Overview
overview
10Static
static
10The-MALWAR...ot.exe
windows7-x64
10The-MALWAR...ot.exe
windows10-2004-x64
10The-MALWAR...ll.exe
windows7-x64
10The-MALWAR...ll.exe
windows10-2004-x64
10The-MALWAR...BS.exe
windows7-x64
10The-MALWAR...BS.exe
windows10-2004-x64
10The-MALWAR...in.exe
windows7-x64
7The-MALWAR...in.exe
windows10-2004-x64
7The-MALWAR....A.exe
windows7-x64
7The-MALWAR....A.exe
windows10-2004-x64
7The-MALWAR....A.exe
windows7-x64
10The-MALWAR....A.exe
windows10-2004-x64
10The-MALWAR...us.exe
windows7-x64
6The-MALWAR...us.exe
windows10-2004-x64
6The-MALWAR....a.exe
windows7-x64
3The-MALWAR....a.exe
windows10-2004-x64
3The-MALWAR....a.exe
windows7-x64
7The-MALWAR....a.exe
windows10-2004-x64
7The-MALWAR...ok.exe
windows7-x64
10The-MALWAR...ok.exe
windows10-2004-x64
1The-MALWAR...ft.exe
windows7-x64
4The-MALWAR...ft.exe
windows10-2004-x64
4The-MALWAR...en.exe
windows7-x64
6The-MALWAR...en.exe
windows10-2004-x64
6The-MALWAR...min.js
windows7-x64
3The-MALWAR...min.js
windows10-2004-x64
3The-MALWAR...ul.exe
windows7-x64
1The-MALWAR...ul.exe
windows10-2004-x64
3The-MALWAR....a.exe
windows7-x64
8The-MALWAR....a.exe
windows10-2004-x64
7The-MALWAR...99.exe
windows7-x64
5The-MALWAR...99.exe
windows10-2004-x64
5Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-01-2025 14:56
Static task
static1
macroupxaspackv2macro_on_actiongeforcehoststealerguestmydoomdarkcometnjratmodiloaderremcosrevengeratwipelock
21 signatures
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Email-Worm/Amus.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Email-Worm/Amus.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Email-Worm/Anap.a.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Email-Worm/Anap.a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Email-Worm/Axam.a.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Email-Worm/Axam.a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Email-Worm/Brontok.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Email-Worm/Brontok.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Email-Worm/Bugsoft.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Email-Worm/Bugsoft.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Email-Worm/Duksten.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Email-Worm/Duksten.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Email-Worm/Emin.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Email-Worm/Emin.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Email-Worm/Funsoul.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Email-Worm/Funsoul.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Email-Worm/Gruel.a.exe
Resource
win7-20240903-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Email-Worm/Gruel.a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/Email-Worm/Happy99.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/Email-Worm/Happy99.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
The-MALWARE-Repo-master/Email-Worm/Gruel.a.exe
-
Size
100KB
-
MD5
b0feccddd78039aed7f1d68dae4d73d3
-
SHA1
8fcffb3ae7af33b9b83af4c5acbb044f888eeabf
-
SHA256
5714efd4746f7796bbc52a272f8e354f67edfb50129d5fdaa1396e920956d0d6
-
SHA512
b02b9476eeb9c43fcfef56949f867c1c88f152d65f3961a2838b8bff02df2383945aefb9a8c517ac78d79b5a9163c7677f5b6238f4624b1966994c9c09eb428d
-
SSDEEP
1536:ThBfyxwMz14BSSQGRwmkwmGDAzGC6TaPAlbv/g:1BKxwMz14wSQGGUDAATaPAlbv/g
Score
8/10
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe\DisableExceptionChainValidation = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe\DisableExceptionChainValidation = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe\DisableExceptionChainValidation = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe\DisableExceptionChainValidation = "0" msiexec.exe -
Manipulates Digital Signatures 1 TTPs 26 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigVerifyIndirectData" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubInitialize" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubLoadMessage" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigCreateIndirectData" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubCheckCert" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "mso.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "mso.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigGetSignedDataMsg" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigRemoveSignedDataMsg" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustTestPolicy" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigPutSignedDataMsg" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubLoadSignature" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "WintrustCertificateTrust" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustFinalPolicy" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubCleanup" MsiExec.exe -
Executes dropped EXE 1 IoCs
pid Process 3920 OUTLOOK.EXE -
Loads dropped DLL 64 IoCs
pid Process 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 1844 msiexec.exe 1844 msiexec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 1844 msiexec.exe 1844 msiexec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2912 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2912 MsiExec.exe 2912 MsiExec.exe 3920 OUTLOOK.EXE 3920 OUTLOOK.EXE 3920 OUTLOOK.EXE 1180 Process not Found 1180 Process not Found 1180 Process not Found -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1" Gruel.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1" Gruel.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1" Gruel.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1" Gruel.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1" Gruel.a.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEX\DevicePath = "C:\\Rundll32.exe" Gruel.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MediaPath = "C:\\Rundll32.exe" Gruel.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Rundll32 = "C:\\Rundll32.exe" Gruel.a.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: Gruel.a.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\FM20.DLL msiexec.exe File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\VBAME.DLL msiexec.exe File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\MSCOMCTL.OCX msiexec.exe File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE -
Drops file in Program Files directory 17 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\REMINDER.WAV msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUTL.OLB msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SSGEN.DLL msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\PipelineSegments.store addinutil.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLPH.DLL msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXSEC32.DLL msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLRPC.DLL msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store addinutil.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\odffilt.dll msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLACCT.DLL msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE.MANIFEST msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RTFHTML.DLL msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI9219.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9B57.tmp msiexec.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pubs.exe msiexec.exe File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE File opened for modification C:\Windows\Installer\f76903e.mst msiexec.exe File opened for modification C:\Windows\Installer\MSI9BC6.tmp msiexec.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIB585.tmp msiexec.exe File created C:\Windows\Installer\f769041.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI9C35.tmp msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pubs.exe msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIB5C4.tmp msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\msouc.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI9569.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI976C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI98D5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9F68.tmp msiexec.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe msiexec.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe msiexec.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe msiexec.exe File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe msiexec.exe File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File opened for modification C:\Windows\Installer\MSI914B.tmp msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIB616.tmp msiexec.exe File opened for modification C:\Windows\Installer\f769041.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI912B.tmp msiexec.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe msiexec.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe msiexec.exe File created C:\windows\Program Files\Kazaa\My Shared Folder\Norton 2003 Pro.exe Gruel.a.exe File opened for modification C:\Windows\Installer\MSI90FB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9C55.tmp msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\accicons.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI918B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9EBA.tmp msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe msiexec.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\accicons.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIB532.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB553.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBA3F.tmp msiexec.exe File created C:\Windows\Installer\f76903e.mst msiexec.exe File opened for modification C:\Windows\Installer\MSI9529.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI97DB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA372.tmp msiexec.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI91F9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI92A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI9D8E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA3E0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB573.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBA2E.tmp msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\grvicons.exe msiexec.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe msiexec.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIB542.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB5F6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI92A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9B46.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gruel.a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bcssync.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUTLOOK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gruel.a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gruel.a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msohtmed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies Control Panel 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Keyboard\KeyboardSpeed = "31" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Keyboard\KeyboardDelay = "1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\MMCPL OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Appearance\Schemes rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\Pattern Upgrade = "TRUE" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\CursorBlinkRate = "530" rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" msohtmed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor msohtmed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell msohtmed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\OUTLOOK.EXE = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor msohtmed.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\ContinuousBrowsing\Enabled = "0" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" msohtmed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND msohtmed.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell msohtmed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_OBJECT_CACHING\OUTLOOK.EXE = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\OUTLOOK.EXE = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ADDON_MANAGEMENT\OUTLOOK.EXE = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "kIlLeRgUaTe 1.03, I mAke ThIs vIrUs BeCaUsE I dOn'T hAvE NoThInG tO dO!!" Gruel.a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\OUTLOOK.EXE = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\OUTLOOK.EXE = "1" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor msohtmed.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 msohtmed.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Privacy\ClearBrowsingHistoryOnExit = "0" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit msohtmed.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 msohtmed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor msohtmed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\AlternateCLSID = "{F91CAF91-225B-43A7-BB9E-472F991FC402}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\AlternateCLSID = "{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command msohtmed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_UNC_SAVEDFILECHECK\OUTLOOK.EXE = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\AlternateCLSID = "{996BF5E0-8044-4650-ADEB-0B013914E99C}" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\OUTLOOK.EXE = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\OUTLOOK.EXE = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{A0E7BF67-8D30-4620-8825-7111714C7CAB}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}\AlternateCLSID = "{627C8B79-918A-4C5C-9E19-20F66BF30B86}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\OUTLOOK.EXE = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" msohtmed.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND msohtmed.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit msohtmed.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Privacy rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\AlternateCLSID = "{24B224E0-9545-4A2F-ABD5-86AA8A849385}" msiexec.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "about:Tabs" rundll32.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.OlkBusinessCardControl\CurVer\ = "Outlook.OlkBusinessCardControl.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00063085-0000-0000-C000-000000000046}\ = "SyncObjectEvents" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000672F6-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command msohtmed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5512D110-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\ = "C:\\Windows\\SysWOW64\\FM20.DLL" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\TypeLib\Version = "2.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00063023-0000-0000-C000-000000000046}\ = "_RemoteItem" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E6-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Windows\\SysWOW64\\MSCOMCTL.OCX" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\TypeLib\Version = "2.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E3867A2-8586-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{0006303D-0000-0000-C000-000000000046} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8BD21D10-EC42-11CE-9E0D-00AA006002F3}\Implemented Categories\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{8BD21D20-EC42-11CE-9E0D-00AA006002F3}\Control msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.OlkPageControl.1\ = "Microsoft Outlook Page Control" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000630E1-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000630D7-0000-0000-C000-000000000046}\ProxyStubClsid msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Outlook.OlkPageControl.1 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{35053A20-8589-11D1-B16A-00C0F0283628} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000672E4-0000-0000-C000-000000000046}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5512D118-5CC6-11CF-8D67-00AA00BDCE1D}\ToolboxBitmap32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAE50EB0-4A62-11CE-BED6-00AA00611080}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0006F04E-0000-0000-C000-000000000046}\ToolboxBitmap32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLOOK.EXE,5507" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307A-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.Application.14 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5512D11C-5CC6-11CF-8D67-00AA00BDCE1D}\Version msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5512D124-5CC6-11CF-8D67-00AA00BDCE1D}\Version\ = "2.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000672F4-0000-0000-C000-000000000046}\ = "_OlkCategory" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{4C599241-6926-101B-9992-00000B65C6F9}\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{EAE50EB0-4A62-11CE-BED6-00AA00611080}\MiscStatus msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{0006F04D-0000-0000-C000-000000000046}\InprocHandler32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.File.ofs.14\NoOpen msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 msohtmed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E6-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5512D116-5CC6-11CF-8D67-00AA00BDCE1D}\TypeLib\ = "{0D452EE1-E08F-101A-852E-02608C4D0BB4}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0006303C-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000630B0-0000-0000-C000-000000000046} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.OlkTimeControl\CLSID\ = "{0006F051-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E3-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32\InprocServer32 = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b00500072006f0064007500630074004e006f006e0042006f006f007400460069006c00650073003e00640062004b0078002d006c0062006d006600280047006e002c004c005b005b0051007e0043004e0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Forms.ToggleButton.1\CLSID\ = "{8BD21D60-EC42-11CE-9E0D-00AA006002F3}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{0006F054-0000-0000-C000-000000000046}\Typelib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063006-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{23CE100B-1390-49D6-BA00-F17D3AEE149C}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\ProgID\ = "Forms.Form.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{0006F059-0000-0000-C000-000000000046} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002034E-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063044-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5512D11C-5CC6-11CF-8D67-00AA00BDCE1D}\ = "Microsoft Forms 2.0 HTML Hidden" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063034-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EF-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.File.oft.14\shell\ = "Open" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5512D11C-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3920 OUTLOOK.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1844 msiexec.exe 1844 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3920 OUTLOOK.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeSecurityPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2392 Gruel.a.exe 3920 OUTLOOK.EXE 3920 OUTLOOK.EXE 3920 OUTLOOK.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3920 OUTLOOK.EXE 3920 OUTLOOK.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2392 Gruel.a.exe 1988 Gruel.a.exe 2580 Gruel.a.exe 3920 OUTLOOK.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2772 2392 Gruel.a.exe 30 PID 2392 wrote to memory of 2772 2392 Gruel.a.exe 30 PID 2392 wrote to memory of 2772 2392 Gruel.a.exe 30 PID 2392 wrote to memory of 2772 2392 Gruel.a.exe 30 PID 2392 wrote to memory of 2772 2392 Gruel.a.exe 30 PID 2392 wrote to memory of 2772 2392 Gruel.a.exe 30 PID 2392 wrote to memory of 2772 2392 Gruel.a.exe 30 PID 2392 wrote to memory of 2948 2392 Gruel.a.exe 31 PID 2392 wrote to memory of 2948 2392 Gruel.a.exe 31 PID 2392 wrote to memory of 2948 2392 Gruel.a.exe 31 PID 2392 wrote to memory of 2948 2392 Gruel.a.exe 31 PID 2392 wrote to memory of 2948 2392 Gruel.a.exe 31 PID 2392 wrote to memory of 2948 2392 Gruel.a.exe 31 PID 2392 wrote to memory of 2948 2392 Gruel.a.exe 31 PID 2948 wrote to memory of 2648 2948 rundll32.exe 32 PID 2948 wrote to memory of 2648 2948 rundll32.exe 32 PID 2948 wrote to memory of 2648 2948 rundll32.exe 32 PID 2948 wrote to memory of 2648 2948 rundll32.exe 32 PID 2392 wrote to memory of 2832 2392 Gruel.a.exe 33 PID 2392 wrote to memory of 2832 2392 Gruel.a.exe 33 PID 2392 wrote to memory of 2832 2392 Gruel.a.exe 33 PID 2392 wrote to memory of 2832 2392 Gruel.a.exe 33 PID 2392 wrote to memory of 2832 2392 Gruel.a.exe 33 PID 2392 wrote to memory of 2832 2392 Gruel.a.exe 33 PID 2392 wrote to memory of 2832 2392 Gruel.a.exe 33 PID 2392 wrote to memory of 2840 2392 Gruel.a.exe 34 PID 2392 wrote to memory of 2840 2392 Gruel.a.exe 34 PID 2392 wrote to memory of 2840 2392 Gruel.a.exe 34 PID 2392 wrote to memory of 2840 2392 Gruel.a.exe 34 PID 2392 wrote to memory of 2840 2392 Gruel.a.exe 34 PID 2392 wrote to memory of 2840 2392 Gruel.a.exe 34 PID 2392 wrote to memory of 2840 2392 Gruel.a.exe 34 PID 2392 wrote to memory of 2548 2392 Gruel.a.exe 35 PID 2392 wrote to memory of 2548 2392 Gruel.a.exe 35 PID 2392 wrote to memory of 2548 2392 Gruel.a.exe 35 PID 2392 wrote to memory of 2548 2392 Gruel.a.exe 35 PID 2392 wrote to memory of 2548 2392 Gruel.a.exe 35 PID 2392 wrote to memory of 2548 2392 Gruel.a.exe 35 PID 2392 wrote to memory of 2548 2392 Gruel.a.exe 35 PID 2548 wrote to memory of 1988 2548 rundll32.exe 36 PID 2548 wrote to memory of 1988 2548 rundll32.exe 36 PID 2548 wrote to memory of 1988 2548 rundll32.exe 36 PID 2548 wrote to memory of 1988 2548 rundll32.exe 36 PID 2548 wrote to memory of 1988 2548 rundll32.exe 36 PID 2548 wrote to memory of 1988 2548 rundll32.exe 36 PID 2548 wrote to memory of 1988 2548 rundll32.exe 36 PID 2392 wrote to memory of 2704 2392 Gruel.a.exe 37 PID 2392 wrote to memory of 2704 2392 Gruel.a.exe 37 PID 2392 wrote to memory of 2704 2392 Gruel.a.exe 37 PID 2392 wrote to memory of 2704 2392 Gruel.a.exe 37 PID 2392 wrote to memory of 2704 2392 Gruel.a.exe 37 PID 2392 wrote to memory of 2704 2392 Gruel.a.exe 37 PID 2392 wrote to memory of 2704 2392 Gruel.a.exe 37 PID 2392 wrote to memory of 2568 2392 Gruel.a.exe 38 PID 2392 wrote to memory of 2568 2392 Gruel.a.exe 38 PID 2392 wrote to memory of 2568 2392 Gruel.a.exe 38 PID 2392 wrote to memory of 2568 2392 Gruel.a.exe 38 PID 2392 wrote to memory of 2568 2392 Gruel.a.exe 38 PID 2392 wrote to memory of 2568 2392 Gruel.a.exe 38 PID 2392 wrote to memory of 2568 2392 Gruel.a.exe 38 PID 2568 wrote to memory of 2580 2568 rundll32.exe 39 PID 2568 wrote to memory of 2580 2568 rundll32.exe 39 PID 2568 wrote to memory of 2580 2568 rundll32.exe 39 PID 2568 wrote to memory of 2580 2568 rundll32.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL mmsys.cpl @12⤵
- System Location Discovery: System Language Discovery
PID:2772
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL netcpl.cpl2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL netcpl.cpl3⤵PID:2648
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,,02⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL main.cpl @02⤵
- System Location Discovery: System Language Discovery
PID:2840
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL modem.cpl2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe" C:\Windows\system32\rundll32.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1988
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL main.cpl @12⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
PID:2704
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL sysdm.cpl @12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe" C:\Windows\System32\SystemPropertiesComputerName.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2580
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,12⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL timedate.cpl2⤵
- System Location Discovery: System Language Discovery
PID:2588
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL desk.cpl,,02⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
PID:2556
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,02⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:4048
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5653D73238F822F4CF59CE15275EC0A82⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Program Files (x86)\Microsoft Office\Office14\bcssync.exe"C:\Program Files (x86)\Microsoft Office\Office14\bcssync.exe" /shutdown3⤵
- System Location Discovery: System Language Discovery
PID:1908
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C78E5103B117914654B6157D142976CE M Global\MSI00002⤵
- Manipulates Digital Signatures
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2184 -
C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
- Drops file in Program Files directory
PID:3240
-
-
C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
- Drops file in Program Files directory
PID:3364
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe"C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /regserverfp2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:3132
-
-
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3920
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5f8022f019d0dc8810e213c395e298ed9
SHA164428b7689ee1ed871a59d65494c3be55b58220a
SHA25605e5467fe04535ed77d87a49095c7bcfd9e7f9d77f3c694c5c2e5d053427873c
SHA5123aa3de59fb77a6db79544c557896104e75e823673ff6acd3cf1a186e146f6c38f8ba2d64f404e183a783267d8e0077b8da8e8e146031fa462cb418ac9d2fa76d
-
Filesize
583KB
MD50587616e4f4dc27180f5bdeace7a0b3d
SHA1550705fbbc9701b7471e21010f1f35d8e0e4a939
SHA256a51091581dae719f56bd524bb7616f4d72ccdb8a63fe95faf1df72420b47d98e
SHA512b1cdf8b660c8dc3e0145065f431a4ad8eff850bb2f71721eddc710107a12705bafac4a6f4941d926c700ad9a1a5dfe7d04b250833e537cfe43bbccd5e24f9d7e
-
Filesize
2KB
MD5bab2da800f1a336b18a4605225315e65
SHA18658270eb85fb1fed448ce656a82e41ed0211105
SHA256b350d9eef3e708bdd5f75494bf8bb85909016c63b029d3a15054ab544ac62519
SHA512ea324699c1598158367454ee5c652f175cfc825694e9cdbaa7522df37795206345e3cff62cdb030824453a1f66c76efcc2465b057f782df7b3c2f430d7e1b5b4
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Outlook 2010.lnk~RFf76ae97.TMP
Filesize2KB
MD51b12f84d853cd205e915a220425d9a4c
SHA1079ce0396c0e477b137ed9d6d0f60a3edce786bc
SHA2567728c459780979d905aa99d6e2f5eef28908a7324689170dd181ab5e69cb901d
SHA5121be18b389267a58261b050d291b6718e5a66a3d4f23068c684dfacd939c6be1ac5e379e2a80659544910c10acad1ff19d66189312f442b51054049b96052356c
-
Filesize
100KB
MD5b0feccddd78039aed7f1d68dae4d73d3
SHA18fcffb3ae7af33b9b83af4c5acbb044f888eeabf
SHA2565714efd4746f7796bbc52a272f8e354f67edfb50129d5fdaa1396e920956d0d6
SHA512b02b9476eeb9c43fcfef56949f867c1c88f152d65f3961a2838b8bff02df2383945aefb9a8c517ac78d79b5a9163c7677f5b6238f4624b1966994c9c09eb428d
-
Filesize
240KB
MD58513bbe7037b0f08ed58799d9fbc3e93
SHA1dc86f7babd1c3101c81a657b73ead09682c3d6fc
SHA2561d04b2d12555f09edc2ecad2c40a386d145b259bf31d6105e7503ed29a2a88e2
SHA5125a8c26edf4b4a1d54d222a37fb55de1cff8a72e8d79318a62b0d7d5804b5af7f2dcebc20d34b260bf79162bbea80dfe4b4a0df20c0f0ffd63d99a4057f28b4d7
-
Filesize
1KB
MD548dd6cae43ce26b992c35799fcd76898
SHA18e600544df0250da7d634599ce6ee50da11c0355
SHA2567bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a
SHA512c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31
-
Filesize
1KB
MD529e0e345438882a935d2c0baff457f6c
SHA1aef4d88c8c81bc9d9440e1f94f792f6ab83e2b5a
SHA2560c127592f7670047d0b1928fede6ecf7c827b9e8086500b23756e5c02d09a4c6
SHA5128b87df27f7edc9328debeb3a0f68468d1d46615122e815d03330a9682776f85a47ef37889fc210fb28e56d91bf8cf0f0e594f90c3eaff5827dfd57b97a0b359b
-
Filesize
1KB
MD57012d93473e34cf46043452e018d1b0f
SHA19a4b1880ebad4aa887392699d0000320d8e10216
SHA256487773d26dfb8341d3a53fd2453cc5a21b113aab952762eb68b5ad2104eb015f
SHA512cef70cf9d94c0b5b489589a2131c911fbe7eee42c8ca2556c209afe3d8cc9f80be7be6d33beb651fd01f87da2ec74642f57cdf22e060e58c2bb7559c8fca2317
-
Filesize
1KB
MD5159bd6a587f370f16522b2a6f690bcc3
SHA1c07d14fc439997e2f65b982c0702a985b36b9cf8
SHA2569193c9b28f4e19c5fbd00340dce578825fbc6ce6ab67b1c9082c0d8f64446993
SHA512a1ddc058193d778b3935ef8f158bb06f014de72124d5561a4d7af99e77921bcfe5ffcb24a1375917d5e438e0f2a1dccb96c1bdc2fa5b6aaf75ca5cabe1788e46
-
Filesize
1KB
MD57c048eaacd1820ac933dccc0b872fa05
SHA1955999eb7463f7e4031d551e24fbd1e1fb812197
SHA256614d7a9ca519b3aa741a512e95f6f99aedd25e8c1630d30d13dd9735b562b3be
SHA51209f35a1a69344e64b13f0a54ecc82cd7dd1ee9124bfc274fcd5fe8af2a07e30bbf0841d9230591cbbe12bc8f066f5f36e1577b82d5d1f3f0eb6b9b5154ce5d4b
-
Filesize
1KB
MD505471356f0ea1c0f5f5b8deb29c3ebd1
SHA112b14b737d1e0f76ca2494fb7a6841e5792a0504
SHA256cf59479c75a8803468dd2a2c1d2803a2694c41992d5a0b3b65b1c69c28d1eac7
SHA512942285259612792c2b3a45a65483e0775314841e397e815d447fd8f69f63f5de1ac48653a051c0121bd73415655c468772d39ce72bb1ba3d8ae367f78143502b
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
85KB
MD55577a98daef4ba33e900a3e3108d6cc1
SHA15af817186ab0376a0433686be470ea2b48c74f5f
SHA256148199b4f3b6b2030e2aeb63a66e8e333e692d38691bcbe39139cf02bb61b31d
SHA512d37d511975b5331a5b1cdda736890c7d4f2dcba4abac2b9399c977bdb7e09c964327e3f771cd592e2632b0e776545c490f29fd391ec13c7948557957cd805dd5
-
Filesize
32KB
MD58d4c7e2792f92d8e7cba3098a54c8e66
SHA1d21b486f78aef95b7041d7e6966568ac3c550e3a
SHA256aaf3e53a1a1aeadac1339b20e256eabc29502a9a583a7c18b29d6bba2adb1ab0
SHA512b81598b2c47ebe78fb9851254b576885e7ba68b637337378c9e8e7928c72ffc89734c9a729dcb947aa64f8a89f07ef9c1751f64526e60cd72931b92662d2b91a
-
Filesize
350KB
MD59caf5e1999a4bd6ab8c4d4ea07818a7d
SHA1fb1fe1d18fb670fbbf7461f449a473778b711717
SHA256813ebc09bb3144d76f6f3a1550877c21590e0776f893915ca1178672e84ca1e7
SHA512d40a70f7718adc63a21758ce43bd0c3f71abf4a4b7dd0639be3decf326a1b3281ac1043c519fd3f5cbae5ed6b3e59e3bd8d583c2ae253529fdd6d5225f41ab74
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
107KB
MD59f0b9bc54bb73dfb7cf85520da1a08cb
SHA1236f7b770317d782f0817fbf7542140cb1e1526e
SHA2560d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f
SHA5128acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d
-
Filesize
148KB
MD533908aa43ac0aaabc06a58d51b1c2cca
SHA10a0d1ce3435abe2eed635481bac69e1999031291
SHA2564447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783
SHA512d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46
-
Filesize
214KB
MD5399075975c41f7e85b12bc6668f59cf3
SHA104f5140a93f4fd7721cd305d12cdb80d75b36a16
SHA256b5129d385ac5d296142ba97faf663ffbb6c50761fc414d4528d8b8a26bc31ac3
SHA5121266087db1d06405ccdb4e3cfc8f086b361da2a276a62dcbd2ecfa4532571cf57fdc568b07493fb5d0d9171c1eac8b9d371cd3e35600ee08b108b2688c0c95bf
-
Filesize
83KB
MD59471017b246f1b3dbbd8984ecc1f4293
SHA1d498d3f0fdf3c5d90e244094f3df3e618da36341
SHA256e75f900e7240da9993c267a11f5a68d4c2cebb205fa690200bcdf8e1d0b6e7d8
SHA512d950f8e613b8585ba8148cad5731134105bf992d160cdedffdf914e78e7b9f1eac0fa3d1071c87343ee942a92ad8ebd1970850edb5fb278326ef03e9ab4160c7
-
Filesize
114KB
MD500c3f5ca474a20c4a8dfb263a3950dad
SHA178b00a2e0490e1664af4d86fdbd3ac78330d21d4
SHA2569d849a8f5b39941ea32d47f0529977b1870f648736a483d86682436e3d3db748
SHA51220a8a8655b61b464f29329a70daa95a36c8c54b549bbec26ed93c63097d6d7a4c0a3ca1cb9a85a0521d298885c00f22fbfa28abf9aa33737056b48cc0ebead9d
-
Filesize
134KB
MD5b8255a1bc3c307557741d2c99b8256d1
SHA148cc6f3c1a566f06684c5184cf830cbd7db638c2
SHA256796aea9a46fb7704222a7fe1f4e27455b14640c816d6f961344f89dc47537b33
SHA51285f685ad84f2208ad87ff34fb5e99edae50fc938a9335cb9747b7707d237c1b397c318090112eee0e9f04777ee004e26e7377f57c3e31159a96638b65110a69c
-
Filesize
407KB
MD5e68712aa60972bc259acfcdc0a9e1813
SHA14aae1a7a21aead497ba777a61d9b470d40276dcd
SHA25631ffdcbeb12118e82c80b9f1aa2a08dd46ab673ba2c7ec4138e4507b3edc0fa3
SHA512eee968934b32d68273521695036b3e90e6e7efe4454def43426e3be0b14338dd01e5b5fd32fb027752bf80b3468eaff96355de0982809c1fefc775d359bf6c8d
-
Filesize
19KB
MD59cadbfa797783ff9e7fc60301de9e1ff
SHA183bde6d6b75dfc88d3418ec1a2e935872b8864bb
SHA256c1eda5c42be64cfc08408a276340c9082f424ec1a4e96e78f85e9f80d0634141
SHA512095963d9e01d46dae7908e3de6f115d7a0eebb114a5ec6e4e9312dbc22ba5baa268f5acece328066c9456172e90a95e097a35b9ed61589ce9684762e38f1385b
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
571KB
MD55a1e6b155435693938596d58eaca74bb
SHA127fb323ccc215136ef350469072b6ad559d39c3d
SHA256f2d5eb947b85f763f72de7f800118844a5207c9e3dd456f13186c2aaf0c485ac
SHA5124fee8576ef5541d4923aacb514b09e1e4dc8d6cbb1dcaada67c65240358147b971c2a1d034faf50c594ae7edb4a3c68dd4ffbbb69893413ffb52e71a86c65388