2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c

max time kernel
145s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware-1-master/butterflyondesktop.exe
Size

2.8MB
MD5

1535aa21451192109b86be9bcc7c4345
SHA1

1af211c686c4d4bf0239ed6620358a19691cf88c
SHA256

4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
SHA512

1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
SSDEEP

49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2080	butterflyondesktop.tmp
2776	ButterflyOnDesktop.exe

Loads dropped DLL 7 IoCs

pid	Process
2424	butterflyondesktop.exe
2080	butterflyondesktop.tmp
2080	butterflyondesktop.tmp
2080	butterflyondesktop.tmp
2080	butterflyondesktop.tmp
2080	butterflyondesktop.tmp
2080	butterflyondesktop.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	butterflyondesktop.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-BN4E9.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-AQ1DL.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-TGBBO.tmp	butterflyondesktop.tmp
File created	C:\Program Files (x86)\Butterfly on Desktop\is-TG28F.tmp	butterflyondesktop.tmp
File opened for modification	C:\Program Files (x86)\Butterfly on Desktop\unins000.dat	butterflyondesktop.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ButterflyOnDesktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000269ccb2715776145b58f5ba3011203f200000000020000000000106600000001000020000000ac8ce603c9c6c4c45afb2f72e6798185c68f8c4c45fe3f83bcf2f9d1631f604b000000000e8000000002000020000000ae6437ef9417908db7b0c839249d773bf6cce409a6126d3ef259f547a8ad5a6b20000000aab66a77fc7106f59de8d4ff53713fe3f4373a1b81fae4a58f1c3b3d277adbba400000005442907d185f80f5aeec48a844e3092fab426768532d86c1c3596bec3b692def126a3103e50e84b393f330cb33955a6054c1a23166765fcb2552bd14949d5add	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000269ccb2715776145b58f5ba3011203f200000000020000000000106600000001000020000000363a105c01f4015813dd6bc70b55a5ee9104c6fad2057904a1afbcf034883e13000000000e80000000020000200000009c80eefb4294b6297ae154ac62b0b5129ce4767353e2ae7903529c7e74ae0e74900000002c5ae3430af42b4c60e83e65d65044e3200271421f6d8cff8b529c29e297ed63af975e480d235becbf8b1683105cb2be64eeddc456f4ac7e98ed7da6fb1e16c7534c5268db4a5da574da4ec33aa5daa63acf26affc261c8abb4bf4e6ef13d55a854553365dfbce82f0943f3ca9421e59b7e415f31cd01f26982cbfb82a988299167c441dfca3e6f730aab6d7971e8c5c40000000c92bdf3f53cc33f9e41e5a2f06b56c5ba8056967190b6eb949bb0a867986b560f3e0a7819b86c4062963046574417521abea9e319420695e5fa60fd47873204d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f0df5c0a65db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442859144"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86183F31-D0FD-11EF-9F10-C28ADB222BBA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\freedesktopsoft.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2080	butterflyondesktop.tmp
2776	ButterflyOnDesktop.exe
2820	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2776	ButterflyOnDesktop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2080	2424	butterflyondesktop.exe	28
PID 2424 wrote to memory of 2080	2424	butterflyondesktop.exe	28
PID 2424 wrote to memory of 2080	2424	butterflyondesktop.exe	28
PID 2424 wrote to memory of 2080	2424	butterflyondesktop.exe	28
PID 2424 wrote to memory of 2080	2424	butterflyondesktop.exe	28
PID 2424 wrote to memory of 2080	2424	butterflyondesktop.exe	28
PID 2424 wrote to memory of 2080	2424	butterflyondesktop.exe	28
PID 2080 wrote to memory of 2776	2080	butterflyondesktop.tmp	31
PID 2080 wrote to memory of 2776	2080	butterflyondesktop.tmp	31
PID 2080 wrote to memory of 2776	2080	butterflyondesktop.tmp	31
PID 2080 wrote to memory of 2776	2080	butterflyondesktop.tmp	31
PID 2080 wrote to memory of 2820	2080	butterflyondesktop.tmp	32
PID 2080 wrote to memory of 2820	2080	butterflyondesktop.tmp	32
PID 2080 wrote to memory of 2820	2080	butterflyondesktop.tmp	32
PID 2080 wrote to memory of 2820	2080	butterflyondesktop.tmp	32
PID 2820 wrote to memory of 2540	2820	iexplore.exe	33
PID 2820 wrote to memory of 2540	2820	iexplore.exe	33
PID 2820 wrote to memory of 2540	2820	iexplore.exe	33
PID 2820 wrote to memory of 2540	2820	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\butterflyondesktop.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\butterflyondesktop.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\is-DJG5C.tmp\butterflyondesktop.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DJG5C.tmp\butterflyondesktop.tmp" /SL5="$5014E,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-1-master\butterflyondesktop.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
    "C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2776
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://freedesktopsoft.com/butterflyondesktoplike.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

Filesize
3.0MB

MD5
81aab57e0ef37ddff02d0106ced6b91e

SHA1
6e3895b350ef1545902bd23e7162dfce4c64e029

SHA256
a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287

SHA512
a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
cb0e7e6cc9143af12f8734712cb1baf6

SHA1
69f1c325d0784988c1baebde74e1a4858a672e3c

SHA256
832f170ad11801030787c84921d1b88c11783cb09868fa2fc81eec07ac7a94ca

SHA512
94f1c4485c4c422712e1c99aba335e62e82c43bb8b0d3e36fe2a179c82a281127f2941a617d8b01449d9519998539caa3ec3a5045046296073e44a41655b7e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2190f60d90d86dbb835d8950c6ce90e7

SHA1
17d9e8b3f7f7804a205fc0f684223593b4ce0739

SHA256
a5c06580eea6e24651f3e4feee26ad9d8217b35b95bfcc734910ef5b15bbbe87

SHA512
c905e3a3878c0a043b5c1f4be2e1a3d2e71e5fc8d1f3751d7e4b69514976264fec9b9c649fdf2b005bece506e7329554d2b15efb78b0a1eb719dfc4ea3b07e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a85e357932492fcd5a0c6f6efa906e16

SHA1
cd5d176345265be8f61699c22be57c1fc895a471

SHA256
58fd99ec1593ff964203165c4d698e0e4dcb346a15f755c92123a8d6d38f58f3

SHA512
405311d8213c59beeaae766ed5caaad01dc016a38215fe101f5ed8af98aa61bf5c1e4532ea98e91000b3ce0e68ac8887635327dd920083b7f054c2e8146a08e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec0d5b8ecb02f0852b1fcfbfcfed1c96

SHA1
1bef0130b3e11035fe8ee03ca5bba34f5d4b3d3e

SHA256
fee321ec0fb57a77c22aba7d13b746b649aa4e4754809aaa7c950bbee5a47dd8

SHA512
163467f09bd2eaf0c58f38ffa9947442fb7c4fecc633fa1eb09ce115c3a6e66bc6437b5ab631f43bf6d6d4c239f2ae208608004beff4683c239588526aadaa58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4d71f6a7ee91c10669602ac4b466437

SHA1
af38eb08d21e4ff51c287f46fffc8aad2e2f0fb2

SHA256
ebd4033d9de1f2cb8cf3142c0e0950934ccc92910666f738437da673b22b4e20

SHA512
649acf199cdab70ecbe3720ae69b02fa598cd464edf071bd8ab637ea431965837ba6cf7fff2a5503ce9d85a75ad4a9849b4095c6d30e7f355739c33e5ecf02e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4615fc4c6ae055c7e0d582ccdc69e36d

SHA1
f1c85d271b1f1de7b26734235f0b86329c83bd4d

SHA256
765e311988f06676e4294ec5c1842f9efc18589f150ce1426f1b22f3690856ca

SHA512
acb6db5eafea218fa0c7b81d7f540e265dc490639671666632a8efc1571b1f029ea835221d6797b5095212eeb62ee3132a266cbef21fa3406dd5ae2168befc00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccc770327ea3a5bf948d940d7c3c7f10

SHA1
985f3dcbe218b36280410b5b1bbbdd373c72fa72

SHA256
aeb21986a1f30d18d8a0ee838126e6be83be78dced012f974318591c44147ba9

SHA512
3e113d8b97aa06210543bd1b5aaa57e28088eeea00f8dfdb47f6a19cff8c638fc9b67e058fafc86c2ada22eefd24952f6ffac43d8ce629c310cbb09823f86ff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3fac7941304b2de94e4c6a17e90388d

SHA1
3ddc76b748bcf84caad26ac9fb0bd5c2561a33ac

SHA256
2231927b439cf89575f7c4551e443563725a9f129954cba20504cc44b34e73fd

SHA512
ab03852156f9bfd68ca7146155eafaee3a73eab5fa836bd79861bc671c597548845ddcfdedcd6719bbb246e4272dfa1e5db4b3c91fdeb39ca09ed8f1036ae3a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77cf38280ae4b07c57d50f65a10e4d14

SHA1
2bf09e6950707b54d175fecba4b9db881c6b9ce9

SHA256
1858d7a2efc10948f584c247b0a006078f77b24fade0dd005a33dd34473f480b

SHA512
46d83d1d8d99aa89ab0ecefff79c04cb8bc500f5b387c33ba6741ddede81b4265bf7f6a1b7af7316fb45a41bf23f3572d47636232466c5caee386cce18e14108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e35155d6e99198fb2ad91611dd97827b

SHA1
ee1d27ba951e6f5f3f105e85c650ae55b13a4d55

SHA256
115e872d958f056e5e2a49b15f344be492faba227d3c501ac803e369575dff54

SHA512
f54eb3c738138845ca6c47b9ad359be05454a3d064475199d72e12b92279950b71c0427d97079ac06dd3f0c82cff6be79207aedb284f9228f39966bbca9e966e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36ed568ea212b7c7df407c968f60a940

SHA1
9e330a41c80d029bde79f9c14a8d3d01b372c9c5

SHA256
a28ade1bdf68e6d66183263ae175c8db4de620cf63786acb671b0b2a3719df73

SHA512
eb969656e67345ac0bec5b7d01d1bfba88bca8dbd448ec9de3bdb162abb6760b83234a0714c062c9e91e84fdc5b639bec858c1f6ce49cc9d3cddeeb223f6f01f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77b55032dba6355a0355021119e9ed21

SHA1
08dc31ed4a0e898dbbb6ebee01930c6dd094b905

SHA256
2f9f525e24026026bc5ed6e63f4a6adc1cf02fb42cb19af4d6b8a80055fddf0c

SHA512
59af54dd06656899d3fbc9ae2c34fe1144ee72597c06930bc0d0500b1a88f6d6bbae4bdd7af5fb1bf357068f9d05de4c1ed058a72c306473b99ecd43cea7db1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c482d2d0ceaae66886d2450abe0f1c4

SHA1
d592bd39e28246c1c17b667724ff9f9694496394

SHA256
fd751a2a463b19a839825abbe58aa7ac87026d607c839cb7331b2dafe636a108

SHA512
9513b61f6ec8e8f6de867029d999008a0dc1eaf62320b12bd76814da3643eaf5f9672eb492859576edef616eb4f9c0e4785361b356bd643a7160642fcffb1ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
558e21d226caddce760a2d1862fe1211

SHA1
f605323882fc8efc9a65501ecfa28173b7691687

SHA256
3cd3b14abb1d1ff7953fa52039f03c333aa09fd598795044bda690c4b0a1ce69

SHA512
d23d1b3db4815848d3adba265b4268a4138694a07c89adab027adcb39f8b9905cc0746482709d04c3a0a43c9fe178fd8b59dd3abe87f4517f2dec2dd5376c162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8812b7f7935f27b6b2d43f64f9aead6

SHA1
0214689232cb4c0357f10c0a9fe4e106ea44a91a

SHA256
43d36c680134bf5d9399186fe7bcf36d0f652ef6e41546888660289561f1626a

SHA512
de7fd0877c26ec9252f13b8505d5c69abc97cca526d34e47c4efc9b0d031607d2720689c69c4bf0b022c8c318d40458b0e2488c503d4581a7765bbbf712e7344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db381b04e415b589f42ae1ced1c2a5a2

SHA1
2101815d88ec484ed547201061d7b69d38fc2313

SHA256
0a02ceaefd5935ac75ac7c0a62519cb3554295d2426d59e2fed13530e7e9739f

SHA512
c4c044322dc8f1aceefa7c10f99a008820553eec89603ef410274ebbdc668d4f981cd0e6ec0718d8b1a50020ce629e6678081ae4b2911a7cabe01cdd1dfba5ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f53066b8e5ed4a0b43ab76e4cdba172f

SHA1
a87a2568511834712966f7cc8e3b57b82cc0b81c

SHA256
4689b194ab34f4bfe80f15c6d6115cbfc6fcbf4461df516950a059a823dde0e8

SHA512
51a29d72c38fdf27af7d8bb483f0430c7b5d96c7f078f3b93cf102f2c286391dc1efcdb0e2990297ad300f6d12f04cf63aebac14b12c52a25c532089d20eee56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
936dcae43fc136a4660e5445ca521f5f

SHA1
1b34c84499f912058a3366dab76a79e976a3ce5b

SHA256
2841447df2930497d3c8bbd8dc55f0f802aed30f196b4f9f09c317f7f0eef183

SHA512
85e0bded96c17c9bfa8c1dd1269d956a09273b7fddbebe65b356b57e8818833b7e6240d86467f2a244c1beb444c4ed2aea390847902df91e9f857eb47519609a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
193eb9f5f1bb87a8b2eff30731899a44

SHA1
a4f4f6014ee523a257b62c6218b2c43a4d41c1ce

SHA256
95a20d3aa4ec3580bede8a80730929c7271ba872d5090812288eed1a4da4f18c

SHA512
8f072720ac3b57e0004596771f38970ddbee134181b08b76a56f8b3b60eb16ba30e8dd46df70bc847de5132c169713cf31bd5be4ab2d3714246268ac08eb4acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a818c4310d6c408af04c5b35c964bc2

SHA1
03966bff58b7eac734ff24e530f1e4d30e16f457

SHA256
b14218eeb59fcaf2db234133f8b270b4dbe7f1859bc8898bb69439ce05ebeee8

SHA512
f6b05b51af368a8a16d0e517a1dcd923efb91e7bc75eeae6f4dc38a8753acfcaf1b1104250bc9fe9d76129c67af53bc30a1024bfbdada560b0cc3997d9247b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
902bf31fcbd6093d10706ea3eb1c3000

SHA1
c7374b93156b223e33f80a16015ddd7e4d4d1c80

SHA256
f69b7c20e57d37771a6c3ce77d93f337ce4db73d646d5f2b45c9e8ce5d7646bd

SHA512
7649ac02832d300c4718cbabf77c6e7039eaab9669345784fb985bb942d4643b5c8cb1b04a13412ef8c15d768f11af6b4613481d90db86558a7dcb1d2a755873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32023eafae1b8e0288d64584ed83770e

SHA1
2f515f406e830cc20f2580e0648d129d63914def

SHA256
61429e8443426f065a0160aef9d97958a315b0379af820aea37eab50f8ab8985

SHA512
9e092070997d0f0275bbab56a92feff064f694208978be1dd4454727d7f29f02848fe84740064c4b7f7768cbb132423d45e2bf22ef1910348c2b70f7a027fa5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
29b4c54c6879f10d7ff26debd5673f64

SHA1
18d9a337a0669e1fa0f6daea3fc06b599cd2a378

SHA256
2692cc10ebe650ce98f7c702171ba463f933f5d594256bb030de973aaabb0de4

SHA512
75218a9b1693032dd01b1892d28dea418f19c5d7ca758fa02f3f6ebb45322dddedc33f84d0800472ea405f8d57559d83e1d396785e0582ae01fadd764a332808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\bl977i7\imagestore.dat

Filesize
1KB

MD5
d717976ee850d48dbb7aaec129c9e1da

SHA1
29929f8abfb42dfa1892bbe844792a35c1a7ab82

SHA256
c6c4c2b9d8000d6339f6a874693d16ce1ca09e1fd26fedc850a7f515bb8a2375

SHA512
a0d166519aa8595b39fb128b833731f3df62a90f4ac3364bc9ed63c6cbaf935fc10d555e7727c2704949966e62f62d2404cc430b6346b2131740fe327c3b6d2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QS2MOPHD\favicon[1].ico

Filesize
1KB

MD5
972196f80fc453debb271c6bfdf1d1be

SHA1
01965ba3f3c61a9a23d261bc69f7ef5abe0b2dc3

SHA256
769684bc8078079c7c13898e1cccce6bc8ddec801bafde8a6aec2331c532f778

SHA512
cb74de07067d43477bd62ab7875e83da00fad5ac1f9f08b8b30f5ebb14b1da720e0af5867b6e4ab2a02acd93f4134e26d9f1a56c896da071fc23a4241dc767f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4CAC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CCE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Program Files (x86)\Butterfly on Desktop\unins000.exe

Filesize
698KB

MD5
1fee4db19d9f5af7834ec556311e69dd

SHA1
ff779b9a3515b5a85ab27198939c58c0ad08da70

SHA256
3d550c908d5a8de143c5cd5f4fe431528cd5fa20b77f4605a9b8ca063e83fc36

SHA512
306652c0c4739fce284e9740397e4c8924cd31b6e294c18dd42536d6e00ad8d4c93d9642fe2408f54273d046f04f154f25948936930dd9c81255f3726f31ee65

Download Submit
\Users\Admin\AppData\Local\Temp\is-53AR9.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-DJG5C.tmp\butterflyondesktop.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
memory/2080-17-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2080-55-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2080-43-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2080-8-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2080-21-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2080-19-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2424-16-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2424-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2424-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2424-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2776-630-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2776-455-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2776-631-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2776-632-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2776-629-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2776-628-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2776-1177-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2776-1178-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2776-1179-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2776-1180-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads