mimic | 6c62da469a894fa0a40c6e3b6d9f8b5dc8ea7a03b82879e4627435c9fa748963

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/04/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-13_9f95431f1ee85dab9e7cccce4411cb77_elex_mimic_pay2key_wannacry.exe
Size 3.0MB
Sample260413-te8hesfv5y
SHA256 6c62da469a894fa0a40c6e3b6d9f8b5dc8ea7a03b82879e4627435c9fa748963
MD5 9f95431f1ee85dab9e7cccce4411cb77
SHA1 67802367dbd0d7666f6618a65aaa229d28fea3ae
SHA512 f0b149d901fb00004492ef69332fbce31e3628afd4066e8ded53f7fba6ff52a08467b03048bd5732337f19233e60395b37b3e902d14418d2ee8a773cd586b84f
SSDEEP 98304:wgwRivguPPMqOVhThtsxrelreBpJqCB111XH:wgLvIVh0xreUcCjb3
TLSH
T17FE5331276EB0AB1D0D21AF2179C573B1EF8B6251B1A0BE7879065234B313C66B783DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution mimic persistence ransomware

Malware Config

Signatures

Family: Mimic
Ransomware family was first exploited in the wild in 2022.
ransomware mimic

Detects Mimic ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b45b-43.dat	family_mimic

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b45b-43.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b45b-43.dat	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b45b-43.dat	INDICATOR_SUSPICIOUS_USNDeleteJournal

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b45b-43.dat	INDICATOR_SUSPICIOUS_ClearWinLogs

Detects executables packed with ConfuserEx Mod 4 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b45d-71.dat	INDICATOR_EXE_Packed_ConfuserEx
behavioral2/files/0x001900000002b45c-68.dat	INDICATOR_EXE_Packed_ConfuserEx
behavioral2/memory/4300-91-0x00000000005C0000-0x000000000060E000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx
behavioral2/memory/4300-93-0x0000000000E90000-0x0000000000EE4000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe	payfast.exe

Executes dropped EXE 10 IoCs

pid	Process
3512	7za.exe
4424	7za.exe
2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
4476	payfast.exe
3340	Everything.exe
4300	gui40.exe
4956	payfast.exe
564	payfast.exe
1852	payfast.exe
236	DC.exe

Loads dropped DLL 5 IoCs

pid	Process
2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
4476	payfast.exe
4956	payfast.exe
564	payfast.exe
1852	payfast.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell\open	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	payfast.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell\open\command	payfast.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	payfast.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell\open\command	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	payfast.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\payfast = "\"C:\\Users\\Admin\\AppData\\Local\\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\\payfast.exe\" "	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe

Power Settings 1 TTPs 15 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
900	powercfg.exe
480	powercfg.exe
4360	powercfg.exe
1444	powercfg.exe
1936	powercfg.exe
484	powercfg.exe
2168	powercfg.exe
3904	powercfg.exe
4964	powercfg.exe
3096	powercfg.exe
696	powercfg.exe
4692	powercfg.exe
1640	powercfg.exe
1660	powercfg.exe
568	powercfg.exe

ConfuserEx .NET packer 3 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/files/0x001900000002b45d-71.dat	ConfuserEx
behavioral2/files/0x001900000002b45c-68.dat	ConfuserEx
behavioral2/memory/4300-93-0x0000000000E90000-0x0000000000EE4000-memory.dmp	ConfuserEx

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\javafx-src.zip.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\GrantSuspend.docx.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\LICENSE.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\release.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\LICENSE.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
File opened for modification	C:\Program Files\ConnectEnter.zip.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4740	powershell.exe
5072	powershell.exe
1820	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	payfast.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	payfast.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-13_9f95431f1ee85dab9e7cccce4411cb77_elex_mimic_pay2key_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	payfast.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	payfast.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\Decrypt_files.txt\""	payfast.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell\open\command	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg\ = "mimicfile"	payfast.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell\open\command	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	payfast.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.kfesu3g60b5-4XBwo-2buxaAYadkvmOqkBaW9ce2_48CugdmZ1EnMQg	payfast.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell	payfast.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell\open	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	payfast.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	payfast.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4300	gui40.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
4476	payfast.exe
5072	powershell.exe
5072	powershell.exe
4740	powershell.exe
4740	powershell.exe
1820	powershell.exe
1820	powershell.exe
5072	powershell.exe
1820	powershell.exe
4740	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3512	7za.exe
Token: 35	3512	7za.exe
Token: SeRestorePrivilege	4424	7za.exe
Token: 35	4424	7za.exe
Token: SeSecurityPrivilege	4424	7za.exe
Token: SeSecurityPrivilege	4424	7za.exe
Token: SeIncreaseQuotaPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeSecurityPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeTakeOwnershipPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeLoadDriverPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeSystemProfilePrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeSystemtimePrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeProfSingleProcessPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeIncBasePriorityPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeCreatePagefilePrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeBackupPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeRestorePrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeShutdownPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeDebugPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeSystemEnvironmentPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeChangeNotifyPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeRemoteShutdownPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeUndockPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeManageVolumePrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeImpersonatePrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeCreateGlobalPrivilege	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: 33	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: 34	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: 35	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: 36	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Token: SeIncreaseQuotaPrivilege	4476	payfast.exe
Token: SeSecurityPrivilege	4476	payfast.exe
Token: SeTakeOwnershipPrivilege	4476	payfast.exe
Token: SeLoadDriverPrivilege	4476	payfast.exe
Token: SeSystemProfilePrivilege	4476	payfast.exe
Token: SeSystemtimePrivilege	4476	payfast.exe
Token: SeProfSingleProcessPrivilege	4476	payfast.exe
Token: SeIncBasePriorityPrivilege	4476	payfast.exe
Token: SeCreatePagefilePrivilege	4476	payfast.exe
Token: SeBackupPrivilege	4476	payfast.exe
Token: SeRestorePrivilege	4476	payfast.exe
Token: SeShutdownPrivilege	4476	payfast.exe
Token: SeDebugPrivilege	4476	payfast.exe
Token: SeSystemEnvironmentPrivilege	4476	payfast.exe
Token: SeChangeNotifyPrivilege	4476	payfast.exe
Token: SeRemoteShutdownPrivilege	4476	payfast.exe
Token: SeUndockPrivilege	4476	payfast.exe
Token: SeManageVolumePrivilege	4476	payfast.exe
Token: SeImpersonatePrivilege	4476	payfast.exe
Token: SeCreateGlobalPrivilege	4476	payfast.exe
Token: 33	4476	payfast.exe
Token: 34	4476	payfast.exe
Token: 35	4476	payfast.exe
Token: 36	4476	payfast.exe
Token: SeDebugPrivilege	4300	gui40.exe
Token: SeIncreaseQuotaPrivilege	1852	payfast.exe
Token: SeSecurityPrivilege	1852	payfast.exe
Token: SeTakeOwnershipPrivilege	1852	payfast.exe
Token: SeLoadDriverPrivilege	1852	payfast.exe
Token: SeSystemProfilePrivilege	1852	payfast.exe
Token: SeSystemtimePrivilege	1852	payfast.exe
Token: SeIncreaseQuotaPrivilege	564	payfast.exe
Token: SeProfSingleProcessPrivilege	1852	payfast.exe
Token: SeSecurityPrivilege	564	payfast.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3340	Everything.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3512	3480	2026-04-13_9f95431f1ee85dab9e7cccce4411cb77_elex_mimic_pay2key_wannacry.exe	80
PID 3480 wrote to memory of 4424	3480	2026-04-13_9f95431f1ee85dab9e7cccce4411cb77_elex_mimic_pay2key_wannacry.exe	82
PID 3480 wrote to memory of 2144	3480	2026-04-13_9f95431f1ee85dab9e7cccce4411cb77_elex_mimic_pay2key_wannacry.exe	84
PID 2144 wrote to memory of 4476	2144	ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe	85
PID 4476 wrote to memory of 3340	4476	payfast.exe	87
PID 4476 wrote to memory of 4300	4476	payfast.exe	86
PID 4476 wrote to memory of 4800	4476	payfast.exe	88
PID 4476 wrote to memory of 4956	4476	payfast.exe	89
PID 4476 wrote to memory of 564	4476	payfast.exe	90
PID 4476 wrote to memory of 1852	4476	payfast.exe	91
PID 4800 wrote to memory of 236	4800	cmd.exe	93
PID 4476 wrote to memory of 484	4476	payfast.exe	95
PID 4476 wrote to memory of 480	4476	payfast.exe	96
PID 4476 wrote to memory of 3096	4476	payfast.exe	97
PID 4476 wrote to memory of 696	4476	payfast.exe	98
PID 4476 wrote to memory of 2168	4476	payfast.exe	99
PID 4476 wrote to memory of 3904	4476	payfast.exe	100
PID 4476 wrote to memory of 4360	4476	payfast.exe	101
PID 4476 wrote to memory of 4964	4476	payfast.exe	102
PID 4476 wrote to memory of 1444	4476	payfast.exe	103
PID 4476 wrote to memory of 1640	4476	payfast.exe	104
PID 4476 wrote to memory of 4692	4476	payfast.exe	105
PID 4476 wrote to memory of 1660	4476	payfast.exe	106
PID 4476 wrote to memory of 568	4476	payfast.exe	107
PID 4476 wrote to memory of 1936	4476	payfast.exe	108
PID 4476 wrote to memory of 900	4476	payfast.exe	109
PID 4476 wrote to memory of 1820	4476	payfast.exe	110
PID 4476 wrote to memory of 5072	4476	payfast.exe	111
PID 4476 wrote to memory of 4740	4476	payfast.exe	112

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	payfast.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	payfast.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	payfast.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	payfast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	payfast.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	payfast.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-13_9f95431f1ee85dab9e7cccce4411cb77_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-13_9f95431f1ee85dab9e7cccce4411cb77_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p2721026812690125593 Everything64.dll
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\payfast.exe
    "C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\payfast.exe"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4476
  - - C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\gui40.exe
      C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\gui40.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4300
  - - C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\Everything.exe
      "C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3340
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c DC.exe /D
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\DC.exe
        
        DC.exe /D
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:236
  - - C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\payfast.exe
      "C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\payfast.exe" -e watch -pid 4476 -!
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4956
  - - C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\payfast.exe
      "C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\payfast.exe" -e ul1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:564
  - - C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\payfast.exe
      "C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\payfast.exe" -e ul2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1852
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -H off
      4⤵
      Power Settings
      PID:484
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      Power Settings
      PID:480
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      Power Settings
      PID:3096
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      Power Settings
      PID:696
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      Power Settings
      PID:2168
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      Power Settings
      PID:3904
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      Power Settings
      PID:4360
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      Power Settings
      PID:4964
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      Power Settings
      PID:1444
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      Power Settings
      PID:1640
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      Power Settings
      PID:4692
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      Power Settings
      PID:1660
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      Power Settings
      PID:568
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      Power Settings
      PID:1936
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
      4⤵
      Power Settings
      PID:900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

global_options.ini

Path C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\global_options.ini
Size 14KB
SHA256 56945b59ea30438a5e8d5b455bbb4a1e13eb2435dd6db2093a2a859d1cab020d
MD5 a1ccf4bb4f9b1c3fd17ddc2126013754
SHA1 de196b2a6e3a58056dc3438c3907ef1bdb33d793
SHA512 52762eb130a398bc28b74be83245e265566ad68c5bad8f162bf625f286f62eed4bbd6bc32d1736ffc0d77f0dbdf050755e6c81d69a50b92fdf3446a315c5347c
SSDEEP 192:4qPXBSB7k3DfcMIH9GZgy6kMdyMwZfCshSfGo3ssQ7eQcCKUdDnY:9UtkBgy6mqfh3snGCKUdDY
TLSH
T13652826C1AE764C5B2B35B59DFF780B74B2AB8522C15A42D072D050B0D6AE1DEC2373A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

global_options.ini

Path C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\global_options.ini
Size 13KB
SHA256 178bf245033439ef5c6019130cd0641ab867895176595351359fd8f1e60099d8
MD5 078c373a6b2223077e48a26e7aa55dda
SHA1 55c0d13bffc5db3eb1c40d322bb0d2feb2188360
SHA512 0fad3c560f2edc9ac3b9fa7637872653bcc47356230ea365d1fd3a98ecc757df9b234f8d18940c88f62167bc59f9877b03decb076fc6adbcf1b6eed7c9d91258
SSDEEP 192:9BCB7k3LfcMIH9GZgy6kMIyMwZfCspqSf77U3ssQ7eQcCKUdDZ:Otkpgy673f03snGCKUdDZ
TLSH
T13352806C1AE764C5F2B25B59DFF780B74B2AB8121C19A42D072D150B0D6AE1DEC2373B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

global_options.ini

Path C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\global_options.ini
Size 14KB
SHA256 17bb33fd0cb2cf8d10b83053dec5eb5f7824a1558d9fa4b526c9bfee1c9b6d1f
MD5 eedc75c04056633cef3491308d4cb978
SHA1 f2ef6226f6b8f79d6afe959c0030a16debe4ed41
SHA512 69ff8e934fd45709e2ba6c66791d17b171e2d29cae276d689eeb131224e19b208e0e5112a586a70880dc74a9282608ec00fd6cdddf0b87b8658f7ec66fe67bca
SSDEEP 192:r/CBCB7k3LfcMIH9GZgy6kMIyMwZfCspqSf77U3ssQ7eQcCKUdD/+:Vtkpgy673f03snGCKUdDW
TLSH
T13252A26D1AE764C5F2B25B58DFF780B74B2AB8122C19A42D075D050B0D6AE1DEC2373B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

session.tmp

Path C:\Users\Admin\AppData\Local\C7CDD258-44CC-E75B-3F3D-D1B2B27821FF\session.tmp
Size 32B
SHA256 9374680801da5ad80a524946152591706f2eade5aa9c4260ad0a3d0b33755798
MD5 3b06ae140af4ca23ad17fb59914e44cc
SHA1 95e8fc1aaa72d252160e7b4c371481bbc61e7ad2
SHA512 3758bb4d1045c03011913358bc281f3ac80cf70c4a171617dfb3b0e06e622ce1cf39299a7c02eaf56bd6c48170f88d239a649107724bdf84b8d45475d0a94074
MD5 SHA1 SHA512

Submit Download

Decrypt_files.txt

Path C:\Users\Admin\AppData\Local\Decrypt_files.txt
Size 3KB
SHA256 769ef33337c208d0d1b01fb7044f6e51caf5d5116701a16c70949c1ce5ba6815
MD5 2bc3a92e269c5a903643315437d43b32
SHA1 d92cb4e96db091d5666deb26bbf25105b22c74e2
SHA512 6cb231559a9d49df067cc25a154ba632b9fbd8a3efb39dee9fca2e8258105f3362a918490dd450296a6be1e18ab26c4f7d1840434a69f80c96b5252f16be43e0
TLSH
T10161BD640A9674CE1104F407DC28B90D7DD724FE7FFB2365315A3A2E76E1578863C50A
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0646223d9650a9dbcb7d4230b3dd5712eeddd828100b6542e287fd811ef9a1a2
MD5 5ed6dce4b2677bceef48abecf26db312
SHA1 e149659d457beb33956762a802a27987b691761e
SHA512 c8873c6b3d9deed82ab4fdb9314b1e56c94ee1b286b0020c72f815fa3f1e2eb88390aadbf850c54c99b311f7c757cc233a5d2dc5f3d05e913c53450cc97880ba
TLSH
T16B217933B3ECC565C8D9117A208DAD00B2B5C3C7449E8F8B7A84C629957F9DADF541A4
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
Size 772KB
SHA256 ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
MD5 b93eb0a48c91a53bda6a1a074a4b431e
SHA1 ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA512 732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
SSDEEP 24576:DFhjj7f4K+ao308d0ORMz27R0iIdclDJiD:JlwpP90OFWxD
TLSH
T1D3F48D227AE5D0BBC2521131CA1C7BF691F5E3190B2448C363908F6EAB359D5DA3BE1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DC.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe
Size 802KB
SHA256 c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
MD5 ac34ba84a5054cd701efad5dd14645c9
SHA1 dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA512 df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
SSDEEP 12288:NaWzgMg7v3qnCiPErQohh0F4uCJ8lnyIQJ9QudhzYOekDXiGt8PSmQ:MaHMv6CrrjSnyIQ8+ekGA8PSmQ
TLSH
T1B605CF12B3D680B6D99338B1297BE32BEB3565194327C4C7A7F02E739F211509B3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ENC_default_1733995284_default_1733995284_2024-12-12_01-23-11=kfesu3g60b5.exe
Size 2.3MB
SHA256 8016fbdc697e13a69fd3cfa5a07a7c06821df80d1dd096a02944cf9c39241396
MD5 f726bbcf6e9e464aab5eea9e7865fc43
SHA1 f21b506c3f3351f9e913fe7cc8fc5ca3ce1fbba5
SHA512 52d813e454a672be166e3e24681dbe71e767c7c4567871cb72c7bafa76a7f6b5c03524680fa2fc74de076d54d02d926f57425d47e9a8f0848f47514976124986
SSDEEP 49152:8lhR5no/qrf5EQlRUhNAw6IN0ny2C7OoZGtPENNCr405abBkYx9k484:8lhRuiVhG/o80ny2CnZGaHCf58f
TLSH
T138B5D002FBC28172E192467491B6A77F8A3EBA249734C5C797D0197989313C36B3F3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe
Size 1.7MB
SHA256 4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
MD5 c44487ce1827ce26ac4699432d15b42a
SHA1 8434080fad778057a50607364fee8b481f0feef8
SHA512 a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
SSDEEP 49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH
TLSH
T13D857C42A7D344B1FD8A6637212F6713573AAB0D4313E5DF96902C70AC712F32A7E296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything.ini

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini
Size 548B
SHA256 2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
MD5 742c2400f2de964d0cce4a8dabadd708
SHA1 c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA512 63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
TLSH
T181F03020DB7D985C75B2DE74E4A2791002E623BCAE302494038D0EC77CCEACBA52B0DD
MD5 SHA1 SHA512 TLSH

Submit Download

Everything2.ini

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini
Size 550B
SHA256 89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
MD5 51014c0c06acdd80f9ae4469e7d30a9e
SHA1 204e6a57c44242fad874377851b13099dfe60176
SHA512 79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
TLSH
T11DF03620D77D945C35B2DE74E492751002D653BCAE302494038D0EC77DCDACB952B0DD
MD5 SHA1 SHA512 TLSH

Submit Download

Everything32.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
Size 84KB
SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
MD5 3b03324537327811bbbaff4aafa4d75b
SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
TLSH
T179834B15295348B3F24A1831E6C642C27FBF6D433BD2A4FFFB5705854A903C5BA792A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything64.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll
Size 2.1MB
SHA256 d074c34f7cf1655033440f683ee6233d128f8da75290b1c8b3cf986e259e355c
MD5 53186e6a63ac76f91de549d71946c15c
SHA1 4ca6b45d7df64d1be2cfe90a71cbdf670cced1be
SHA512 db39154b02ca9866521a94872413b17c409da390e9599728f184f6d27571af3db99fe746c018ace45909a95b7c7dfdb797086deb9af31afc66942294bccf7fd9
SSDEEP 49152:v0mQTlHFzia9/Vq2Fso88jnpAcb9eFlAMJD9iFCBMVlj9W:MBHFziatVo9CDhAqMJQCBMVB9W
TLSH
T109A533A2D4BF0E3019D25DC52BED463F6E9C7822B1061F789600F0234A363CA6B947ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gui35.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\gui35.exe
Size 276KB
SHA256 1822e2611373475de055c769d49acffc6ef8796e8e0d0e0a0dc0a77a42451349
MD5 470264fc917927b78af9ca5c6033e140
SHA1 dd0a62105d7f1449ab882cc2f9e89f411c879526
SHA512 9332dccfc5c86cd38450dcf8542ce45731e9c3b92d35a67e46b90725d20386385764a6c5dc33b12ce6bbe84ba2ad356dc9bd11a85793de122f84805aef86f6b8
SSDEEP 6144:EYtVF7HwRdJbWPtssmiu44MYL7TiNsd7HyeuarFdMiRE40hNDRT:EM5QRiyMYLsCLyu5dhE40hNDRT
TLSH
T18D548DDD722076DFC857C4729EA82DA8EB6174BB431B5217D42712EDAA4C897CF180F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gui40.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\gui40.exe
Size 277KB
SHA256 276a3503e2ee9476cd173d3305019d98fabc928ede3975a85cc5a5f4aab43c79
MD5 7e274fe8a140bf82912bcaab09f4398d
SHA1 75ab00c393282b3513aff20a959282a788352bf5
SHA512 e07e0981558e4e89a11b7cc69e364d07737378a96d57b0ab9b492514970a762dca8b9f47a3e0b82d2f50cb3acf083d30badde42a703ad2e2a96ed4b4977bf918
SSDEEP 6144:rNtHW7epbTZjoShkCmaqOYccugZbW7OzwkFxZzl7lc6aIj:rNtHSepJkuqOYbVi6zwktzl7lc6aIj
TLSH
T1F0548C9D326035DEC867D472DE982DA8EA6074BB531F8253A42316EDDE4C897DF240F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdel.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\xdel.exe
Size 350KB
SHA256 e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
MD5 803df907d936e08fbbd06020c411be93
SHA1 4aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA512 5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
SSDEEP 6144:OBgL/kqXQangs2iKn5yvfj7wZxPzzLHrNJT7V:QgL5ga0iKn5GfPwZRT5
TLSH
T1EF745B10BAC08071D2B33D304BB9E6725DBE78311E359A8F53A819795F74690EA35B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fgcvt4ga.cik.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fgcvt4ga.cik.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-137-0x0000000001BA0000-0x0000000001C7F000-memory.dmp

Download

memory/564-258-0x0000000001070000-0x000000000114F000-memory.dmp

Download

memory/1820-191-0x000001BE15AD0000-0x000001BE15B7F000-memory.dmp

Download

memory/1820-190-0x000001BE14020000-0x000001BE1402C000-memory.dmp

Download

memory/1820-192-0x000001BE15A80000-0x000001BE15A92000-memory.dmp

Download

memory/1820-184-0x000001BE2E5D0000-0x000001BE2E5EA000-memory.dmp

Download

memory/1820-182-0x000001BE2E570000-0x000001BE2E57A000-memory.dmp

Download

memory/1820-181-0x000001BE2E590000-0x000001BE2E5AC000-memory.dmp

Download

memory/1820-180-0x000001BE2E410000-0x000001BE2E41A000-memory.dmp

Download

memory/1820-166-0x000001BE2E330000-0x000001BE2E34C000-memory.dmp

Download

memory/1852-259-0x0000000000E20000-0x0000000000EFF000-memory.dmp

Download

memory/2144-102-0x00000000016C0000-0x000000000179F000-memory.dmp

Download

memory/2144-103-0x00000000016C0000-0x000000000179F000-memory.dmp

Download

memory/3340-107-0x00000000016E0000-0x00000000017BF000-memory.dmp

Download

memory/3480-101-0x0000000000990000-0x0000000000A6F000-memory.dmp

Download

memory/3480-104-0x0000000000990000-0x0000000000A6F000-memory.dmp

Download

memory/3512-17-0x0000000001870000-0x000000000194F000-memory.dmp

Download

memory/4300-106-0x0000000000E70000-0x0000000000E7C000-memory.dmp

Download

memory/4300-263-0x0000000000E70000-0x0000000000E7C000-memory.dmp

Download

memory/4300-94-0x0000000000E40000-0x0000000000E46000-memory.dmp

Download

memory/4300-93-0x0000000000E90000-0x0000000000EE4000-memory.dmp

Download

memory/4300-92-0x0000000000E30000-0x0000000000E36000-memory.dmp

Download

memory/4300-91-0x00000000005C0000-0x000000000060E000-memory.dmp

Download

memory/4424-42-0x0000000001810000-0x00000000018EF000-memory.dmp

Download

memory/4476-105-0x00000000010B0000-0x000000000118F000-memory.dmp

Download

memory/4740-183-0x000001F069700000-0x000001F06970A000-memory.dmp

Download

memory/4740-206-0x000001F0690E0000-0x000001F0690F2000-memory.dmp

Download

memory/4740-205-0x000001F068EC0000-0x000001F068F6F000-memory.dmp

Download

memory/4740-204-0x000001F067540000-0x000001F06754C000-memory.dmp

Download

memory/4956-260-0x0000000001950000-0x0000000001A2F000-memory.dmp

Download

memory/5072-186-0x0000017F51910000-0x0000017F51916000-memory.dmp

Download

memory/5072-196-0x0000017F38ED0000-0x0000017F38EDC000-memory.dmp

Download

memory/5072-197-0x0000017F51670000-0x0000017F5171F000-memory.dmp

Download

memory/5072-198-0x0000017F390F0000-0x0000017F39102000-memory.dmp

Download

memory/5072-187-0x0000017F51920000-0x0000017F5192A000-memory.dmp

Download

memory/5072-185-0x0000017F518E0000-0x0000017F518E8000-memory.dmp

Download

memory/5072-173-0x0000017F51B70000-0x0000017F51C23000-memory.dmp

Download

memory/5072-146-0x0000017F39130000-0x0000017F39152000-memory.dmp

Download