38622c32cac325c68f2fbf7148255a9813e7caeb53e3b95ebea56a6da5cb22ba

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/12/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Whyet-4.9.exe
Size 20.2MB
Sample241229-sefa7stpfx
SHA256 38622c32cac325c68f2fbf7148255a9813e7caeb53e3b95ebea56a6da5cb22ba
MD5 f317c17035501aaad0abfaf9fba4c085
SHA1 f522fec1296c065cd4c3eaf52d1c4fbc26fd9f28
SHA512 147e484e12adf36e9c3a446b3a08af2c274e4acdff04b2eb5a3164771b3eb9c7e1f15858289b7c19eabc97f99d06936ead9ff94ce05f892af45d757ac65a9d08
SSDEEP 393216:OecgR96USu2VkX3mGZHoRJ3+j8yvn7lbt0lWL:kVHemGZMkT7lbt0YL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bootkit defense_evasion discovery evasion execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	oEimJsyy5o.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	oEimJsyy5o.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	oEimJsyy5o.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oEimJsyy5o.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oEimJsyy5o.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oEimJsyy5o.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	oEimJsyy5o.exe

Executes dropped EXE 3 IoCs

pid	Process
1636	irsetup.exe
1168	Process not Found
444	oEimJsyy5o.exe

Loads dropped DLL 4 IoCs

pid	Process
2948	Whyet-4.9.exe
1636	irsetup.exe
1168	Process not Found
1636	irsetup.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\ProgramData\\Program\\iusb3mon.exe"	oEimJsyy5o.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\ProgramData\\Program\\iusb3mon.exe"	oEimJsyy5o.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\ProgramData\\Program\\iusb3mon.exe"	oEimJsyy5o.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	oEimJsyy5o.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	oEimJsyy5o.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1888	powershell.exe
1796	powershell.exe
1604	powershell.exe
2356	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	oEimJsyy5o.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\product1\letsvpn-latest.exe	irsetup.exe
File opened for modification	C:\Program Files\product1\letsvpn-latest.exe	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oEimJsyy5o.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2948	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
444	oEimJsyy5o.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2728	powershell.exe
2728	powershell.exe
2560	powershell.exe
2560	powershell.exe
2652	powershell.exe
2652	powershell.exe
2060	powershell.exe
2060	powershell.exe
528	powershell.exe
528	powershell.exe
528	powershell.exe
528	powershell.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
1888	powershell.exe
1604	powershell.exe
1796	powershell.exe
2356	powershell.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
1932	powershell.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
1932	powershell.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe
444	oEimJsyy5o.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	528	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	1012	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1636	irsetup.exe
1636	irsetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1636	2948	Whyet-4.9.exe	31
PID 2948 wrote to memory of 1636	2948	Whyet-4.9.exe	31
PID 2948 wrote to memory of 1636	2948	Whyet-4.9.exe	31
PID 1636 wrote to memory of 2728	1636	irsetup.exe	32
PID 1636 wrote to memory of 2728	1636	irsetup.exe	32
PID 1636 wrote to memory of 2728	1636	irsetup.exe	32
PID 1636 wrote to memory of 2560	1636	irsetup.exe	34
PID 1636 wrote to memory of 2560	1636	irsetup.exe	34
PID 1636 wrote to memory of 2560	1636	irsetup.exe	34
PID 1636 wrote to memory of 2652	1636	irsetup.exe	36
PID 1636 wrote to memory of 2652	1636	irsetup.exe	36
PID 1636 wrote to memory of 2652	1636	irsetup.exe	36
PID 1636 wrote to memory of 2060	1636	irsetup.exe	38
PID 1636 wrote to memory of 2060	1636	irsetup.exe	38
PID 1636 wrote to memory of 2060	1636	irsetup.exe	38
PID 1636 wrote to memory of 528	1636	irsetup.exe	40
PID 1636 wrote to memory of 528	1636	irsetup.exe	40
PID 1636 wrote to memory of 528	1636	irsetup.exe	40
PID 1636 wrote to memory of 832	1636	irsetup.exe	44
PID 1636 wrote to memory of 832	1636	irsetup.exe	44
PID 1636 wrote to memory of 832	1636	irsetup.exe	44
PID 832 wrote to memory of 444	832	cmd.exe	46
PID 832 wrote to memory of 444	832	cmd.exe	46
PID 832 wrote to memory of 444	832	cmd.exe	46
PID 832 wrote to memory of 444	832	cmd.exe	46
PID 444 wrote to memory of 1888	444	oEimJsyy5o.exe	47
PID 444 wrote to memory of 1888	444	oEimJsyy5o.exe	47
PID 444 wrote to memory of 1888	444	oEimJsyy5o.exe	47
PID 444 wrote to memory of 1888	444	oEimJsyy5o.exe	47
PID 444 wrote to memory of 1796	444	oEimJsyy5o.exe	49
PID 444 wrote to memory of 1796	444	oEimJsyy5o.exe	49
PID 444 wrote to memory of 1796	444	oEimJsyy5o.exe	49
PID 444 wrote to memory of 1796	444	oEimJsyy5o.exe	49
PID 444 wrote to memory of 1604	444	oEimJsyy5o.exe	50
PID 444 wrote to memory of 1604	444	oEimJsyy5o.exe	50
PID 444 wrote to memory of 1604	444	oEimJsyy5o.exe	50
PID 444 wrote to memory of 1604	444	oEimJsyy5o.exe	50
PID 444 wrote to memory of 2356	444	oEimJsyy5o.exe	53
PID 444 wrote to memory of 2356	444	oEimJsyy5o.exe	53
PID 444 wrote to memory of 2356	444	oEimJsyy5o.exe	53
PID 444 wrote to memory of 2356	444	oEimJsyy5o.exe	53
PID 444 wrote to memory of 3052	444	oEimJsyy5o.exe	55
PID 444 wrote to memory of 3052	444	oEimJsyy5o.exe	55
PID 444 wrote to memory of 3052	444	oEimJsyy5o.exe	55
PID 444 wrote to memory of 3052	444	oEimJsyy5o.exe	55
PID 1604 wrote to memory of 1436	1604	powershell.exe	57
PID 1604 wrote to memory of 1436	1604	powershell.exe	57
PID 1604 wrote to memory of 1436	1604	powershell.exe	57
PID 1604 wrote to memory of 1436	1604	powershell.exe	57
PID 2356 wrote to memory of 2044	2356	powershell.exe	58
PID 2356 wrote to memory of 2044	2356	powershell.exe	58
PID 2356 wrote to memory of 2044	2356	powershell.exe	58
PID 2356 wrote to memory of 2044	2356	powershell.exe	58
PID 1796 wrote to memory of 2164	1796	powershell.exe	59
PID 1796 wrote to memory of 2164	1796	powershell.exe	59
PID 1796 wrote to memory of 2164	1796	powershell.exe	59
PID 1796 wrote to memory of 2164	1796	powershell.exe	59
PID 1888 wrote to memory of 2064	1888	powershell.exe	60
PID 1888 wrote to memory of 2064	1888	powershell.exe	60
PID 1888 wrote to memory of 2064	1888	powershell.exe	60
PID 1888 wrote to memory of 2064	1888	powershell.exe	60
PID 1636 wrote to memory of 1932	1636	irsetup.exe	61
PID 1636 wrote to memory of 1932	1636	irsetup.exe	61
PID 1636 wrote to memory of 1932	1636	irsetup.exe	61

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	oEimJsyy5o.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	oEimJsyy5o.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	oEimJsyy5o.exe

C:\Users\Admin\AppData\Local\Temp\Whyet-4.9.exe
"C:\Users\Admin\AppData\Local\Temp\Whyet-4.9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5655410 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\Whyet-4.9.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3290804112-2823094203-3137964600-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"msmpeng.exe\"));
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"securityhealthsystray.exe\"));
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"mpcopyaccelerator.exe\"));
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"MpDefenderCoreService.exe\"));
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $mypid=(Get-WmiObject -Query 'select ParentProcessId from Win32_Process where ProcessId=1636').ParentProcessId;if($mypid){Stop-Process -Id $mypid -Force;}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:528
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start "title" "C:\Users\Public\Documents\UKeuWn6t\oEimJsyy5o.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:832
  - - C:\Users\Public\Documents\UKeuWn6t\oEimJsyy5o.exe
      "C:\Users\Public\Documents\UKeuWn6t\oEimJsyy5o.exe"
      4⤵
      UAC bypass
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:444
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -C "Set-Content -Value @('[Unicode]','Unicode=yes','[Version]','signature=\"$CHICAGO$\"','Revision=1','[Privilege Rights]','SeDebugPrivilege = *S-1-5-18','[File Security]','\"C:\ProgramData\Program\",0,\"D:AR(D;OICI;DTSDRCWD;;;WD)\"') -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.inf')) -Encoding Unicode; secedit.exe /configure /db ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.sdb')) /cfg ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.inf')) /overwrite /log ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.log')) /quiet; Remove-Item -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.*')) -Force;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1888
      - C:\Windows\SysWOW64\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log /quiet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -C "Set-Content -Value @('[Unicode]','Unicode=yes','[Version]','signature=\"$CHICAGO$\"','Revision=1','[Privilege Rights]','SeDebugPrivilege = *S-1-5-18','[File Security]','\"C:\ProgramData\Data\",0,\"D:AR(D;OICI;DTSDRCWD;;;WD)\"') -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege3.inf')) -Encoding Unicode; secedit.exe /configure /db ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege3.sdb')) /cfg ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege3.inf')) /overwrite /log ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege3.log')) /quiet; Remove-Item -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege3.*')) -Force;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1796
      - C:\Windows\SysWOW64\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege3.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege3.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege3.log /quiet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2164
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -C "[IO.File]::WriteAllBytes([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.inf'), [Convert]::FromBase64String('//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA=')); secedit.exe /configure /db ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.sdb')) /cfg ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.inf')) /overwrite /log ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.log')) /quiet; Remove-Item -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.*')) -Force;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1604
      - C:\Windows\SysWOW64\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege4.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege4.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege4.log /quiet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1436
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -C "Set-Content -Value @('[Unicode]','Unicode=yes','[Version]','signature=\"$CHICAGO$\"','Revision=1','[Privilege Rights]','SeDebugPrivilege = *S-1-5-18','[File Security]','\"C:\ProgramData\Program\",0,\"D:AR(D;OICI;DTSDRCWD;;;WD)\"') -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.inf')) -Encoding Unicode; secedit.exe /configure /db ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.sdb')) /cfg ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.inf')) /overwrite /log ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.log')) /quiet; Remove-Item -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.*')) -Force;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2356
      - C:\Windows\SysWOW64\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log /quiet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c echo.>c:\inst.ini
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c schtasks.exe /create /tn "Windows Audio Endpoint Builder(ÏµÍ³ÒôÆµ·þÎñ)" /xml "C:\ProgramData\Microsoft\MicrosoftNetFramework.xml
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1020
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "Windows Audio Endpoint Builder(ÏµÍ³ÒôÆµ·þÎñ)" /xml "C:\ProgramData\Microsoft\MicrosoftNetFramework.xml
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"oEimJsyy5o.exe\"));
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftNetFramework.xml

Path C:\ProgramData\Microsoft\MicrosoftNetFramework.xml
Size 3KB
SHA256 943f169c31c319417e61586d8911057321de04926e01e4cc3e6f57b3b032c28e
MD5 69c282fdcd177c1ac4d6709ef841da65
SHA1 575cbac132f5215c9446e6b440ca44a2082f0644
SHA512 6b686a5d6aabe4681c6e1c83d4f32bd55d9fa26fc25ed72ecd20676c6dd3bd49cee4f1e5d1b25f2d3a90a994be00bf3b1366075272d4c3ea16917806dbbe0ea7
MD5 SHA1 SHA512

Submit Download

ziliao.jpg

Path C:\ProgramData\Microsoft\Program\ziliao.jpg
Size 221KB
SHA256 543c66b627f6b6380b0e6a4acd1fdd523051fee344dc059ded299f1cc2135b54
MD5 497bc4b17398d5afc4622e66e623f533
SHA1 68699b0fd00bf5e5a71cbb9ce6afb158d6a492cd
SHA512 2ce9930dbf17be7db460a145f13c82b9c5a40595faff95830880949492b22cb3010379def6a3ad3435dc712003004766bbeeb27fc383dd784ca5723c3151961c
SSDEEP 6144:x/x6F5WCmLGEOmC4v8Z0J+c4v8Z0J+iI8:x/xSWYEOL
MD5 SHA1 SHA512 SSDEEP

Submit Download

SeDebugPrivilege1.inf

Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.inf
Size 390B
SHA256 1a19404888c3463a206ae85da582a233e4ff74e5afea7fce71d24e3f71f88b8c
MD5 b66f55531e3bc2059bc9dc2925bd022d
SHA1 d2f77035a6cfff4f3fce7f08902b790623c5c48a
SHA512 8fe726cace14eefedeba9e9367f9d415b631525bf4ec1dd43c0a91890ef92382c1d24631165566114468bf0c38999569c7d5baa3089be1606dc243d2116fc129
MD5 SHA1 SHA512

Submit Download

SeDebugPrivilege1.log

Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

SeDebugPrivilege1.log

Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log
Size 334B
SHA256 02acb4aa47b8f80c64a52db3096c34977fe76c8e008541d32cbbd115f7076b66
MD5 641a99257611c61a7d72e774fd2eee6e
SHA1 1df319a77e3c68760331fdaafcfed5a0d66947c7
SHA512 7281f4f4c9a15510e29c05dd61d1fe1dfaf256a8bd5be2874dc578af0caabfe942e7de50a8cb081b1a01329297000a28abc86cba79cf817570b306f060b72043
MD5 SHA1 SHA512

Submit Download

SeDebugPrivilege1.log

Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log
Size 2KB
SHA256 1be513e9150dc8165d75571506542894952817d32f21c8da7ba801acd4f30ac2
MD5 3074dd3053ef0707e5aeb5c70b30d067
SHA1 29eb424e467c287c433fb2cd4062eccbf3ee6528
SHA512 377abfc6ac07ccfd967f2d9161c9c3399c07e3a243dbe4a5e006e53614c71f2a4ac790ab7dfc6d275fab7592548fb756cd67053bf618cf5ba2e6580d72ef4144
MD5 SHA1 SHA512

Submit Download

SeDebugPrivilege1.log

Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log
Size 2KB
SHA256 5ee0fc029ccd4b4587cae4c3e1d57b71447e8097017f65bbe7bf62f83c854090
MD5 30d1da3d12b3fb4b6111789c22c606ff
SHA1 6825a732324b6a9f36e627fdfa69558a866ad567
SHA512 e6a728cfd2dff941ad31c4e95d38e8febafb6cc5f999a60261643aa272262cf53c1467edcd776ee9c22e31f39142d991edf6bcf7e0cc42b3e47b42b983847482
MD5 SHA1 SHA512

Submit Download

SeDebugPrivilege3.log

Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege3.log
Size 2KB
SHA256 b5c4688241bf8318161a0f72358ed49979e0b805e3277330322f2b659328d68e
MD5 380c0bb0dff3c47f06e90e6908a34d1a
SHA1 ed7b26eafb1de476cb2e701fc278a509b367a77d
SHA512 51d46e2c827e314540190ab06b6f28356aedecd7d8a7aaacc221a54d54f9a8538e60bfe7c1c75b6b1eeb9f432fdd2d5af46c77d8dde4966f45d96ebde49b5ca1
MD5 SHA1 SHA512

Submit Download

SeDebugPrivilege4.log

Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege4.log
Size 2KB
SHA256 dbd0fd8d055836f959b37fdace40b39eee306817c41da62e9fd34fa2d5196a12
MD5 e56fb06f9a607aa6c8152a4fc8e96706
SHA1 bc38d07f503c3c49fe6e84a8022d53ac93082446
SHA512 d7f370f50719df1c1622354d2093cd65ffd9223a2a09674eae47d52b713bd6cf84be215dddc8c2f1480cb12173c2251a3a83409ac6267bda46248b922df3265d
MD5 SHA1 SHA512

Submit Download

SeDebugPrivilege4.log

Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege4.log
Size 2KB
SHA256 4ef2d1e0d41531cbf24b559261586d4abb7f3aaa8637bd895f630ed3b1d3ba45
MD5 5a18280aed20e8cc704c6211597e4195
SHA1 4286c3091e9bd83e03f1dd3b498b26b5cfb3741d
SHA512 49051747339cd89a2d3892f8b133ef60ff696681cdeaa257039763c37c8d606904c6b2ca3c623adf1a2d7002f5f44f1418fea017d9fc42ef688d3d2b2230dd85
MD5 SHA1 SHA512

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 4.9MB
SHA256 879109ae311e9b88f930ce1c659f29ec0e338687004318661e604d0d3727e3cf
MD5 2a7d5f8d3fb4ab753b226fd88d31453b
SHA1 2ba2f1e7d4c5ff02a730920f0796cee9b174820c
SHA512 fa520ebf9e2626008f479c6e8f472514980d105f917c48ad638a64177d77c82a651c34ed3f28f3e39e67f12e50920503b66e373b5e92cf606bc81dc62a6b3ea4
SSDEEP 49152:aYjdIw1TJyn5PPXDFFCMvSn/yRe4AloH1/coSNs5QKvbeGktKpGw+BbwPiBqkd96:SPZYxnMe4V/cJtKpGvJc5twG
MD5 SHA1 SHA512 SSDEEP

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Size 329KB
SHA256 3ea4a4c3c6dea44d8917b342e93d653f59d93e1f552ace16e97e43bb04e951d8
MD5 958103e55c74427e5c66d7e18f3bf237
SHA1 cea3fc512763dc2ba1cfa9b7cb7a46ae89d9fcd8
SHA512 02ed6e1f24ef8f7f1c0377fa86a3a494b8a4474472ab7001f7902f2f3afa6cd975dc69fcab6f5524545a67657ecccfcd4ed2c95431843e9d50f2fff4c5178dbe
SSDEEP 6144:J8bKN/3dhtovc2LAmB7jQaHU9ZW5NpFaQIuHmc6/nEPn:JqKN/NhKEIzdjQaHUe7OaME
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c7cffd4c079d10e2c56e6c05b8a194b1269537a8d53e3e82d84aad4266fbe877
MD5 e8a3134aed2393f822b24896b0352378
SHA1 1b9e1e7602582851c94199f13e75928326ad227f
SHA512 8892ed25f2d7a5a26ead3dee3da38df31d42c53983562d448ae6ac4e4bd7ec941b9871c7cb2a67a216aa9176866660a66a7023b2928c331a7fd6229d07663a3d
SSDEEP 96:0BSC5mQM8NnqvsqvJCwo0h8BSC5mQM8NnqvsEHyqvJCwor+hwqLGQH1G7R4XlUVc:83/RUo0hk3/RAHnor+hw3EG7R4L
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 d0e3a719fee109754fc57f6ae37c505cb19282bc0be3a22e6750ea6f9fcffc5f
MD5 21d254e2bdf2db4b2f67c25f1c5ae802
SHA1 efc53720cc64c8616e0b59a2568a4715a73a5ef7
SHA512 b6bc55d0a4289ca8772a0d1c4ac5ca6d2248269ca8c6f6035e8d5cd50d6cc0d72e4ad8a027e5875cdfda87053e99cf6dabbd41ee0bd412d26c9b89168550a863
SSDEEP 96:OnRSC5mQM8NnqvsqvJCwo0hGnRSC5mQM8NnqvsEHyqvJCwor+hwSLGQH1G7R4Xl1:OR3/RUo0hGR3/RAHnor+hwPEG7R4L
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 e39855deeca2124c6cf3fc530eac3155fb6018f7876f453c34fdb03a845a8c8b
MD5 17972a88c117713a7111c2286d19c92d
SHA1 990388313457e37e11ac39fd464808af44c2100c
SHA512 832095523ab56c399ac469fa5bc8eadc045b7e43fef1f131bcf0f618fea7c094b27b4474632d5e201f8ffb76b647b7d69eb09bacded7cc8ef1eb2fae1238a271
SSDEEP 96:OnBSC5mQM8NnqvsqvJCwo0hGnBSC5mQM8NnqvsEHyqvJCwor+hbS5wQH2F7R4Xl1:OB3/RUo0hGB3/RAHnor+hbHfF7R4L
MD5 SHA1 SHA512 SSDEEP

Submit Download

oEimJsyy5o.exe

Path C:\Users\Public\Documents\UKeuWn6t\oEimJsyy5o.exe
Size 2.5MB
SHA256 3a58437dc80577ca49a809c17fc06604a7da76f16fe22e0fda53f4157feef3a5
MD5 2432bf0cdafc01588774773a0fd6a3a9
SHA1 8ac674cb5cf244aebe06fa4571f4bb22c076c58f
SHA512 ace9141e9aace0b30544e202dad8cb27c37503e82aff46bf190f2f13733339651840f7c74d9c6589e570ba680f877bd18d6ef9b786506dd3923c4b33b184ed1b
SSDEEP 49152:uGroqcdHZSVxgwVSnw0kivz9s9vO/L97d+ehUqpJE3SiOUDvLiI6WYoJ:uYw3gjEw0Lvz9JZ7dj6SOLiFWYoJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/444-70-0x00000000009E0000-0x0000000001011000-memory.dmp

Download

memory/444-198-0x00000000009E0000-0x0000000001011000-memory.dmp

Download

memory/444-76-0x00000000009E0000-0x0000000001011000-memory.dmp

Download

memory/444-84-0x0000000000170000-0x00000000001AF000-memory.dmp

Download

memory/444-83-0x0000000000170000-0x00000000001AF000-memory.dmp

Download

memory/444-75-0x00000000009E0000-0x0000000001011000-memory.dmp

Download

memory/444-74-0x00000000009E0000-0x0000000001011000-memory.dmp

Download

memory/444-72-0x00000000009E0000-0x0000000001011000-memory.dmp

Download

memory/444-73-0x00000000009E0000-0x0000000001011000-memory.dmp

Download

memory/444-214-0x00000000009E0000-0x0000000001011000-memory.dmp

Download

memory/444-85-0x0000000000170000-0x00000000001AF000-memory.dmp

Download

memory/1640-221-0x000000001B570000-0x000000001B852000-memory.dmp

Download

memory/1648-204-0x000000001B690000-0x000000001B972000-memory.dmp

Download

memory/1648-205-0x00000000027E0000-0x00000000027E8000-memory.dmp

Download

memory/1932-196-0x00000000028E0000-0x00000000028E8000-memory.dmp

Download

memory/1932-195-0x000000001B670000-0x000000001B952000-memory.dmp

Download

memory/2396-212-0x000000001B690000-0x000000001B972000-memory.dmp

Download

memory/2396-213-0x0000000002320000-0x0000000002328000-memory.dmp

Download

memory/2560-35-0x000000001B600000-0x000000001B8E2000-memory.dmp

Download

memory/2560-36-0x0000000002890000-0x0000000002898000-memory.dmp

Download

memory/2728-29-0x0000000001E80000-0x0000000001E88000-memory.dmp

Download

memory/2728-28-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Download