3dc1b6e80be4f1d55cb81f184e631a494ade7a95abf35df066466867a316f16c

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20240903-de
resource tags

arch:x64arch:x86image:win7-20240903-delocale:de-deos:windows7-x64systemwindows
submitted
11/02/2025, 18:14

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

d86cd0522385c94d127a8a687fcde9bbfe2f025d061b050458b03a75e908a97a.msi
Size

2.9MB
MD5

9a70f71e961db28a61f88b5a401cc6b9
SHA1

afc84d322954f1c543a24f354885a2a9938a9118
SHA256

d86cd0522385c94d127a8a687fcde9bbfe2f025d061b050458b03a75e908a97a
SHA512

b9747e78e6b03631093ac57a3bd6a7c8ab1f2ee724589db1fd9e282ef5f3be81e0499652977567f815bcf26d1f3fa3470e7b59890986ced94043b8c0d37da209
SSDEEP

49152:++1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:++lUlz9FKbsodq0YaH7ZPxMb8tT

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2408	msiexec.exe
5	2408	msiexec.exe
7	2408	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF	DrvInst.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f76e56f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE62C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECB3.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\volsnap.PNF	DrvInst.exe
File created	C:\Windows\Installer\f76e56f.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2408	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\67BDC06\LanguageList = 640065002d0044004500000064006500000065006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2408	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeSecurityPrivilege	2760	msiexec.exe
Token: SeCreateTokenPrivilege	2408	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2408	msiexec.exe
Token: SeLockMemoryPrivilege	2408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2408	msiexec.exe
Token: SeMachineAccountPrivilege	2408	msiexec.exe
Token: SeTcbPrivilege	2408	msiexec.exe
Token: SeSecurityPrivilege	2408	msiexec.exe
Token: SeTakeOwnershipPrivilege	2408	msiexec.exe
Token: SeLoadDriverPrivilege	2408	msiexec.exe
Token: SeSystemProfilePrivilege	2408	msiexec.exe
Token: SeSystemtimePrivilege	2408	msiexec.exe
Token: SeProfSingleProcessPrivilege	2408	msiexec.exe
Token: SeIncBasePriorityPrivilege	2408	msiexec.exe
Token: SeCreatePagefilePrivilege	2408	msiexec.exe
Token: SeCreatePermanentPrivilege	2408	msiexec.exe
Token: SeBackupPrivilege	2408	msiexec.exe
Token: SeRestorePrivilege	2408	msiexec.exe
Token: SeShutdownPrivilege	2408	msiexec.exe
Token: SeDebugPrivilege	2408	msiexec.exe
Token: SeAuditPrivilege	2408	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2408	msiexec.exe
Token: SeChangeNotifyPrivilege	2408	msiexec.exe
Token: SeRemoteShutdownPrivilege	2408	msiexec.exe
Token: SeUndockPrivilege	2408	msiexec.exe
Token: SeSyncAgentPrivilege	2408	msiexec.exe
Token: SeEnableDelegationPrivilege	2408	msiexec.exe
Token: SeManageVolumePrivilege	2408	msiexec.exe
Token: SeImpersonatePrivilege	2408	msiexec.exe
Token: SeCreateGlobalPrivilege	2408	msiexec.exe
Token: SeBackupPrivilege	2892	vssvc.exe
Token: SeRestorePrivilege	2892	vssvc.exe
Token: SeAuditPrivilege	2892	vssvc.exe
Token: SeBackupPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2348	DrvInst.exe
Token: SeRestorePrivilege	2348	DrvInst.exe
Token: SeRestorePrivilege	2348	DrvInst.exe
Token: SeRestorePrivilege	2348	DrvInst.exe
Token: SeRestorePrivilege	2348	DrvInst.exe
Token: SeRestorePrivilege	2348	DrvInst.exe
Token: SeRestorePrivilege	2348	DrvInst.exe
Token: SeLoadDriverPrivilege	2348	DrvInst.exe
Token: SeLoadDriverPrivilege	2348	DrvInst.exe
Token: SeLoadDriverPrivilege	2348	DrvInst.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2408	msiexec.exe
2408	msiexec.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2120	2760	msiexec.exe	36
PID 2760 wrote to memory of 2120	2760	msiexec.exe	36
PID 2760 wrote to memory of 2120	2760	msiexec.exe	36
PID 2760 wrote to memory of 2120	2760	msiexec.exe	36
PID 2760 wrote to memory of 2120	2760	msiexec.exe	36
PID 2760 wrote to memory of 2120	2760	msiexec.exe	36
PID 2760 wrote to memory of 2120	2760	msiexec.exe	36
PID 2760 wrote to memory of 2240	2760	msiexec.exe	37
PID 2760 wrote to memory of 2240	2760	msiexec.exe	37
PID 2760 wrote to memory of 2240	2760	msiexec.exe	37
PID 2760 wrote to memory of 2240	2760	msiexec.exe	37
PID 2760 wrote to memory of 2240	2760	msiexec.exe	37
PID 2760 wrote to memory of 2240	2760	msiexec.exe	37
PID 2760 wrote to memory of 2240	2760	msiexec.exe	37

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d86cd0522385c94d127a8a687fcde9bbfe2f025d061b050458b03a75e908a97a.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2408

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 96295F51B224DB7449335231424EAA59
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2120
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5753DCA303DFDCF846FEDCADD4DFD9DE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1336

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000600" "00000000000005CC"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
e242e879ac7e69a50d90b031da6dd7be

SHA1
664aedee6aed13e5ffb04b2e55027b62a1dca424

SHA256
117ea178466c2511e2a5f8aa6ba60aa395e33d47ca8a7778d7126b172b4bc7ed

SHA512
252515fab4dbefe9a820ce3c972a5596a017ffc94bdaec9bf1cba97debe9d516949f19936ac50a604d4f6822b0254e740dd52f53482101ae39be9a20875387b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Filesize
727B

MD5
17c3144b951201b5c7ba287c302e30db

SHA1
aae8469d67066d1def775b7e2a24de2ff312c642

SHA256
347c70bbd5ac08ce5107a28597033c075b518d1404703dfdc2043cc36ab56c00

SHA512
088550c13e80ebf16b4bb542a0a3ba1df2c9d3a98008b293accd1a1aa4019c0917bb970d8b349afd9fb365c892107251d5aea5f16d27bb18c582545ebd64a6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
d7909c7cd997af5e26a89920cd8b320a

SHA1
058e556bd3abd9b117a6a159f1f9baef60ba9bc5

SHA256
45c8301f0b9cd3c3a363ce79b38d3b1488eab1ab81782ec375a16101ed7e740b

SHA512
03c41ce3220fd87e22911ee5a4571bc374eb4f93871c39fd4419b91b4ed110cdcedb6138e652ba7d5937573bee5fa7d18346692c4be779210d31d0d50d3f0256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
29436a09d639bb0a4631c281ac9cdf77

SHA1
c946c918af0837508dade5988ab27b09a29c739d

SHA256
871e10c59795ff12e999a04916fb0a1ae683aa8cf0f263000d77237669ac22f1

SHA512
8304774c8d793214e3254dc9267530b55e11e527eef641e3f61902584236b02bb4a458f66fbde68710d5a8e9aaf374a2eaefc5e484c446392995a4913d4fc141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Filesize
404B

MD5
4e0bb9914ee962f7667c71ba5fc1689f

SHA1
5107ca692454d4688604fef4c48a769e6d61e058

SHA256
c07dac00bb74f7cc67a1ba763788948a1c5bb07faea9fc19d03fd16104ebe77b

SHA512
49a3d036ed074cae7fc46d0e394ea8a0e0c822b84256646f417eef541eea5732206a15a16220df7f06ea48abb34a83960dbaeb0b7743cd7d461f40b3e5228cf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
719801d3cf37f96261b85a2525ac7e12

SHA1
da4def556f26a99cfbc7adcf4999556cd8ca33c1

SHA256
5eb266a4e508a3c956d35a9190bddc80d5872ff29a9bed8f64cbf462e6af0a5c

SHA512
0749c4e1a22f38548daffb8d9f59a543260757aeea23c91664230678bdb568f82444f71719111fb482bcfd00480fb46553e28795095700e2099c23b3da7775a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
0fadc4b7cb387616a20511f9b831ff41

SHA1
f91fbab2b3c3e0580985d17329a052af4638dd92

SHA256
235d0199e08bb69281fbab255be074330c406a5a090502a4e45a7d14c6488c42

SHA512
0389a2b1109bc6f9e8aacc251ef3789d55b2eaf206b1bc0c3a831afc5bf578dbdd4d7d2a14b71a04210ee9af2280e555f8a068cc81feb914b3678310d42f9fda

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC370.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC42E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF

Filesize
5KB

MD5
d700ec0e99f3c18f78ff27d7a1fb90a3

SHA1
c3c04b3ecffec472995899de2c9b17ef19ee22d8

SHA256
a08e2e90193f4f8654ea813aa4355af00a8e634a29150812dc5e8cfe4916eb2f

SHA512
f222db9d8c1a6f882541d54959a8e78a59f1f4d8e96b985ff453b2003848ff0915cadf21ba90a3a0e38bf5c4e0f97c0d2e3c7a580b75b8d64eb61397167f2b1e

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads