747C1-B732-11EF-A5D6-7E6174361434} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazonaws.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazonaws.com\Total = "0"	IEXPLORE.EXE

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\psiphon\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe\" -- \"%1\""	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\psiphon	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\psiphon\ = "URL:psiphon"	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\psiphon\URL Protocol	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\psiphon\shell\open\command	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\psiphon\shell	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\psiphon\shell\open	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1592	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
1592	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
2580	iexplore.exe
2580	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1592	1100	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe	28
PID 1100 wrote to memory of 1592	1100	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe	28
PID 1100 wrote to memory of 1592	1100	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe	28
PID 1100 wrote to memory of 1592	1100	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe	28
PID 1592 wrote to memory of 2580	1592	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe	30
PID 1592 wrote to memory of 2580	1592	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe	30
PID 1592 wrote to memory of 2580	1592	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe	30
PID 1592 wrote to memory of 2580	1592	16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe	30
PID 2580 wrote to memory of 2256	2580	iexplore.exe	31
PID 2580 wrote to memory of 2256	2580	iexplore.exe	31
PID 2580 wrote to memory of 2256	2580	iexplore.exe	31
PID 2580 wrote to memory of 2256	2580	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
"C:\Users\Admin\AppData\Local\Temp\16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\3582-490\16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://s3.amazonaws.com/psiphon/web/yqeg-8x4w-6cha/faq.html#windows-7-eol
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
73471bd718cc90e2a56fdcda89045cb1

SHA1
9532afc989213a477c6c5cc73af2e77c07ec9554

SHA256
291dfb3a68cae4e4713f9e26859bbcdf385af26cc5bbc5e03942b9d17a7918fd

SHA512
166243faf61d1a8bbd725aa355d8e4d5196165e06e28a1161bd8f545470c43c77a1b898ebca31972bf789c5a01a9a6f76a58696423463701cee762841307195e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79a519ac286c79d04740106f362338eb

SHA1
3979e80cf58a8f059ce1bc0fc7459dc2a2ce57d7

SHA256
4552226aa4b083fd8d9baa829e044dee847a1c3694291bfa277ed6679e53bf96

SHA512
11aad69d86b206ad39b1e2e27abff388756871aea0c96c243ad8f27293139c2dc00077881871978d0f5a6594ec977e8b64fa032f83633c9ec1e415908d042964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbba61539dfd029943b74e6904fc3776

SHA1
e7df07ea8a9b3698f78a7b134d916d5a31d139fe

SHA256
ccfcd8ee1e220e1b597d2f77c90ca86468eea300f4038aea7c15b90ee2ac90f3

SHA512
f4134bd447382799412f6a04fda6fa81db90e89f46a220534e833c839ea592cea9314f6488df40449f609d161478adfcd509c56a5ad436d9aa3aab4b168910aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
839136833002e0e404c74bc4e50e793e

SHA1
2068eb81441f165d64f721b74598ce9e98f645ad

SHA256
ed728ca947f10b4efb1c89b8bbf355e6a3d7d71e1ab2d3e1e2978841edb4a070

SHA512
eb62a5fe904ebcd5552246b843a4a12ea6b2974f98946b60ce18fb97b6af823042e738614b487fc1b85a5bd9b03f230cd60151d3e6911c1c4972607498b3aaca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a37609e8800c0924e25b47c1663ccdda

SHA1
87f8df45d9837c0a459504e9d27fc09b45e682ee

SHA256
f1596d083e1187373e3371dc80dcfa40c1bf6693a421dbe176d4ae6f76994d1f

SHA512
3f204d92b064a7733fc2b51a0139f0b0fd42a2bbc61549f0c26e73b81ea23c12054d2468664a038e24e17e255c022faa74dd22a793e1f350c2cc1f7f008ea26a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56da507a857af63005e38f3e9a07e23b

SHA1
5cc64faa311ff95cc718d48879f24a3c952f157e

SHA256
320b9036b41f60ed3fe6f8769c69546101bbff3fc411858ead964026baa5ae03

SHA512
8632dc23ed101c4369fcc58e030406ce028035bf4d4633db60fd7131c0a26dfe96034b55b8f9cdc9f2f43408a9aedd0c630ef4cf885eac1936d93d1a5b7005b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28db00fe67b113df267c4d01bb5a7e3d

SHA1
1da12b861ff2f2b9c181c1cdfd928653df988706

SHA256
021331d8f53d4e519aa07def32c9d9808f97d7f739929119bfd1b886bde3b43c

SHA512
6e056a296a4609e6746541b62679c6c4f62287931d1a3d24e38d38130fb9ba9eec42ce7c9213532700dc1269f2bd8e240ce26f1f00fb6b7e771259303a3090ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d91c5d7eb8ee16b5a74a01f4011ca7ee

SHA1
28ebd1205b4bd1cdaaca0ef5f22f14ad2fa2ec13

SHA256
105792c4a270e5ad5bad1e40c1b28c64e05c583fae70bc715740c16c4eae1dc6

SHA512
ec72a780989c1d7ba65587ccc497c4b0d749138c348ab7cb178e7049417fb070ac35fd655cfad8c26b52396d4fa2fe586e5e620a8b2c24f3252eaae6ce4daa63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cadafab7c3a4c1792bc89a6f0219309a

SHA1
10f75201884efe43c7131f8e2db5fcb7b4d46463

SHA256
efe7773f0e6bc7226b6b259bd6b271fdf33aabf66674c73c950464418c2d0d1e

SHA512
d8a7f9e38526df46073b082658621cf4717065eb38c9464368877e0a59a94f153326105933311d9aa8b1bf9fd6c71765a48624cec7e5e82fbd5b49652ced0884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fa8c524766b8eab961f89594136bbca

SHA1
25dc617d7a3ffbd2e9a3170246bbf7d3ea4d5e2b

SHA256
048e33743197a685cfb6a02db5b3a655e1451b2defbb81997956d4c87e105cd4

SHA512
88b3cf53ac2113330e0ecb32ef51dd2cf8039ede8d96b742a0388a552ab7c1d0ba727c400f3e620ce6be6a9ddf39887a5537a7dc8aac783e850e8bfa9bf0ff01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
209ec7bb1bef1b1380800f3111b334e9

SHA1
19c1790c50c099cf1f552b6dbcabf3289a021144

SHA256
66969344b965941f7744b9d1131c296050333930806e9b6c7578cbdc21dba601

SHA512
94c97896eb4f42b59f1585cbe1b3288b99fc1557aceb5e9f7eb4b19e908eb8ff24c06cf7bb32079b943351216680d7815cf8f0ca67a10f15acef6ec01c4b4867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a77ec1b05fd4936ab84270ba8c6eecc

SHA1
779d2fb52a112dccd5fa77c36971bd23e7117456

SHA256
ef064b6a491269cb977c742de55cab494abb6268ecff9416b940fc7df3b5703d

SHA512
ff6447bf54d9fcd8eabe0fd3625b584600bc45c1ee812617b9b3a3b7ee2b639c874a8d95fd42e02263fc6c7fccd4b320b9f70dfd92fd3ce13252431ccf627cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
039451bcf48283c1443722e570fb33ca

SHA1
de367f62ffcc23dd31a62eeef9132289dd982f24

SHA256
8c2c4390e25ab175cb83d4eed0ba930f09ca73c7ebc1fe8dd318de10603f664e

SHA512
edfe4769d6185f00a5a2f50d46ac78c9a4fd79b5676d84b5c777b643d67b68061db1465b08f2a619f434561dcb67d78bf2dc52eba7b873b303ce96936dcba432

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
865661e66e7b8b5ae3e6f3d26aeb4fc7

SHA1
b4fff60aaaaed510b17657d6e7fb70f50fdfcabd

SHA256
0088c59660a4de3595e97d606e1f50b96f70f23f6d6507995ca035d9e222eaf2

SHA512
ea1de93edf7526988c6abaa32b68b639357bdf53f828e3832893ab320aab7ba9c4793c373a3f14095054f491164abb9bcc9dcdf01aabe3daf2b0d839bcf52c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40da1a3aa508a2136eb005f385fde231

SHA1
e0e017642b7490d67a2434b9a6ccc07cd437cd60

SHA256
3521f829f298a2ae88d1d1f311937a32a974b342eec315b90aae37daadc8e8d2

SHA512
f676d347da3b2416e34c4843b362ea052ee74d7d27127f00e40c3f92cc8ad531ce67c102ce6bf72a8d61a64ce0c0d50b2b42709d722c6a192853b0fd0524c149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfbe230b7a4e1b236f663638775a8ed0

SHA1
121d78ab23f85e27728ac06341828b12d7d71fa9

SHA256
71e6b792771efbf781aee3c5ba1cea7b9e6bfba40760ff4798160ae9403a2db4

SHA512
4fe99ece48a0e4bce453ea8a15c4ec137ab226699de935d6812ef5bc110bb57d9245cf746ff4817b9d61513844b839563f673fad441d6e932405c6801d9b1695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
641ee012456d37ab50b1a9dd6f1a1016

SHA1
005ab51eee21ce90392002f69bb3ff43bb950867

SHA256
4e184d6605934896c8247d3ad3515ef5736a808459333d8f2d38217a3404bf08

SHA512
0e410d3694487f1077f56160c248c8958d01401929502d9a20c940ab00a6fba6c60d475b68be30ddb26a01a91711214bdd5f0b11de233676989c90e235929015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1adc82aa8146fa5ab025907e50c829e

SHA1
be8da1c2bd321f013b69a2205a993c63cb3bc6c8

SHA256
6d41ebaa1ac509b79ae0ab9ffc51db40751a1653b9d8ac0bab64f11bcc942a2d

SHA512
0364f8b3bb6b818f29f37557d4df7f7d3ba1115cfae5848ada67cc1a7fa19d33c238d600667e0ee020a1e887b00330d7ef1f0b5fd3eea6cb3458172d730f0219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3be574e8d81a808f2adcb3d89160b5f5

SHA1
abd1f5527a875c07d68c5b2bd1172bbbdd69ea36

SHA256
4c63ff67fe2ec2804d664a5d4146f67a5fac017b1b1f4cc7ac531268de81d95c

SHA512
e078dd94fc3e997292cd3612b81b73d7cdb84a897018d08c8bc6b3a34cb04222b68276f41ff395028df060fbc9d138aca7c309b7ba34f3350d226b1bca2dbbc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cfd3941c2519d1760ca3322c162c307

SHA1
39a18ce1c59ae3360f00daf9e38b39f80e2e3db4

SHA256
901cf367b81ec4bf8cd377eaf6487682895a4b1a5e1754d700dd498587d47c76

SHA512
59cd51bc0f9c67a7ecaa9425d3aca26f9bf712e073377c1b30aec72260b89005aff6fb5f38a8c5cf0b3606bee92378a09615778f36b2052ba1420ba158248018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1709023f760231d3151e995f6dbef3aa

SHA1
25d47b9629049569ef4e6e9d36423038dd1ca1bc

SHA256
8223f6dd3c0dfa667c223ce3d3183e378a7cce12e7c6e10af9a523d441b08931

SHA512
d9337c6270e735596b8c60924b748e39755aa8941701e37dab4423a414cc3bb38247684ccfb5419aed5fd07f923c8d35be7a6079046c1c8b3cc16283b9d9cffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c50b02b659e6e71e4d8c62481cc58347

SHA1
3bdd906cb91c3688462f9bf3847ad48eb8d8a714

SHA256
7ff33ee44f052ec04455da732eb6c8193171488fea5bd2acc6d7861a7fcb3746

SHA512
3f376f00253df5f218986cb1d2fa7d3c773f21b2d857f479b8f461126d44eb31b7f89c215746b187d9deaf1088a77dce51ae0a626c08352ab8bff435dcdcf807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43a6e6bff8a4776d404eddecf29e16f2

SHA1
2e7877b51f0cef4f34560895fadbc7a6e5c14dc3

SHA256
b4e4c00b7d5000274ab41a620e4ccd2b690c1c0c2c6eed8bb53912298ffeffc9

SHA512
2a350f794d0f8fdca74e58ee8be5c701795ba6dcdbddf94fff493cd6d1054a33a7460424cbfbdab36d652655197f9decf3b2a945d6dc07f2a6a4a222919fe5b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be33bd770b88211aa2ffedc2d3b3333a

SHA1
5f44088b0979bf897a5b2c5b60ae0e70818d5154

SHA256
b458106bab9b2bb20dcbd1bc9d9ed55c42d23ea5c1d22390f9e1d646f237bc07

SHA512
f63e859535830bb8d5fcae88c6f31683a7fdb6baf1afe8f31b682360e50281241725bd48643f23b833684c5fd9624046ac36f3cca3f55815d8ec4bbe668c5ca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f84910873e20420e9c1bd68023aa250

SHA1
e27f1b52c07cca0fed671f8a113a07ae0143ed1b

SHA256
3317da1fef539e26a1aa805222fd797f68efa01a61f7bb6eaf9b9babd7222db2

SHA512
ffc53ad04459af513c05b554b75820705196bafb298ea92e528ad2078b0b2b30ba18c3533fac0592563fd7323547af6c2c53f5811e20dfd1a914aad9972e7745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b606d189afbe980f629f9d8bd1e1e75

SHA1
b603871dcb3f1628716a069617fbfb5d550a8102

SHA256
f3488508c0e2729011e4fa4af99a25fd460db8939cc21e6f58806c3773417199

SHA512
e8897101c38180e4be9186cfbaeba2d4c565ee9b5dc6b7ac02370404818cadbfb965e7a3460859082f490ee65e99652b5e0128d88e311ec1807adf9f3ac312be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bf60d196b11e85eba51696630b59ae05

SHA1
809f68ae256cfab806ef649e82e9c412c54732a5

SHA256
ae585a796faa1a660b94c8731d8185be7b7e3e8aba04159a842935fe867c24bb

SHA512
caaf13d0081acdf5634dd110b6748274b37830ebb5c12ae2b6da3a562245e50d9c44562bc4a6848a32210a6edec386345b456ca00f62fbb0aa09d4f9abc0fa6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\90UEV4PR\s3.amazonaws[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z8d0nzh\imagestore.dat

Filesize
5KB

MD5
ac1040aa3d12ebc4b42d3cb0c0aa2218

SHA1
3fd924fb18bafaf8db0a761503ae622910809b83

SHA256
e99b70f5fb1e491bde1d5f2e2ea5d3764064a58691ae8aa5dd95cc47b3d2b669

SHA512
ba76f3c0135df18eb79f2bebf8fffc37def84460cf445ee2eb1a522ee94d5b0fb573e502ee6a466e84282fc00dc20e98874758f6ac64a4d5db636a4b1e521532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\favicon[1].ico

Filesize
5KB

MD5
f6dd4d16a7af2e5a74b4b67b1140971c

SHA1
79fa891338c7944a94f84cc51c2ca3d4be1d0278

SHA256
84dde9e416a1c460c177c9379064f9c629d2527b53335c01d681b71cd0039ba1

SHA512
4241ac9f5e9b4007a71d820c4dffadca64481f6f084ecaa3d0cfbc2a25ec77006117af58a07a4ccf4a1f154868358d5482a614e9c1e21ad02ac9f5337c874118

Download Submit
C:\Users\Admin\AppData\Local\Psiphon3\psicash\psicashdatastore.prod

Filesize
4B

MD5
5ad5cc4d26869082efd29c436b57384a

SHA1
693dad7d164d27329c43b1c1bff4b271013514f5

SHA256
c5c24f7ca1c946fa4dfd44407409c8e11ec6e41f0e1c7c45bf8381b42afb31f1

SHA512
36efc511a98e53031d52dacdd40292a46fe5eab0194a0e9512f778f88b84fac5aac1eebb6e281c44e40ef2ddc3cdea41df7f5a50e4024cd86c087ed909fe8629

Download Submit
C:\Users\Admin\AppData\Local\Psiphon3\psicash\psicashdatastore.prod.2.commit

Filesize
115B

MD5
918c3796d0fc6f1e23e1f23fe949460e

SHA1
c45d5dd4570999a548f077f951a36b0ecd3e7ba2

SHA256
25c59206a04695e7640f7e099f683c5b1d7435af340c6f7bf7170ccce2d17061

SHA512
0f00c67a47704f55f0fed85c0d4e1053d3802f1fec720deef289bbb6a443ad602a12f4c468d60085132799e0f05125a579bfa6a2c00ba890e4f7a9ad54d2a42f

Download Submit
C:\Users\Admin\AppData\Local\Psiphon3\psicash\psicashdatastore.prod.2.commit

Filesize
252B

MD5
382aca3c270300bda43cf838b6661e6c

SHA1
b95e3f9628da1d3ede49028711f4a3c9c74337a4

SHA256
0fc41cfbd18b4747810ff85d856d37dd2b1279760c431fdad32041226623314d

SHA512
8e4bb3ee56feefa7fb8aef61b0851b4259017c04468878f3e8f11fd7a45c84a324122af5a31ba59caf1c494120df65802c0e849bb0529af10f9f613a2f2e7e04

Download Submit
C:\Users\Admin\AppData\Local\Psiphon3\psicash\psicashdatastore.prod.2.commit

Filesize
274B

MD5
35a587eddd04019c05cb9a4ef48b54f3

SHA1
11ff487f0042d87922c503b0ea266e338cb77f8c

SHA256
2d8bc9f99505e2943ab6d7010b730ec7f8431b57edc9a3ce103261f8cfd18c59

SHA512
2f4c3eea699f827f7002cb8967a556807699a1e3841beebe0de902b6b0497242b6a6be6e5404a3d5012052af491fe790d03197bc4415eee108576485ba5577d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC46A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC528.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\16f872e00ebafc31e7607997ef03eedef69f603a96ae7e8acc1009a8dd19c602.exe

Filesize
9.2MB

MD5
863d635522818cc98d3c1c4975c27577

SHA1
488501df4f7a9407d889826315716bd3beb2317b

SHA256
bc7025f7e9fb77cd61508c34a9cd7d0fad2efd8635be801ccca34ba3a6038348

SHA512
cc694e4cc67c0ccb8af1ab9eb6bb72420eea0d91053368ef9ef02f563601041f5f22b7716b3c66f542d4265ce8f371528172211d984388880dd007237f8a10f9

Download Submit
memory/1100-142-0x0000000002C90000-0x000000000481C000-memory.dmp

Filesize
27.5MB

Download
memory/1100-143-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1100-141-0x0000000002C90000-0x000000000481C000-memory.dmp

Filesize
27.5MB

Download
memory/1100-488-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1100-444-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1100-15-0x0000000002C90000-0x000000000481C000-memory.dmp

Filesize
27.5MB

Download
memory/1100-14-0x0000000002C90000-0x000000000481C000-memory.dmp

Filesize
27.5MB

Download
memory/1592-144-0x0000000000850000-0x00000000023DC000-memory.dmp

Filesize
27.5MB

Download
memory/1592-16-0x0000000000850000-0x00000000023DC000-memory.dmp

Filesize
27.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads