cerber | 0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b

Analysis

max time kernel
131s
max time network
133s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
Size

255KB
MD5

1382caad112ebbb4d00257696a7bd9a6
SHA1

0a269602c823be96cc240fe7595cd05a6c24b8b7
SHA256

0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b
SHA512

ae105b757f81d7c479068b88de23a2b096c07f637c07fa024c6ab427310e94dc474ea0cf4ad92143304c94b20a5908051a1c648d91e63e96a889a1999bc1b057
SSDEEP

6144:GwHysO+Bb4cnEWkwM3qKq6qKm3cskuxru5vg:9O+B7Jeqv6dm30vg

Score

10^/10

cerber defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\# DECRYPT MY FILES #.txt

Ransom Note

C_E_R_B_E_R R_A_N_S_O_M_W_A_R_E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable??? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerb3r Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to return your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B | | 2. http://52uo5k3t73ypjije.mustspace.us/F7F4-165B-5150-0072-BC4B | | 3. http://52uo5k3t73ypjije.effortany.win/F7F4-165B-5150-0072-BC4B | | 4. http://52uo5k3t73ypjije.boxsame.kim/F7F4-165B-5150-0072-BC4B | | 5. http://52uo5k3t73ypjije.onion.to/F7F4-165B-5150-0072-BC4B |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/F7F4-165B-5150-0072-BC4B | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B

http://52uo5k3t73ypjije.mustspace.us/F7F4-165B-5150-0072-BC4B

http://52uo5k3t73ypjije.effortany.win/F7F4-165B-5150-0072-BC4B

http://52uo5k3t73ypjije.boxsame.kim/F7F4-165B-5150-0072-BC4B

http://52uo5k3t73ypjije.onion.to/F7F4-165B-5150-0072-BC4B

http://52uo5k3t73ypjije.onion/F7F4-165B-5150-0072-BC4B

Extracted

Path

C:\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#C3rber Ransomware". <hr> If you are reading this message it means the software "Cerber" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !Any attempts to get back your files with the third-party tools can be fatal for your encrypted files! The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files! When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li>Please wait...<a class="url" href="http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B" id="url_1" target="_blank">http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://52uo5k3t73ypjije.mustspace.us/F7F4-165B-5150-0072-BC4B" target="_blank">http://52uo5k3t73ypjije.mustspace.us/F7F4-165B-5150-0072-BC4B</a></li> <li><a href="http://52uo5k3t73ypjije.effortany.win/F7F4-165B-5150-0072-BC4B" target="_blank">http://52uo5k3t73ypjije.effortany.win/F7F4-165B-5150-0072-BC4B</a></li> <li><a href="http://52uo5k3t73ypjije.boxsame.kim/F7F4-165B-5150-0072-BC4B" target="_blank">http://52uo5k3t73ypjije.boxsame.kim/F7F4-165B-5150-0072-BC4B</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/F7F4-165B-5150-0072-BC4B" target="_blank">http://52uo5k3t73ypjije.onion.to/F7F4-165B-5150-0072-BC4B</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B" id="url_2" target="_blank">http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address Please wait...<a class="url" href="http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B" id="url_3" target="_blank">http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B" id="url_4" target="_blank">http://52uo5k3t73ypjije.sentowing.trade/F7F4-165B-5150-0072-BC4B</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/F7F4-165B-5150-0072-BC4B in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } }

Signatures

Cerber 2 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	Process
Mutant created	shell.{7CD5FF42-92A7-61DD-1344-B958F226406D}	logagent.exe
Mutant opened	shell.{7CD5FF42-92A7-61DD-1344-B958F226406D}	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe

Cerber family
cerber

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	logagent.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
892	bcdedit.exe
1776	bcdedit.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\\logagent.exe\""	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\\logagent.exe\""	logagent.exe

Contacts a large (524) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
2960	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\logagent.lnk	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\logagent.lnk	logagent.exe

Executes dropped EXE 2 IoCs

pid	Process
2588	logagent.exe
2436	logagent.exe

Loads dropped DLL 5 IoCs

pid	Process
3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
2732	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
2588	logagent.exe
2588	logagent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\logagent = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\\logagent.exe\""	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\logagent = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\\logagent.exe\""	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\logagent = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\\logagent.exe\""	logagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\logagent = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\\logagent.exe\""	logagent.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	logagent.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp19B8.bmp"	logagent.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 2588 set thread context of 2436	2588	logagent.exe	37

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.url	logagent.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html	logagent.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt	logagent.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	logagent.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini	logagent.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs	logagent.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE	logagent.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml	logagent.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.txt	logagent.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.vbs	logagent.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url	logagent.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE	logagent.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.html	logagent.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE	logagent.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE	logagent.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	logagent.exe
File opened for modification	C:\Windows\	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	logagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	logagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2960	cmd.exe
2096	PING.EXE
2588	cmd.exe
2348	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0005000000019246-37.dat	nsis_installer_1
behavioral1/files/0x0005000000019246-37.dat	nsis_installer_2

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1132	vssadmin.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1380	taskkill.exe
2980	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop	logagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\\logagent.exe\""	logagent.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\\logagent.exe\""	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b88a063f61db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43BDF4A1-CD32-11EF-9628-7EC7239491A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43B20DC1-CD32-11EF-9628-7EC7239491A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d9ff38293df19418e9b210e2f211eb6000000000200000000001066000000010000200000006b17de6821ae5e89017da4bf0a2bd16bf852f72487929d471b288f0afa14dfd1000000000e8000000002000020000000cd29efcabd69b46dadeb6e7f908a021e7af36fb0a94731d575222e4cb06113e990000000ae645833fe23a258b0ae23afac09c02d332ed6d9dd8bfcec692be3b86987851fd26626bf322af7f666da2a6d3ea9c6f9675d7beeb0866f928c2c4074774b2ffac1cd768b498774624c7d285b850b17d0d44d3a1e1578a78a079e3e31d3bb15e9f7639122bbfd8af4a2f46d15525884c09ee8ceb915b74f31e918b1286f7c247ce5660e9112fa8b2df3319860d2bbc3a3400000008fc11330a8f4f7fc8f7d6ca85bdb97440e2cb0c0b9b73e37190fd71a1d35600e342c6f2987e7e91d0222e7c285029b728a731510ee217fd3bfffd12f6f16d4b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d9ff38293df19418e9b210e2f211eb600000000020000000000106600000001000020000000c65d9ca9166226a13534b0440da92bf564a2025b5482c4ff5c0a1a538deb70c7000000000e80000000020000200000009636cbdf9fa113e469ad0e366c58a77a596d1b2a9022c62c57af252eb1e3e75320000000759735ef627afad451a202d14301dbea78a18cf4deab7a0051c9d38c9f91924f4000000093ef164b4aa1724a5c2a941105d6e780864e35ea7c22856f801100243fee00ae591e76a8f33d40aa58839926a04e17cc19ec560a28cd03809ab2ad87216736cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442441992"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2096	PING.EXE
2348	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe
2436	logagent.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
Token: SeDebugPrivilege	1380	taskkill.exe
Token: SeDebugPrivilege	2436	logagent.exe
Token: SeBackupPrivilege	1204	vssvc.exe
Token: SeRestorePrivilege	1204	vssvc.exe
Token: SeAuditPrivilege	1204	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2444	wmic.exe
Token: SeSecurityPrivilege	2444	wmic.exe
Token: SeTakeOwnershipPrivilege	2444	wmic.exe
Token: SeLoadDriverPrivilege	2444	wmic.exe
Token: SeSystemProfilePrivilege	2444	wmic.exe
Token: SeSystemtimePrivilege	2444	wmic.exe
Token: SeProfSingleProcessPrivilege	2444	wmic.exe
Token: SeIncBasePriorityPrivilege	2444	wmic.exe
Token: SeCreatePagefilePrivilege	2444	wmic.exe
Token: SeBackupPrivilege	2444	wmic.exe
Token: SeRestorePrivilege	2444	wmic.exe
Token: SeShutdownPrivilege	2444	wmic.exe
Token: SeDebugPrivilege	2444	wmic.exe
Token: SeSystemEnvironmentPrivilege	2444	wmic.exe
Token: SeRemoteShutdownPrivilege	2444	wmic.exe
Token: SeUndockPrivilege	2444	wmic.exe
Token: SeManageVolumePrivilege	2444	wmic.exe
Token: 33	2444	wmic.exe
Token: 34	2444	wmic.exe
Token: 35	2444	wmic.exe
Token: SeIncreaseQuotaPrivilege	2444	wmic.exe
Token: SeSecurityPrivilege	2444	wmic.exe
Token: SeTakeOwnershipPrivilege	2444	wmic.exe
Token: SeLoadDriverPrivilege	2444	wmic.exe
Token: SeSystemProfilePrivilege	2444	wmic.exe
Token: SeSystemtimePrivilege	2444	wmic.exe
Token: SeProfSingleProcessPrivilege	2444	wmic.exe
Token: SeIncBasePriorityPrivilege	2444	wmic.exe
Token: SeCreatePagefilePrivilege	2444	wmic.exe
Token: SeBackupPrivilege	2444	wmic.exe
Token: SeRestorePrivilege	2444	wmic.exe
Token: SeShutdownPrivilege	2444	wmic.exe
Token: SeDebugPrivilege	2444	wmic.exe
Token: SeSystemEnvironmentPrivilege	2444	wmic.exe
Token: SeRemoteShutdownPrivilege	2444	wmic.exe
Token: SeUndockPrivilege	2444	wmic.exe
Token: SeManageVolumePrivilege	2444	wmic.exe
Token: 33	2444	wmic.exe
Token: 34	2444	wmic.exe
Token: 35	2444	wmic.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: 33	1080	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1080	AUDIODG.EXE
Token: 33	1080	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1080	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2660	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2660	iexplore.exe
2660	iexplore.exe
3028	iexplore.exe
3028	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
1460	IEXPLORE.EXE
1460	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 3028 wrote to memory of 2732	3028	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	30
PID 2732 wrote to memory of 2588	2732	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	31
PID 2732 wrote to memory of 2588	2732	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	31
PID 2732 wrote to memory of 2588	2732	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	31
PID 2732 wrote to memory of 2588	2732	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	31
PID 2732 wrote to memory of 2960	2732	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	32
PID 2732 wrote to memory of 2960	2732	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	32
PID 2732 wrote to memory of 2960	2732	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	32
PID 2732 wrote to memory of 2960	2732	0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe	32
PID 2960 wrote to memory of 1380	2960	cmd.exe	34
PID 2960 wrote to memory of 1380	2960	cmd.exe	34
PID 2960 wrote to memory of 1380	2960	cmd.exe	34
PID 2960 wrote to memory of 1380	2960	cmd.exe	34
PID 2960 wrote to memory of 2096	2960	cmd.exe	36
PID 2960 wrote to memory of 2096	2960	cmd.exe	36
PID 2960 wrote to memory of 2096	2960	cmd.exe	36
PID 2960 wrote to memory of 2096	2960	cmd.exe	36
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2588 wrote to memory of 2436	2588	logagent.exe	37
PID 2436 wrote to memory of 1132	2436	logagent.exe	38
PID 2436 wrote to memory of 1132	2436	logagent.exe	38
PID 2436 wrote to memory of 1132	2436	logagent.exe	38
PID 2436 wrote to memory of 1132	2436	logagent.exe	38
PID 2436 wrote to memory of 2444	2436	logagent.exe	43
PID 2436 wrote to memory of 2444	2436	logagent.exe	43
PID 2436 wrote to memory of 2444	2436	logagent.exe	43
PID 2436 wrote to memory of 2444	2436	logagent.exe	43
PID 2436 wrote to memory of 892	2436	logagent.exe	45
PID 2436 wrote to memory of 892	2436	logagent.exe	45
PID 2436 wrote to memory of 892	2436	logagent.exe	45
PID 2436 wrote to memory of 892	2436	logagent.exe	45
PID 2436 wrote to memory of 1776	2436	logagent.exe	47
PID 2436 wrote to memory of 1776	2436	logagent.exe	47
PID 2436 wrote to memory of 1776	2436	logagent.exe	47
PID 2436 wrote to memory of 1776	2436	logagent.exe	47
PID 2436 wrote to memory of 3028	2436	logagent.exe	50
PID 2436 wrote to memory of 3028	2436	logagent.exe	50
PID 2436 wrote to memory of 3028	2436	logagent.exe	50
PID 2436 wrote to memory of 3028	2436	logagent.exe	50
PID 2436 wrote to memory of 2560	2436	logagent.exe	51
PID 2436 wrote to memory of 2560	2436	logagent.exe	51
PID 2436 wrote to memory of 2560	2436	logagent.exe	51
PID 2436 wrote to memory of 2560	2436	logagent.exe	51
PID 3028 wrote to memory of 2580	3028	iexplore.exe	53
PID 3028 wrote to memory of 2580	3028	iexplore.exe	53

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
"C:\Users\Admin\AppData\Local\Temp\0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe
  "C:\Users\Admin\AppData\Local\Temp\0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe"
  2⤵
  - Cerber
  - Modifies visiblity of hidden/system files in Explorer
  - Adds policy Run key to start application
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Roaming\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\logagent.exe
    "C:\Users\Admin\AppData\Roaming\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\logagent.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Users\Admin\AppData\Roaming\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\logagent.exe
      "C:\Users\Admin\AppData\Roaming\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\logagent.exe"
      4⤵
      Cerber
      Modifies visiblity of hidden/system files in Explorer
      Adds policy Run key to start application
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Sets desktop wallpaper using registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Windows\system32\vssadmin.exe
        
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:1132
    - - C:\Windows\system32\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
    - - C:\Windows\System32\bcdedit.exe
        
        "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:892
    - - C:\Windows\System32\bcdedit.exe
        
        "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1776
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3028
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:537601 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2424
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:2560
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:1736
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /f /im "logagent.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\logagent.exe" > NUL
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2588
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "logagent.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /f /im "0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe" > NUL
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1380
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1460

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:2192

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\# DECRYPT MY FILES #.html

Filesize
19KB

MD5
1049aeb0c0048e9aecb7ba323ea0e680

SHA1
ce72d77dfb4ac0f8be6fbeaa42834f345af3e2b2

SHA256
7a5a736b763093c477f1b92c62d05d26cd7c892a6d989f1cc0bf0126ba60cb48

SHA512
b85640a2bebbb329e12c7cb08eeddc1857ae3ab5ae8325bcd424107f3a5da74526b38bbbc0b19abf69432bc58ce7e3145916d489257c073dfb4d130aa20068b5

Download Submit
C:\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
30fd689a5bf7ba2f641ade3bb0215016

SHA1
1008803c597681ade9355147386116bb7884b682

SHA256
70d8fc776d6713ed17d72fa4e0c949ed978a238cdf9f8a56f71bed19d22a8a5a

SHA512
354b4816c8586edc4d3234bf73d070999e882e662228a9063f5c9eebd139365f210bfb25cda87b0997995abda457094d79af77fcef210813c23ac51b40d8c5c0

Download Submit
C:\# DECRYPT MY FILES #.url

Filesize
95B

MD5
411e3c42bc6179ab7d904acdf4fab613

SHA1
1076625153b7aaf6faca886bf25d3cd5fc928727

SHA256
30f2e42f95471f70d816b0c729e4fa4561b0824735599d5ce0bed8c961896d1d

SHA512
7b8972178491879371b799050e14dab70b3b93badff7039bfa124ee6a7e31d165f03274b106f9f15fdbd630c112182f946ab02d3d5eb44b187a74484c57a8dd1

Download Submit
C:\# DECRYPT MY FILES #.vbs

Filesize
252B

MD5
18d46f5d8ebd3c7d6df0c7a8fd1bd64d

SHA1
aeb8407457434aabce2a4c2f95fe305c5303f929

SHA256
ceb35b75d397b07c84dfab3a28189e9431bdf80ec99ab65f9ccf01986bd4a8e9

SHA512
35fc759be0dee77eb9e39350873c24d9693cf6f370f171814e2ce6250ea814fea8a0887442ebae9077d6e9ff81ae7034faa0afcb080401a7d4ac384d2ba42d65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
71fcb882806fb8e53d0749123fe4f795

SHA1
b29c39f5d676917a0ad07f19a67108bbea6db9e2

SHA256
c700fafbf4d82153c65bafebb0d83b70f7fb9ae5891f224803edab4048b84571

SHA512
700f003f31314978af6c53525347cc7038cf31d596814daf3d0f002388eb8de58a24b32c2fe75892f0528997f41991247f5ad865e55f7117ba43cfa1b56e73a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eae829eb43b9b6b5c35ce08e841d26b

SHA1
d2259fdf1dd99dfde013fc6760c8a841130304bb

SHA256
e79b99624e7325b9a7ecc8e2f84051a46782bda17ac8135f763bc9a449422e4d

SHA512
33c83f7088b48eabc7f5cca8292eb3d4c53961805be814f1cdc93153d3250a2dfea1bc7bf14176cfb93f6ebd925076f64d0e7ff34b90f4ec19d42da518ad15c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dae25de930919aade71203b37105aa0

SHA1
b49b7ddbdd55c1ff566c0fc903f8bbfb010a78f5

SHA256
75bc70dbff93e0ec71852cb91adc5081b084bc0fa396186fbdf0973a26f8de29

SHA512
0e78985bc77be13e6030233749be47c8eb6ec2399db5c3c60b871587cdf10a4273e1bf1afc76845ec14ab7ba6dcf7f1172ade8502196ce43657fa6bbbd354e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
276474b36c67d41725472625c07e882d

SHA1
45cc1c059323a71eed671131db9b7c11cf225463

SHA256
edcb85cc75a6f272703a80e3af00fe0f5cb76162c25236880284628e5d0508d3

SHA512
a9c09121732186e4a7013a44283402f05a40cbfb066ca2dcd034d7837a7f0fc1f5f297c8d744a52269c4876c6488474c6db5f0be98bc467dee32572b28e7e7de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4268bbba26489ed4fdfb4e4d317db732

SHA1
82a6cb8b96a4660d5ea8a7ebcf01b8d7c2ee85b3

SHA256
8655454655a8fac0480a0186de8290d2908743b1993338a455620ab71ea64d74

SHA512
ab024cc1b3aeee293b31fd8210c598879f009b3bd7688bfbcd519ada2d9766bc42969da89ffd69b4bc8ad7d85f01d3a818a290667ed2866acfe2adc1f63d79b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b553611af1a62373d2ad7537bb97503

SHA1
2cb35cef0b50e571a0d261fbbd8b781baf73d1a0

SHA256
e23e90083932970eb530e8e2615f8606000dcc2b546ffd2efecd69e1ebb99935

SHA512
7515fd7086848df0444e69e4e95b314c01ede495a9ad1146e15ac8480fa52737950da5dc0c0b53f097ef7b381847115b68d9ae1e8abf115225262fc4513ffde5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4aa18ab2cb679fe52f9630dab85ff43

SHA1
dfe725220b42b4fb2fbbd69022c5d63ec4a71616

SHA256
019794d4364c34a4e01adfad06dc54224d1bdefaa5994fcff88ea5079b54fb38

SHA512
f10fe7637ee5d55fa1f136d14a9da897fa3f3de56259cade13f9566b401e7e8f04492b86a4a929c0aad8b2eccae498fac45ef9dc70af62817466b6337a2281d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
858a4cb5d6f57559a882a1a4700ae8c0

SHA1
d1b849fe6c9fd8597ce133bb9a74ac20531e5401

SHA256
bbc43cf6292d0e7d0d9714f5a590b5be254c685ed0ba3c8d611281428b67ff1b

SHA512
f238831c2e4992596c380f78e8f11d0c475ede345c323fba5556860fde0a001efc807dc6196942de959e33a76c714ec103cde4be7b455db0350f3329c20d808f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f6f5dc774835f65f50e15252db24670

SHA1
db2c1bf2671d40121f90718a191c1e3ec60e1ad1

SHA256
c67e038e0573129ed26d7995d2460d6d76438770afb4e4b76d00c2d0d1f21baf

SHA512
5fc0021ca3164d73a4bca7d009c6949f5abf71c437cdefce0c81ed2aa57ba12657f36d4c6b0f4805e61251257f1decfe50e142f969bd3ec77fce969289af921c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
841729c59dfb02dafe544258a543b841

SHA1
2fdc91e3180a39035e7b6ff5383140ac40987f5d

SHA256
b2b258640e407e5aba9ae55d0d7b32c60fe2d200dddd0893960d6eeb92a45852

SHA512
f0d77eb5b912a991195d7f32a5e9e4cd77d4946a8ed9422c328bbf0e24abb5fe7498496d590b1eccdd6b718feec993f4505e5e45b5b6b173815881da6c4c9830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b65c295395f6d5a252e27e0a90637f94

SHA1
568d1ceb5a4ce944986b4b4358d1221dcbefce87

SHA256
910a7d24bc0b64716909e0ba506f11219d146c0089edfb029409088d37f89c67

SHA512
6010f86af92244bb299091a7429bafd7a5b992dc134202dce71509509b811ae63fe142c8f207c0214187e7e51765f9798a6927434c77fc630b8620087df71645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0592e751e1c18275dd09c4fc4384a77e

SHA1
eb256c814fe7f345a6d28f4f5b6b78980dc76c5c

SHA256
1e0c9edfa093ffef81eb44be827048940c99f7fd8bb2cb11c8c3900b07a16981

SHA512
906be4a9e6a4d60385507e657f16a0fd98de55f7fbd70df0528ce066330190c3cec6d4a5cec82a18244a02c7581f3263b1aeace2f60983508183fef79dfe829d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe9041cb996003074c55a64328617c91

SHA1
0f82437c50545e0f65146a5e4cf990b112c98f4c

SHA256
605c07932a234e5f0df99079d9854b850d339d27bf56c0ef306d59c82690e200

SHA512
d374a6c3a2a1c3ace433a2d305ca767935c9c46b9de6a5e12967bf36529c638e2c46902ff8fb6ccb6051db0226e7a4884d5785a8d5d664fdad0babe70b6ac9e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
802fa9dfe38862870c2c927b8e018893

SHA1
e71adfd6b59ebb93b8125c407a039f3d84bb0e03

SHA256
39c025c52403cb8f4880508243252c04f95572176e6684167f4f1b2a1602589d

SHA512
16f917fa98cb35cbc73653a72862b75d2f5a2deb82533c3b5bf80a2bd036624026ee0f0c0371c580b6c353954d906218a693e34a113f42921a6a2aa9448e91e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cd196f3091b151d8804f95bb9035010

SHA1
b29f5d309de6bc4c5ddaeefef334104e5a76569c

SHA256
3412eac14e68fa3cce0e270608825b1c724df5ac341b4d098b97c209d1bf552a

SHA512
8f24f2d542883825347bcddfe5992e0264cd6994cdc00981525037ee5d77553b13de9a4e15e05746b73574bd73f3836e7a45b65fc4d04d864f290aeb105862ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11d8dbaf9eec2d46df5541dccb473a9c

SHA1
0093e61698506c376ec2ed5e1727a131bc828025

SHA256
3cabce3922dcf871d7a09e749f0444db37133cff6fb4efedddea0d3711c90f3b

SHA512
c9db3b93f9be584e0467099cb6c8bb9b44e0385531184a64134e3a1e8553149491d53a6b5fda5559f9e223acf48a7f93b8369ed7c8b3fbcf5b382a5c3c22bcf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5245abfdc9d7162526d135b3af0e429b

SHA1
70fa3cf3d5365f93e9357cb69c3e83db2cb1f497

SHA256
140290b168ff781e1832e9d333ed420132a6ed92cd31e49c39f3813a004d5c75

SHA512
8c1a88fc12b3035da1f1fedabebab3faecb7b21700f310999064b81af495c52b8a10300fbff086d71f022094f72c2bb10dc05a990963281484897ea36eec00ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6175d38d7263506c783500b65201df11

SHA1
de4b632d69f8b21b564133a234944f39acf04057

SHA256
883a9a3fc0d45ba7dbcbd6c36136ecbe791e3266e38cd87a1a5932f0f6165f6b

SHA512
0632ed2f1006ab6da81dc1b8c4e045ed74942bd8df5580c222b54b35f235ecba2f2622b0a2582e832c5e17afa03818419aecc99c1a2c8d30797975d5b56c526f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d171f33307143734a65c62ed5755f08

SHA1
0bcbd97774a9691ee25f985fca86080cd8c1e91c

SHA256
eb397ad26d76e62e7270309adccebb6d1c6976d1a47ba1c78fc7ac67ebdfaa39

SHA512
705c269e0ac2253c487a91d54e5d6c41654591de18cfa0f75b93461404d2442937fb10b7856a59327023f742332ee29e5584b63b9a318dbb17e3c2ced87a4edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d7e4bfe344d77bc72c2fcccc4ba2c9f

SHA1
4b8e975d57b0859cebe6db6868a583c3530b8ab5

SHA256
fdc202621beae99441590ad7c07c5c723f163116d7f72ea03964a043feec00ab

SHA512
495a9fb7542643fa97e38931a67e718f3b2485f0b05fbb4ff0e34b28100769d642d7d41e02bb7db993b97b0040313d211a2d32f01cbe51d98ab2beebf5a3a927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
754e3212a77e3793cffdc1e71643116a

SHA1
63853314dd18a8d6a673ea1cad87513483079cda

SHA256
e2e50cee1812964886faadd1ef683f1b16008c554220c5c3c31034f17a7b85e1

SHA512
909509b1dee00faaaaa19c32f618a71711db2f283f0f9bcae806dbc9770e1a62407350612716c384884c72bca44cc4318c8d1010139d27e180b57495d9db8a00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f432fbc37545ec9e7a6a2a618e472a14

SHA1
ee2bab9ba2f2b618722753aa6fddcc86115dc2c2

SHA256
1ce6299887f00af3c56f5f69b76e571b9a8df8bc00d1ac0d40ceadc8f1238361

SHA512
601fa05873b3a3c99d8e0a34b47469fc429ec701c42340c8d873f861661605f6d6285b6964aaca83ddeb97b92194333a6aa7051dbc1b898616f39ba603ccbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{43B20DC1-CD32-11EF-9628-7EC7239491A4}.dat

Filesize
5KB

MD5
0b45b2b1f813a1aa8dc1a1f5bf1e2826

SHA1
602f0daa4c278bd7351948cf985a298cac21fe94

SHA256
32482eb59a5f79a388b5f4c2b5a388839d49288ecfa0814114809b64f6eef430

SHA512
4169116bc4c1398384c2f29730cf75689c958777401e2bca1cf88987f037dbd21e10ef32e41e481786213f9d5a172f57c1619f0aa7657c6f6438dbd15147abaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\json[1].json

Filesize
291B

MD5
c085beeb6f771b90fed94c1d940f97f6

SHA1
44a994d9175d6abaa9a3b5718e242fa659aed66a

SHA256
ff5681f440a7a4b019a4a59f43ad414393321d1eb6dc3874cea0a84e73a83c51

SHA512
9d000581b287cd3d5464c33c260008090369a4f5f380b7cfa72eb0fc3221ce0e07df0387f6d3d6b38253c215250ac873dec0f52c501e3d6312f0a5437723a76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3813.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3874.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Carney.u

Filesize
31KB

MD5
e711589f3ad826183551e6dded5b9583

SHA1
d86e8b4f4247d7f0947445aeb478e401845c3455

SHA256
197d118dd9921167d29bef977ac8abdaa1a6ba637bd9a0ceacf1b3853e23e89d

SHA512
e8bf4ad04e7b8269ea98b78bcd7e4550a76621d22d64231912cb9bf727130380e28824147a1c30734f23faeff45fc5a49545562d2442653b9aa24dd692891367

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\logagent.lnk

Filesize
1KB

MD5
fa79645cae480386943fd8a7379e6adb

SHA1
4ca50bd47507a2270ed2a58e672b55b3142ffe56

SHA256
2211933ab4aed3adc0d4532c0a0a058c2d996231484e1fcac913e415117f2c39

SHA512
0409d9035af61a340aa7a8726b0eeb89e506f2e07806bcfdaea0a0c88b269376a10234e135a6fe0ca70d8e56a5a2cf12ebdf8b1eef3c61ebc7c16e3e340781e4

Download Submit
C:\Users\Admin\AppData\Roaming\chunker.output.doctype-system.xml

Filesize
1KB

MD5
968907bced219acdf5cba9cc1aaf9573

SHA1
ed4af715b02ee442c67d6edbbccac22d9c8a08ab

SHA256
7a5717363f518370179dec01d1cf98a9dc15255f16b336ca89c9789cb7ff30d4

SHA512
88d7ea11ee954a5ca2dcfe44ed9b1c77d70459438608a71cb0d77672ed3d1a3fca495954cc113193895e1d5b7cb3e9503571bd94fa9037483823ea5556692010

Download Submit
C:\Users\Admin\AppData\Roaming\chunker.output.doctype-system.xml

Filesize
1KB

MD5
e930bf24883de57b28a31a733d618645

SHA1
416f7f4e017f619d1ac89a34c1e34a5baad73c56

SHA256
2f3ce5515bead08015d327ba391060bd70614aea8b8c4325470723f824d51a21

SHA512
cfe4c11334a627ba2a5a022bf669a78df88ef9e641596bd7cac6fc590da62490e90f9ff3b1f06a169684820406e452f12be420b13de1b093ff1dd73abaee6b3a

Download Submit
C:\Users\Admin\AppData\Roaming\f2.png

Filesize
1KB

MD5
3c47e0efef2f0b575d8d3d9a522fef2a

SHA1
ba419a1b029a6cce6baffb4131c35e9be1de31cb

SHA256
9512a42c7bf38e8455914a2a58c2755a8c8d99161645457416e298855943f5d4

SHA512
60d1c6d275fc773c079e8721dd5a390ac8bd2808a8f387b4de19b7b19539cef5f4958811915c9455016e2de95c8bdbb4bbd0cbca5356ae1e29b03aedb828c25b

Download Submit
C:\Users\Admin\AppData\Roaming\f2.png

Filesize
1KB

MD5
776bd82891e52f9430b3891103e8bd1c

SHA1
00a4de0a6fe8067fa41202f6312e1e85c0cf9126

SHA256
a08812bfa0464d79d082d2e2ad8d2cc4aa2c941fd3deb2e8e0c5fd015d9901ec

SHA512
d4f1adec624a79645d22c6c3901df2a91efa62399f4143384e47a5ab75fdd69a9373ef9cece6f51439fb2029782474f77ac18348e6c9f09848cdaf5cd73ae4cb

Download Submit
\Users\Admin\AppData\Local\Temp\nso29DF.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
\Users\Admin\AppData\Roaming\ProxySettings.dll

Filesize
72KB

MD5
dcc9cec91591178cdfcf411ebbe49418

SHA1
bf97d4ede34fb0420061eef9780198dc9f87db8d

SHA256
d7d7778e7d5852c945f7b181cf37d8e41decdaaddadffc37452e64f41339979f

SHA512
496938599e5f0351eb4e28102ea1ca39e1c68611c41dd0478b9d7016679e85ccba7c3c97541b31345742e94a7a69ac8efd149fd7540ae73d8d67848696e2c9a3

Download Submit
\Users\Admin\AppData\Roaming\{7950FA1F-A216-74FE-80F8-918F1AE2C65E}\logagent.exe

Filesize
255KB

MD5
1382caad112ebbb4d00257696a7bd9a6

SHA1
0a269602c823be96cc240fe7595cd05a6c24b8b7

SHA256
0e7ba1cb5437ce3b1f1140747e4c6b64784fe58a427dab3dfc94c9f73fd0649b

SHA512
ae105b757f81d7c479068b88de23a2b096c07f637c07fa024c6ab427310e94dc474ea0cf4ad92143304c94b20a5908051a1c648d91e63e96a889a1999bc1b057

Download Submit
memory/2436-90-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2436-87-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2436-81-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2436-471-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2436-461-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2436-89-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2436-474-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2436-82-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2436-468-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2436-91-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2588-63-0x0000000001C20000-0x0000000001C33000-memory.dmp

Filesize
76KB

Download
memory/2732-18-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-28-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-15-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-32-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-20-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2732-26-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-22-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-13-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2732-45-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3028-11-0x00000000007B0000-0x00000000007C3000-memory.dmp

Filesize
76KB

Download