6a11d0ca2303bffe42e568f32c1adefd70742379ce2639f2ee2a437051ac9c13

Analysis

max time kernel
24s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
安装助手_1.0.9.exe
Size 5.4MB
Sample241223-en3wzawkcn
SHA256 6a11d0ca2303bffe42e568f32c1adefd70742379ce2639f2ee2a437051ac9c13
MD5 ff430c30f7b9f0550f6b68dcc709c55b
SHA1 a47d3d79a05d232d45aadd14045765521cfd8431
SHA512 44cc03072673a2a2953899e75f0445d11cb3a005a4dd43091ab2fac27517ab2661562dca1a4b96c515d2a7c33d56b91fea5c98e2b7e5cbf3d1134ca69eb6da0b
SSDEEP 98304:XwREoZqR+RuRmr4qNb1R088uArvgOv5EcNQ+DidMwZgf:lvRz1qNz/ts
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3592	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	安装助手_1.0.9.tmp

Executes dropped EXE 4 IoCs

pid	Process
672	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp
4704	7zr.exe
2984	7zr.exe

Loads dropped DLL 1 IoCs

pid	Process
2960	安装助手_1.0.9.tmp

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2960	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\is-1IFJ5.tmp	安装助手_1.0.9.tmp
File created	C:\Program Files (x86)\Windows NT\task.xml	安装助手_1.0.9.tmp
File created	C:\Program Files (x86)\Windows NT\locale.bin	7zr.exe
File opened for modification	C:\Program Files (x86)\Windows NT\locale.bin	7zr.exe
File created	C:\Program Files (x86)\Windows NT\locale7.bin	7zr.exe
File opened for modification	C:\Program Files (x86)\Windows NT\locale2.bin	7zr.exe
File created	C:\Program Files (x86)\Windows NT\locale4.dat	安装助手_1.0.9.tmp
File created	C:\Program Files (x86)\Windows NT\locale7.dat	安装助手_1.0.9.tmp
File created	C:\Program Files (x86)\Windows NT\locale2.bin	7zr.exe
File created	C:\Program Files (x86)\Windows NT\locale3.bin	7zr.exe
File opened for modification	C:\Program Files (x86)\Windows NT\locale7.bin	7zr.exe
File created	C:\Program Files (x86)\Windows NT\locale.dat	安装助手_1.0.9.tmp
File created	C:\Program Files (x86)\Windows NT\locale3.dat	安装助手_1.0.9.tmp
File created	C:\Program Files (x86)\Windows NT\tProtect.dll	7zr.exe
File opened for modification	C:\Program Files (x86)\Windows NT\locale3.bin	7zr.exe
File created	C:\Program Files (x86)\Windows NT\locale4.bin	7zr.exe
File created	C:\Program Files (x86)\Windows NT\is-I3451.tmp	安装助手_1.0.9.tmp
File created	C:\Program Files (x86)\Windows NT\hrsw.vbc	安装助手_1.0.9.tmp
File opened for modification	C:\Program Files (x86)\Windows NT\hrsw.vbc	安装助手_1.0.9.tmp
File created	C:\Program Files (x86)\Windows NT\res.dat	安装助手_1.0.9.tmp
File created	C:\Program Files (x86)\Windows NT\INIT.DAT	安装助手_1.0.9.tmp
File created	C:\Program Files (x86)\Windows NT\7zr.exe	安装助手_1.0.9.tmp
File opened for modification	C:\Program Files (x86)\Windows NT\locale4.bin	7zr.exe
File created	C:\Program Files (x86)\Windows NT\locale2.dat	安装助手_1.0.9.tmp
File opened for modification	C:\Program Files (x86)\Windows NT\tProtect.dll	7zr.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1020	sc.exe
4788	sc.exe
2908	sc.exe
2080	sc.exe
1048	sc.exe
4452	sc.exe
2684	sc.exe
4124	sc.exe
3148	sc.exe
3500	sc.exe
3980	sc.exe
1316	sc.exe
1496	sc.exe
2924	sc.exe
3820	sc.exe
4120	sc.exe
2996	sc.exe
1588	sc.exe
1832	sc.exe
4668	sc.exe
4376	sc.exe
4260	sc.exe
208	sc.exe
2604	sc.exe
4116	sc.exe
3816	sc.exe
4180	sc.exe
1660	sc.exe
4740	sc.exe
3632	sc.exe
3388	sc.exe
2144	sc.exe
2880	sc.exe
616	sc.exe
220	sc.exe
4508	sc.exe
1148	sc.exe
2068	sc.exe
4328	sc.exe
4360	sc.exe
1936	sc.exe
3840	sc.exe
3940	sc.exe
3820	sc.exe
5056	sc.exe
4536	sc.exe
216	sc.exe
4308	sc.exe
4320	sc.exe
648	sc.exe
4568	sc.exe
616	sc.exe
4408	sc.exe
3624	sc.exe
4824	sc.exe
4452	sc.exe
3088	sc.exe
2244	sc.exe
2592	sc.exe
1056	sc.exe
5096	sc.exe
3456	sc.exe
4344	sc.exe
1112	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	安装助手_1.0.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	安装助手_1.0.9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	安装助手_1.0.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	安装助手_1.0.9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "59"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3592	powershell.exe
3592	powershell.exe
2960	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp
2960	安装助手_1.0.9.tmp

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	2960	安装助手_1.0.9.tmp
Token: SeRestorePrivilege	4704	7zr.exe
Token: 35	4704	7zr.exe
Token: SeSecurityPrivilege	4704	7zr.exe
Token: SeSecurityPrivilege	4704	7zr.exe
Token: SeRestorePrivilege	2984	7zr.exe
Token: 35	2984	7zr.exe
Token: SeSecurityPrivilege	2984	7zr.exe
Token: SeSecurityPrivilege	2984	7zr.exe
Token: SeShutdownPrivilege	2628	shutdown.exe
Token: SeRemoteShutdownPrivilege	2628	shutdown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	安装助手_1.0.9.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1788	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 672	3456	安装助手_1.0.9.exe	83
PID 3456 wrote to memory of 672	3456	安装助手_1.0.9.exe	83
PID 3456 wrote to memory of 672	3456	安装助手_1.0.9.exe	83
PID 672 wrote to memory of 3592	672	安装助手_1.0.9.tmp	84
PID 672 wrote to memory of 3592	672	安装助手_1.0.9.tmp	84
PID 672 wrote to memory of 2324	672	安装助手_1.0.9.tmp	86
PID 672 wrote to memory of 2324	672	安装助手_1.0.9.tmp	86
PID 672 wrote to memory of 2324	672	安装助手_1.0.9.tmp	86
PID 2324 wrote to memory of 2960	2324	安装助手_1.0.9.exe	87
PID 2324 wrote to memory of 2960	2324	安装助手_1.0.9.exe	87
PID 2324 wrote to memory of 2960	2324	安装助手_1.0.9.exe	87
PID 4336 wrote to memory of 2244	4336	cmd.exe	89
PID 4336 wrote to memory of 2244	4336	cmd.exe	89
PID 2960 wrote to memory of 4704	2960	安装助手_1.0.9.tmp	91
PID 2960 wrote to memory of 4704	2960	安装助手_1.0.9.tmp	91
PID 2960 wrote to memory of 4704	2960	安装助手_1.0.9.tmp	91
PID 2960 wrote to memory of 2984	2960	安装助手_1.0.9.tmp	93
PID 2960 wrote to memory of 2984	2960	安装助手_1.0.9.tmp	93
PID 2960 wrote to memory of 2984	2960	安装助手_1.0.9.tmp	93
PID 1788 wrote to memory of 648	1788	cmd.exe	96
PID 1788 wrote to memory of 648	1788	cmd.exe	96
PID 4212 wrote to memory of 5056	4212	cmd.exe	99
PID 4212 wrote to memory of 5056	4212	cmd.exe	99
PID 1496 wrote to memory of 4552	1496	cmd.exe	102
PID 1496 wrote to memory of 4552	1496	cmd.exe	102
PID 1092 wrote to memory of 1020	1092	cmd.exe	105
PID 1092 wrote to memory of 1020	1092	cmd.exe	105
PID 4516 wrote to memory of 3332	4516	cmd.exe	108
PID 4516 wrote to memory of 3332	4516	cmd.exe	108
PID 4992 wrote to memory of 3632	4992	cmd.exe	111
PID 4992 wrote to memory of 3632	4992	cmd.exe	111
PID 1068 wrote to memory of 2592	1068	cmd.exe	114
PID 1068 wrote to memory of 2592	1068	cmd.exe	114
PID 4504 wrote to memory of 4568	4504	cmd.exe	117
PID 4504 wrote to memory of 4568	4504	cmd.exe	117
PID 2064 wrote to memory of 616	2064	cmd.exe	120
PID 2064 wrote to memory of 616	2064	cmd.exe	120
PID 4528 wrote to memory of 4116	4528	cmd.exe	123
PID 4528 wrote to memory of 4116	4528	cmd.exe	123
PID 4268 wrote to memory of 4344	4268	cmd.exe	126
PID 4268 wrote to memory of 4344	4268	cmd.exe	126
PID 1144 wrote to memory of 2996	1144	cmd.exe	129
PID 1144 wrote to memory of 2996	1144	cmd.exe	129
PID 1424 wrote to memory of 3640	1424	cmd.exe	132
PID 1424 wrote to memory of 3640	1424	cmd.exe	132
PID 4808 wrote to memory of 1112	4808	cmd.exe	135
PID 4808 wrote to memory of 1112	4808	cmd.exe	135
PID 3268 wrote to memory of 2028	3268	cmd.exe	138
PID 3268 wrote to memory of 2028	3268	cmd.exe	138
PID 3592 wrote to memory of 3388	3592	cmd.exe	141
PID 3592 wrote to memory of 3388	3592	cmd.exe	141
PID 2756 wrote to memory of 1056	2756	cmd.exe	144
PID 2756 wrote to memory of 1056	2756	cmd.exe	144
PID 2880 wrote to memory of 4508	2880	cmd.exe	147
PID 2880 wrote to memory of 4508	2880	cmd.exe	147
PID 3084 wrote to memory of 1588	3084	cmd.exe	150
PID 3084 wrote to memory of 1588	3084	cmd.exe	150
PID 3708 wrote to memory of 4408	3708	cmd.exe	153
PID 3708 wrote to memory of 4408	3708	cmd.exe	153
PID 672 wrote to memory of 4788	672	cmd.exe	156
PID 672 wrote to memory of 4788	672	cmd.exe	156
PID 4512 wrote to memory of 2908	4512	cmd.exe	159
PID 4512 wrote to memory of 2908	4512	cmd.exe	159
PID 2128 wrote to memory of 4360	2128	cmd.exe	162

C:\Users\Admin\AppData\Local\Temp\安装助手_1.0.9.exe
"C:\Users\Admin\AppData\Local\Temp\安装助手_1.0.9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\is-I8JVK.tmp\安装助手_1.0.9.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-I8JVK.tmp\安装助手_1.0.9.tmp" /SL5="$60248,4753292,845824,C:\Users\Admin\AppData\Local\Temp\安装助手_1.0.9.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\安装助手_1.0.9.exe
    "C:\Users\Admin\AppData\Local\Temp\安装助手_1.0.9.exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\is-0N4QV.tmp\安装助手_1.0.9.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-0N4QV.tmp\安装助手_1.0.9.tmp" /SL5="$70246,4753292,845824,C:\Users\Admin\AppData\Local\Temp\安装助手_1.0.9.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Program Files (x86)\Windows NT\7zr.exe
        
        7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
    - - C:\Program Files (x86)\Windows NT\7zr.exe
        
        7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c shutdown -f -r -t 00
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
      - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -f -r -t 00
        6⤵
        
        PID:1196

C:\Windows\system32\cmd.exe
cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\system32\sc.exe
  sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
  2⤵
  - Launches sc.exe
  PID:2244

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:648

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:5056

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:4552

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1020

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:3332

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3632

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2592

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4568

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:616

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4116

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4344

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2996

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:3640

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1112

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2028

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3388

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1056

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4508

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1588

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4408

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4788

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2908

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4360

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4660
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2144

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2980
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:3904

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4164
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1832

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1848
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2328

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4088
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3624

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4448
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4452

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3148
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4536

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3632
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4668

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:884
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2684

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2356
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1936

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4440
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:5096

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1660
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:216

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4680
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2080

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3444
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4376

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4848
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:4996

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3060
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2880

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1324
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1308

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2380
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4260

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4040
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4824

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1420
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3820

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1048
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1148

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2980
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2776

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2540
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2604

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4212
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4124

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4688
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1496

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4748
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:4448

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4916
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3148

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:5100
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3816

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:5084
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4308

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3772
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:616

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2340
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:4116

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1660
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2068

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4680
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:556

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:436
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3500

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2772
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:3956

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1248
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4328

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4768
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3840

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:184
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3456

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1460
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4120

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4956
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1048

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1940
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4320

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1832
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:944

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2328
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1316

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3044
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1496

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2504
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4452

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4992
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3980

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2904
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3088

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:980
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2684

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2512
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:220

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1756
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1660

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4712
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2600

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:4880
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4740

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3516
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1836

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2880
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2924

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1300
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:4180

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:5092
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3940

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2168
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:208

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3192
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3820

C:\Windows\system32\cmd.exe
cmd /c start shutdown -f -r -t 00
1⤵
PID:440
- C:\Windows\system32\shutdown.exe
  shutdown -f -r -t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2628

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3896855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zr.exe

Path C:\Program Files (x86)\Windows NT\7zr.exe
Size 811KB
SHA256 ba1ec2c30212f535231ebeb2d122bda5dd0529d80769495ccfd74361803e3880
MD5 84dc4b92d860e8aea55d12b1e87ea108
SHA1 56074a031a81a2394770d4da98ac01d99ec77aad
SHA512 cf3552ad1f794582f406fb5a396477a2aa10fcf0210b2f06c3fc4e751db02193fb9aa792cd994fa398462737e9f9ffa4f19f095a82fc48f860945e98f1b776b7
SSDEEP 24576:A48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Ae71MzuiehWIKxZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

locale.bin

Path C:\Program Files (x86)\Windows NT\locale.bin
Size 55KB
SHA256 3ff34db386f861828a302e5a4ad3e57409caa8d4ccf5c867f80c2c8b514af30d
MD5 db0ace7aa74daa24bb781119c3c869ae
SHA1 07a3730409afb5070ec735425e77b492b6eba129
SHA512 8fdbb6d6d195ab1ee949dbd855d4e6b1e58eeff7191d667e9a8737c27a2ed0326af905496cc61156fe48b2443fa1846de668c5630f200e3408981b3ab439395c
SSDEEP 1536:MsEZo4RLSOELwdAAOTXo+Pqyq5P5J74UmnNap/FOtP08J:8y4RLddAAOTXoKqZZQn1
MD5 SHA1 SHA512 SSDEEP

Submit Download

locale2.bin

Path C:\Program Files (x86)\Windows NT\locale2.bin
Size 55KB
SHA256 e834d26d571776c889e2d09892c6e562ea62cd6524d8fc625e6496a1742f5dbb
MD5 cea69f993e1ce0fb945a98bf37a66546
SHA1 7114365265f041da904574d1f5876544506f89ba
SHA512 4bcbb5ad50446cd4fad5ed3c530e29cc9dd7ddcb7b912d7c546af8ccf7da74bc1eec397846bfb97858babc9aa46bb3f3d0434f414bbc3b15b9fdbb7bf3ed59f9
SSDEEP 1536:crCPEbYP46GiC3q6cGOlLvjmS9UWgvy/F2QFtTVAe:iCIR913q8wjmS9bhKe
MD5 SHA1 SHA512 SSDEEP

Submit Download

locale3.bin

Path C:\Program Files (x86)\Windows NT\locale3.bin
Size 31KB
SHA256 4e5c193d58b43630e16b6e86c7e4382b26c9a812d6d28905dd39bc7155febee1
MD5 8622fc7228777f64a47bd6c61478add9
SHA1 9a7c15f341835f83c96da804dc1e21fda696bb56
SHA512 71f31079b6c3ce72bc7238560b2cbd012a0285b6a5ac162b18eae61a059dd3b8dbcf465225e1fb099a1e23ed7bddf0aae4ed7c337a10dc20e0feec4bc73c5441
SSDEEP 768:rzwmoD5r754TWCxhazPt9GNgRYpSj3PsQ4yVb595nQ/:vwmolXaT9abVzP1TC
MD5 SHA1 SHA512 SSDEEP

Submit Download

locale3.dat

Path C:\Program Files (x86)\Windows NT\locale3.dat
Size 31KB
SHA256 7b7eb1d44ed88e7c19a19cedaa25855f6800b87ec7e76873f3ea4d6a65daa25f
MD5 ce6034afc63bb42f4e0d6cd897dfbcb8
SHA1 49e6e67eb36fe2ccaa42234a1dbb17aa2b1c7cc0
SHA512 7801fa33c19d6504ff2d84453f4bb810fd579cb0c8772871f7cc53e90b835114d0221224a1743c0f5aae76c658807cc9b4ec3bec2cad4ab8c3fd03203daa7cf0
SSDEEP 768:jh43RfBLJT55mgLMoqX3gX/i69sXCuWegxJr8qF88M:qhj+I7qCKNSegPnFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

locale4.bin

Path C:\Program Files (x86)\Windows NT\locale4.bin
Size 73KB
SHA256 87a341b968b325090ef90dfb6d130ed0a1550a1ebde65b1002e401f1f640854a
MD5 950338d50b95a25f494ee74e97b7b7a9
SHA1 f56a5d6c40bc47869a6ae3bc5217d50ea3fc1643
SHA512 9a6cc00276564dde23d4caba133223d31d9ddd06d8c5b398f234d5ce03774ed7b9c7d875543e945a5b3db2851ec21332fe429a56744a9cc2157436400793ff83
SSDEEP 1536:x2PlxAOr0Y07RqyjjkFThaVNwDsKsNFBrFYek36pX4MDVuPFOnfIId+:QAOrf07RHjkFThaVGMLF3hNDcPFOn5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

locale7.bin

Path C:\Program Files (x86)\Windows NT\locale7.bin
Size 29KB
SHA256 9818febde34d7e9900eb1c7a32983ca60c676be941e2bc1ed9fbd5a187c6f544
MD5 2c3e0d1fb580a8f0855355cc7d8d4f7a
SHA1 177e4a0b7c4bc8ace0f46127398808e669222515
SHA512 b9410fc8f5be02130d50e7389f9a334dd2f2a47694e88fbb9fb4561bd3296f894369b279546eebb376452df795c39d87a67c6ee84c362f47fa19cf4c79e5574e
SSDEEP 768:e7fyvDZi63BuPi2zBBMqUp6fJzwyQb91SPlssLK4:AfKNiG/2vMx6fJzwVb2tss7
MD5 SHA1 SHA512 SSDEEP

Submit Download

res.dat

Path C:\Program Files (x86)\Windows NT\res.dat
Size 244KB
SHA256 187bcfd1e40e2df985e8f3456ecc94347c608c8151bf7f1a4524d66b118a7b60
MD5 7a1992bf55b34786e192e7ff0e870b6c
SHA1 cf5e5eb0c9133a9e6162731440462b88191f4672
SHA512 48792b91d46d070a6b4d97d072ccf302452c163a5576d419398fad3d958adf19b5739bc026068984c149f20051cbeb0dab91eff47468e6ad7ebeb2b08003f29d
SSDEEP 6144:BBfinFeH/n/oxa9p5nKMF7W9uvN/jl3eTYjg0c+YRRbMQL:BBfiFePQxa9pFhYmN/S0rgRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_fnxmp323.hlq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fnxmp323.hlq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

update.vac

Path C:\Users\Admin\AppData\Local\Temp\is-F9HOE.tmp\update.vac
Size 3.4MB
SHA256 05184064fb017025e0704d75d199bae02ebbd30ae4d76fb237df9596ce6450aa
MD5 1d1464c73252978a58ac925ece57f0fb
SHA1 30e442be965f96f3eb75a3abdb61b90e5a506993
SHA512 40165b34d6bc63472c3874aac1fb25b19880f5dfe662f672181728732dc80503a64ef4a8058a410755a321d6bdb7314387464dd8243d6e912f37d5032177928a
SSDEEP 49152:OLI2LSDJWhsk/42oQ6C+NkdkcQdhjee71MzuiehWIKxZUQjOlwz+cxtVI8q29Zlc:OLVLAJG42oaPQdhCe71MzSRsyo29Al
MD5 SHA1 SHA512 SSDEEP

Submit Download

安装助手_1.0.9.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-I8JVK.tmp\安装助手_1.0.9.tmp
Size 3.2MB
SHA256 43d9f1fa3bda81c618cc23fbb4e9d8551305af0090a3d452c4070f938f6bcfac
MD5 9902fa6d39184b87aed7d94a037912d8
SHA1 f5d8470acf5dff81c6d3364a8943b24e3db48d95
SHA512 bc97e2c379c464f821af0e38630db65165f4e91a1105a3c7dabcc5e61cc9eaab1522ac82e749aa4fefc5a9e21a295a0a59cfe99d6bc3980f9c89f00af5b8cf75
SSDEEP 98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/672-31-0x0000000000850000-0x0000000000B93000-memory.dmp

Download

memory/672-6-0x0000000000850000-0x0000000000B93000-memory.dmp

Download

memory/672-25-0x0000000000850000-0x0000000000B93000-memory.dmp

Download

memory/2324-28-0x0000000000860000-0x000000000093C000-memory.dmp

Download

memory/2324-151-0x0000000000860000-0x000000000093C000-memory.dmp

Download

memory/2960-160-0x00000000002D0000-0x0000000000613000-memory.dmp

Download

memory/3456-33-0x0000000000860000-0x000000000093C000-memory.dmp

Download

memory/3456-0-0x0000000000860000-0x000000000093C000-memory.dmp

Download

memory/3456-2-0x0000000000861000-0x0000000000909000-memory.dmp

Download

memory/3592-24-0x00007FFEC8AE0000-0x00007FFEC95A1000-memory.dmp

Download

memory/3592-21-0x00007FFEC8AE0000-0x00007FFEC95A1000-memory.dmp

Download

memory/3592-20-0x00007FFEC8AE0000-0x00007FFEC95A1000-memory.dmp

Download

memory/3592-19-0x0000020B6F8A0000-0x0000020B6F8C2000-memory.dmp

Download

memory/3592-9-0x00007FFEC8AE3000-0x00007FFEC8AE5000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads