51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RippleSpoofer.exe
Size

15.6MB
MD5

76ed914a265f60ff93751afe02cf35a4
SHA1

4f8ea583e5999faaec38be4c66ff4849fcf715c6
SHA256

51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b
SHA512

83135f8b040b68cafb896c4624bd66be1ae98857907b9817701d46952d4be9aaf7ad1ab3754995363bb5192fa2c669c26f526cafc6c487b061c2edcceebde6ac
SSDEEP

393216:QAiUmWQEnjaa4cqmAa4ICSSF1a0HPRV8gtFlSiZh5ZlZ:bhnGhMAXSmHXFA+

Score

9^/10

discovery evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RippleSpoofer.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RippleSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RippleSpoofer.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/576-5-0x00000000011E0000-0x0000000002E60000-memory.dmp	themida
behavioral1/memory/576-6-0x00000000011E0000-0x0000000002E60000-memory.dmp	themida
behavioral1/memory/576-17-0x00000000011E0000-0x0000000002E60000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RippleSpoofer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
17	discord.com
18	discord.com
15	discord.com
16	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
576	RippleSpoofer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5669B3C1-BFE3-11EF-AB56-7227CCB080AF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500bb02df053db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b960000000002000000000010660000000100002000000057ef910f8b41ef82bff7236caf226b00173dda32825fa61283a426e491202f82000000000e800000000200002000000002b2f20bc91b6f62dc3725e425476198fec2374cffe31943c079871dca68c8f120000000d07a40b4c5cf2d3cefd3137cf3f5403a7140da85a81243e0841240708fdb969a400000001c71503661fdc1bbf4bcad7cba8244b43250bd8618709837b42342999e87eb24abf8f41b2cf0c793404053e89b8c769ee02880abfb98e90f666cb37d5086797a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000dda9be6d06a48ec0a9dbd04148e40f0b8aee497c898562ad81a206ad86a92162000000000e8000000002000020000000981daee9c9d0c87a0c143ae57888c8c2f46d8a358babd1d1d86595bd3e6d4c4790000000a38a15d709e7beaafff32e274f07b8700a25d59acdecebaa2b6df4cf6cd639db46af9e72510cda486754b9735fef8ea7abe6886cc4760c5a8a1a5421e3dcd6d80d89d20ae496f48944d17167db0c7c622dc3cc5009907cc2b085838ba87aaf7bda68b3718777079e4bb858121ed07bc844ea3b7a1a8f3189ad9c03bd8170010090973c0cc70bfc718ea848670e6420b8400000002d924da275a40eb83f8f485bb2eab218312108272566b099e4e876e83a3f45a4bbcd16da634a6d2f36c20f8aaa3cc72a56db83cf655c5ec36e34a3c2df9016f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440978728"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	576	RippleSpoofer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2844	576	RippleSpoofer.exe	31
PID 576 wrote to memory of 2844	576	RippleSpoofer.exe	31
PID 576 wrote to memory of 2844	576	RippleSpoofer.exe	31
PID 2844 wrote to memory of 2804	2844	iexplore.exe	32
PID 2844 wrote to memory of 2804	2844	iexplore.exe	32
PID 2844 wrote to memory of 2804	2844	iexplore.exe	32
PID 2844 wrote to memory of 2804	2844	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\RippleSpoofer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/Qt5NMSgdzU
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b7b8a891d052a7a552fc683c6c88f3f4

SHA1
d9ec405b21b2975fb8296eae4023286f98623995

SHA256
4bbecba23d26727db7171139d79a2998d2a09324fb199327cc9c82c16b2ab387

SHA512
96f6bb6fefe8cf043493ad5162b7942b4c266f6efd97e5c3e0927ebc0e452c28a97ceefa57797e54c282c6156aaca65eac9bb1615f091377929da999a321264c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb112b5c75660a36670d435e2d8a1c90

SHA1
002d6029bb16931a66957fe3b5ba04ceeab7e29d

SHA256
61f3e011e319d3c9f7b8d7763e426ff58a77bc630173c5067c8f484ac0cc84c8

SHA512
be90e99ce44face81fe33e67ac9b851527019992188fb89c12554b79e762f800a3329f0418d88d9c805dc70cbab8fae0926d73557d2f5c65cd3a628d4e3444b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1dc2d726851f0250abd225fd01dc88a

SHA1
a6c73f1c9fc32d88885bf26f784d8c08e2679881

SHA256
839f2763a1bd2a6c08d0d19ed55d6d947c74455864f0d88138458cbc42325e0a

SHA512
72aad53709669f7c17cd5d302655923b14134e1409ce0a9c6541a5654a8d4ff894f80d42dcceee00c45e22973a2f1a05de3116775773bf46f44af1c0b4735b7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96b206e4713f45d5037c84b4c72e147d

SHA1
b01abdf4c08f4837d2287fcc5d8c7185bea60373

SHA256
afc53595254c0fc8315d47fdd7d14d501d321bd641f1560f2d9663a727c4ba93

SHA512
ec6b4e57eeaad4030f4dde79f55b3da9c2c363f7868b340a89942fc94f3c3d6106a3b322c1531d0c83c7c988f15c3d5fc39a7a3a60c1aec8d8c4eade26dd7d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86893c4bdc11479dec1f4091b6008c5f

SHA1
214a24262645dbac173aebe8d3eb8b7b3a82eb93

SHA256
29bc24a4b29071404f03821c8f37115d45b763578c45032da4f0f90d9835e249

SHA512
45c5ec49be29e0b5a098445a3ae5c8b5d02e4d65bdb0fe334646c896f28823d1546848ea10b3448ac3aca315320ae7a27637842d50f96f1b87793dddc8714d33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1882fc21d23f8e1acffb4fd934342481

SHA1
ed4b8ecba90516b7148393be619ff3cd4343fe3a

SHA256
c4e007dc3dc724aeb3ab0b78a06780120a77e0af6926b7b03ad2ea6f4e9ae69d

SHA512
ad9985ee501fd8cb9dd3f494508f35fffa4e17c0472ed069a7fe6de3ed6eaac66fd347730cf04745f363ae82e49d53e4f1b4feb12f080a8b470fd03beb1f2f16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88753b0001afcbab92340c6053e0f37e

SHA1
6cfd991cb4dc1780b917ba2d4574e72c011c06f0

SHA256
4490ec0742239638a5cb965a021551b9984e275a8ad346bc00477329aa359637

SHA512
dfd4ec600b256257e78a5941c96f4acfc7dacf1afab9232b2b123c2bbfacc1d0dea463b6f51d0bd2b91bb2daf38b41da7fa5fb52e6ee233e223f03d87d67aa86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54eb01db2835048085c639d4776ed452

SHA1
8b6f59f11b82ac829f923cc61b9a0db5c95c8ee3

SHA256
6ed8c26568e4e74c92507e7185cfc9a885309a8e05ae541c58724c1f56463f89

SHA512
36916cecdd8ae0446c5c5a29b29956c9218a1e8ab692a5f2f3f2bcb49ba3337fdff77ec291da20f921110425f0f0a57c4adb86be8d1272651b4e06800e02db3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d524837999cda84ec3928a30f960af2

SHA1
9a9f40a15902eb5e85d6c1a1e306fc58ae183c93

SHA256
979c19e2fa83e01a07cabe1fe04c743dbbc47ad16a3eb100470472e337d7139c

SHA512
015a3afdcf12a485cb45fcb85477f0244758f3a64ddee06cc001eccacb3133f02bcaef8e59aa1351f44488b9722c8aebec27e32116037fe417691a2fa03b93d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
268b4dbe7c955821d5d2cd43da1827f3

SHA1
029c095752024b916912727214b6f112aeb4f522

SHA256
fb9fcf251029d48a23e588f2eb72851760d338834937c7c0778d3c5484bc424d

SHA512
59bce9ee0ca854ea80310a49ff9ab4d8466a776190610674c1f328a7df4528084558ee8d72c7c3a3da947381507e1ffa3564d5906812afea24af0c66f5aaa20f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
020197f13366708756df32c7f4e2f2c4

SHA1
a390c06a9db4ddf9aaba9a6f4af9a6c53f506666

SHA256
3e133c237cc6b3a37cf619fc080a782afe912b7929b3cdf6a01e613492699efb

SHA512
1b4830ce6b715df30dca397b35fe7c63e5ee07aaae54db220d93d04aa2ff8ae0c9623beb81b56e392d754d4d0537edb355af959dca0054fecc300c17450741d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed32318339c2fde90252d39b2de0c877

SHA1
efd2f01af48e284d4a631bf4d05004822c8f92f1

SHA256
3d08206325e01674ae486d024afb3e5da54fd176542f1eb87471fb76fead73aa

SHA512
51cceb0d19895a42ea0add796f41f445e8ed14de694570950a80dd356b55f6caf91c8241fa0ad4d0c9cdcfd6c4a3def38587b53340486b984bbb05904a28558a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3051442ba302283284c2db68dc22f507

SHA1
200a4f519bb597eac59278ac52500d8a651657ad

SHA256
38b080897eef20aa8135e06f8b77cff744c461345fbbaef35898be466689497c

SHA512
863c35c65196d061b080e4c8eb2c73720d4a26771fce295863e131dea695f56ea80f9369f3a13d41307aaf905801438bc20a6f7d5f7af5729a727efe769d7ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b493d4815185207bccaec5348184a778

SHA1
8f1edf0e146df7b8621ebbe5b0403aba97963108

SHA256
ca0e7fcd11a18968b42a8a0335cadd3e2f7525963cf11240158f118697030653

SHA512
716811ce6f89deb9524fdfc07155d035cb44f9bbcc1ed54cbe255e6108d4626671a9967b05613e6cf650e38a041e06f480a5cedf52f83402e49cdde544ccb30e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a20c73e902cfcaf292b1446115c78cb

SHA1
846cf2cecba5d3c163ec5684ed6cb6122e0b16a2

SHA256
af2ade0ba7d94a267f3f4c165f2a2d096ddd72f37b4f7bd9440b35d53d9e1b5f

SHA512
dce28e992671eb35b96cef4756d9707e273ba35a3a6b17b0db28117b0e9bd09216e2df1f5a57f1748e653d2bc360bf9b97d256d33c8f63d5ce1461597af3e2ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e196ebdd4e55d283bb856246d241dbf2

SHA1
71a905cc798ade1da6a09d7f99412966909c831b

SHA256
cbec47745ece79c2581b54d9a84e4fdf8acd3cb5f0c107f26f80084d7fd95f91

SHA512
a3a91c0f6b49fbfc69b3382643820ea544317137296fc1e0424d37e80438b272053b29b7208198f7c3b72977f5ada9356cf39689dd1b9aaad034671fb023bc70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7cff4162fbd2ce1fe0a7e392ea93cc6

SHA1
269c22ccdf007c3564462a0765befeed9b16ddfe

SHA256
14929d2747817b5d16b8509118748bfb146ea506410a5419326caeeb83893d6d

SHA512
f8ad2873f500efe60bfe8dfd68d6d979877345ca6769baf9bc4678c4c5a659cb7aaac025801b1ce7aed4f3c3703923214204f569bcddcdd700f3731e1678f349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c5364efd26b41f7a020ec7a06f487c4

SHA1
860084cc2c7af2a5589bc3f7ecc24a12709bba31

SHA256
ea7dd73b565012061104b4c04ec5d3c2130211829503c2329195436de3f9b117

SHA512
3be130b03d5db4480abc78433dea264633c872807706e16ab3d0f24c53b954c82fba95a81f0a526c3be25c72a00781a3c390f97ff7dc95d8e6561b06e0f1ca93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2700deab4e486f61f5da31f220cc887

SHA1
08a9d4d6d104be5566327e635431544fa53ad9ac

SHA256
8cb5f244d366eefd3a8349d16e01f3f33426d7ab1432de154a2b6f87be0de606

SHA512
cb0ad5eba133456f0c5c47d965ca9573106dd8895207010a69d6eccec8d3e46785e21de49d3bfd29c79a6e22260070ae1928ab9899ee6bdcff6e30f436465a38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cecbc111816596f70b05db9457c6a217

SHA1
d399150ff18d85832c3113018b31f9e833a314f2

SHA256
e158f745947e0cf8dad6e613b2b69692eb02b0d8fe3969853cefc1de314d1e47

SHA512
eef168db7dcc85e3d2d0461ef9b1d3204caa604e36b24b6b302157539ae63dbb9fa6a632cb1dc5c9f77223b023f73c7306aab997f0eb80880d9965db9c9e0448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aea7005c93ebef23b5d540fe80a553cd

SHA1
d023261568cfd393713777fd848fdcaf31d261ff

SHA256
8688114e795f0e50ae316f0c8756bb1f61b092a9476bf681e6d3f9d8c9a0d2d2

SHA512
f3c05b0cc2cbfb602996444a1c851528b50c3867e64ad5fc91e402365b3068e1879eed4bb3740771e8e9bff92035f3a5b77e71534e86c34f28c1701f0245ac68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a77d50d034f64ab6cf523629379b6e06

SHA1
dd8a2f2dffb49355411dc5537868424068b97e49

SHA256
50d174d9f43630591f56d028d7bec1afb880db357982b509634f4edd965dddc9

SHA512
230be93e9533b4c97c539ba325721da93b7521e2c757fdd542c52fcb1c5ea229a8e3683bd7f3ef98bf804d6f996005a20d3949b3cf8c23f9167cf331613ec201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
beea0872c642363ab3f1cd1bcd8497dc

SHA1
4e30a25fbbf1af7079d9fccdcafbff4e92bd9f07

SHA256
01d877dfadab6a1a01af34ea14e9623ebcbaccf7c240758545a912de245987ba

SHA512
44417954fe78cb002f8a79bfde53b2202cacbd7a79dba8717110b4b03f4a6cff3456bb7e54e62ed77d78a765a9e024f7e167e0662241427263f91f37e984d333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b14661dffe636c417bf52ecdb0f99b9c

SHA1
32e91c8736dd3cecbd4dffe4c2071549a7327dbc

SHA256
d29641fbf97343def890ad808b13d1cabf94b0ebc7f4583a69963d5249f2fe3b

SHA512
04da4a1155766ca553b7eb76842c239bd259d8fb63ab692ae440d75e967b20e50550ca2ca1f7e0ee595bc20635e114f33070f697c216882824df427809755321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z8d0nzh\imagestore.dat

Filesize
24KB

MD5
44752f2479038e04b26e939d8c1a5371

SHA1
4e27446956f5b60d7aa8018421b6a33f1531d557

SHA256
1d46856521e31ce9e4a8a3f44d34b9a29dfe4bf98479ef702dc5629b01366489

SHA512
cc2bba08d4e0285512349ef30dd4f26a72f04c733e2a5bb305c6f34d9d6388531e43a2727941286471713102a6c473cb3bee2306d33cddd4ceeeae379cc8404b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\favicon[1].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F0D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F10.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/576-12-0x000007FEFD670000-0x000007FEFD6DC000-memory.dmp

Filesize
432KB

Download
memory/576-9-0x000007FEFD670000-0x000007FEFD6DC000-memory.dmp

Filesize
432KB

Download
memory/576-14-0x000007FEFD670000-0x000007FEFD6DC000-memory.dmp

Filesize
432KB

Download
memory/576-0-0x00000000011E0000-0x0000000002E60000-memory.dmp

Filesize
28.5MB

Download
memory/576-17-0x00000000011E0000-0x0000000002E60000-memory.dmp

Filesize
28.5MB

Download
memory/576-11-0x00000000011E0000-0x0000000002E60000-memory.dmp

Filesize
28.5MB

Download
memory/576-10-0x0000000004A70000-0x0000000004B22000-memory.dmp

Filesize
712KB

Download
memory/576-16-0x000007FEFD670000-0x000007FEFD6DC000-memory.dmp

Filesize
432KB

Download
memory/576-8-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/576-6-0x00000000011E0000-0x0000000002E60000-memory.dmp

Filesize
28.5MB

Download
memory/576-5-0x00000000011E0000-0x0000000002E60000-memory.dmp

Filesize
28.5MB

Download
memory/576-4-0x000007FEFD670000-0x000007FEFD6DC000-memory.dmp

Filesize
432KB

Download
memory/576-2-0x000007FEFD670000-0x000007FEFD6DC000-memory.dmp

Filesize
432KB

Download
memory/576-1-0x000007FEFD683000-0x000007FEFD684000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads