ae5415cc968c0e8acddd99358c21d267a2c31ac4ff5182861aab9e6931001606

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
298s
max time network
205s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/04/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirtualBox-7.2.8-173730-Win.exe
Size 169.6MB
Sample260426-mwr4faew2w
SHA256 ae5415cc968c0e8acddd99358c21d267a2c31ac4ff5182861aab9e6931001606
MD5 64ba0c07f97edb4f49f27b3a14017470
SHA1 5ef21f3809c77fb9e35b587bf766f5a6bb48d55e
SHA512 53d65c2b9e92622b2678727862bacf76634931c30252923ed10373766440a17b492247b95e849562b0c33d37d723dae1452bd7da94ee0f50e2a81a893d6eb59d
SSDEEP 3145728:ColeZbplUmhv5+R4R70UBcpyPlyrjmaWf6XTUvPeHbjlq59l4zOWrSKnNatVdB:1le/7hvER4RN8yPlqCaWf6XkPgj42zOB
TLSH
T19E883341B7D53D36D34203FFC8939B715A2FAC344713846622B6E22E6DB27E463A62C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET6344.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET6344.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxSup.sys	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\X:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\J:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\Q:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\T:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\W:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\R:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\P:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\H:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\K:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\Y:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\L:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\U:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\V:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\S:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\Z:	VirtualBox-7.2.8-173730-Win.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{def026a6-3326-b845-9dbf-430a20b49e85}\SET600A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_d34af34f8dc5b17b\VBoxSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{def026a6-3326-b845-9dbf-430a20b49e85}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{def026a6-3326-b845-9dbf-430a20b49e85}\SET600A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{def026a6-3326-b845-9dbf-430a20b49e85}\SET5FF8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{def026a6-3326-b845-9dbf-430a20b49e85}\SET6009.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{def026a6-3326-b845-9dbf-430a20b49e85}\SET6009.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{def026a6-3326-b845-9dbf-430a20b49e85}\VBoxSup.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_d34af34f8dc5b17b\VBoxSup.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_d34af34f8dc5b17b\VBoxSup.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{def026a6-3326-b845-9dbf-430a20b49e85}\VBoxSup.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{def026a6-3326-b845-9dbf-430a20b49e85}\SET5FF8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{def026a6-3326-b845-9dbf-430a20b49e85}\VBoxSup.cat	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_nt6_unattended.xml	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox_70px.png	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSupLib.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\vbox-arch-types.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qminimalVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ubuntu_autoinstall_meta_data	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_zh_TW.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\installer\python\vboxapi\pyproject.toml	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\DbgPlugInDiggers.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ca.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\installer\python\vboxapi\setup.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6GuiVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDbg.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxProxyStub-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6CoreVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\vm.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\styles\qmodernwindowsstyleVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_tr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_bg.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_th.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxCAPI.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_bg.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_nl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\CPUMInternal.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_eu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\debian_preseed.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\os2_response_files.rsp	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_eu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_nl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ubuntu_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_tr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\debian_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestAdditions.iso	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6PrintSupportVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAudioTest.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qwindowsVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol8_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\doc\UserManual.pdf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuthSimple.dll	msiexec.exe

Drops file in Windows directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI549A.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI3C69.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{534295E3-1E61-490D-B197-5DCC5437E591}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI538E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C29.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F29.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI570F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5EEF.tmp	msiexec.exe
File created	C:\Windows\Installer\e5938f8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3BE7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C39.tmp	msiexec.exe
File created	C:\Windows\INF\oem2.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\e5938f8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C08.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3BF8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5566.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI55F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5681.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\INF\oem3.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI541C.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5300.tmp	msiexec.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3BA8.tmp	msiexec.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe

Loads dropped DLL 24 IoCs

pid	Process
568	MsiExec.exe
568	MsiExec.exe
568	MsiExec.exe
568	MsiExec.exe
568	MsiExec.exe
568	MsiExec.exe
568	MsiExec.exe
1464	MsiExec.exe
1464	MsiExec.exe
1464	MsiExec.exe
1464	MsiExec.exe
1464	MsiExec.exe
1464	MsiExec.exe
1464	MsiExec.exe
1052	MsiExec.exe
1052	MsiExec.exe
1052	MsiExec.exe
1052	MsiExec.exe
1052	MsiExec.exe
1052	MsiExec.exe
1052	MsiExec.exe
1052	MsiExec.exe
1052	MsiExec.exe
1052	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirtualBox-7.2.8-173730-Win.exe

Checks SCSI registry key(s) 3 TTPs 31 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064f539ca36b3a6210000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380164f539ca0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e8410164f539ca000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f64f539ca00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7164f539ca00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2196	msiexec.exe
2196	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeIncreaseQuotaPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSecurityPrivilege	2196	msiexec.exe
Token: SeCreateTokenPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeAssignPrimaryTokenPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeLockMemoryPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeIncreaseQuotaPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeMachineAccountPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeTcbPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSecurityPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeTakeOwnershipPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeLoadDriverPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemProfilePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemtimePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeProfSingleProcessPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeIncBasePriorityPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreatePagefilePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreatePermanentPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeBackupPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeRestorePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeShutdownPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeDebugPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeAuditPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemEnvironmentPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeChangeNotifyPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeRemoteShutdownPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeUndockPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSyncAgentPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeEnableDelegationPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeManageVolumePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeImpersonatePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreateGlobalPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreateTokenPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeAssignPrimaryTokenPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeLockMemoryPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeIncreaseQuotaPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeMachineAccountPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeTcbPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSecurityPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeTakeOwnershipPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeLoadDriverPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemProfilePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemtimePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeProfSingleProcessPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeIncBasePriorityPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreatePagefilePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreatePermanentPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeBackupPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeRestorePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeShutdownPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeDebugPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeAuditPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemEnvironmentPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeChangeNotifyPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeRemoteShutdownPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeUndockPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeSyncAgentPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeEnableDelegationPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeManageVolumePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeImpersonatePrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreateGlobalPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreateTokenPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeAssignPrimaryTokenPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe
Token: SeLockMemoryPrivilege	3464	VirtualBox-7.2.8-173730-Win.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3464	VirtualBox-7.2.8-173730-Win.exe
3464	VirtualBox-7.2.8-173730-Win.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 568	2196	msiexec.exe	86
PID 2196 wrote to memory of 5964	2196	msiexec.exe	98
PID 2196 wrote to memory of 1464	2196	msiexec.exe	100
PID 2196 wrote to memory of 1052	2196	msiexec.exe	101
PID 5756 wrote to memory of 5244	5756	svchost.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.2.8-173730-Win.exe
"C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.2.8-173730-Win.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3464

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F04EFC13B355AB8BBB8E57E9A391C80C C
  2⤵
  - Loads dropped DLL
  PID:568
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5964
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 05483E03537E4DBEEAD11D7F4E37840E
  2⤵
  - Loads dropped DLL
  PID:1464
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C043D9ECA81DBAB2118EAD40CB63A87C E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Loads dropped DLL
  PID:1052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf" "9" "4ff1aec5b" "00000000000001C8" "WinSta0\Default" "00000000000001B8" "208" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBoxSup.cat

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\vboxsup\VBoxSup.cat
Size 11KB
SHA256 d34ce079eb119f8f318b2a4aa00943ff7cd441fbfe5479ba11b1f5b47c58c3e2
MD5 9f08e28dbe87aaa8230fc853b86e63d2
SHA1 ac868773a42a87a13b2331a2e4c9f21c2c9a3df7
SHA512 7e61717d4509c3fb31a6fdfc850eeca9f1ce0e07e54cf37be80825e1a822a16ade4a3823eadcccd7fefe55d01bd7ab7dfcb19bd860ab28d435e4afbe51f5fac5
SSDEEP 192:hOH/L8zjJCFPXWEwGJhYCE4CDz5j4HsX01k9z3AsLDfSJ:hnUP3h3E4CR9zdnU
TLSH
T1EB3239E6416C1182ED97AC6013E8F59B7C3E37CB5910856622EBF7190C677C8F7181AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxSup.sys

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\vboxsup\VBoxSup.sys
Size 1.0MB
SHA256 ae8af7f943753a8765c9d505a8460a7cfd2cbdc959ac3ce504548cc8b929979e
MD5 5a0e91b7bd9d8515ddceca5c2cdebb53
SHA1 225788451a9ae4ba4ededf3b6045a1a71e2afd90
SHA512 751927e0488d22bffaa5b1975ce9581cf8ffaf352960ca04480526deeab2c7baa445f00e2af073ba23ed901bd55564b6f665f8914c67e9b7d233446a7f7756c7
SSDEEP 12288:r7ojSsLDLNNZz6dWdwDHrrTAJZgMqdgJ3ecwuCY1n8/3bue1KwqzW:PZanNNZz6dW+DHrq6o11n8Tuiqa
TLSH
T1CC35AF9EB6A41AE5C9AB8134D2C1451AD2B6780107B0C7EF06E693B51EB3FD61E3F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxSup.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf
Size 2KB
SHA256 e6a4dc9227d12ba919e27b2ef22ad6b24f829cbe9fafb4728a7f6407c9288926
MD5 bba3dc50f513612b6eb5b4804b7084e7
SHA1 f054676a0769b07e21703d6854bf05af76cd1168
SHA512 a39550b37af53f280d3cffb169b8589d73f3b8ae6e2a7aa59cdf03c568ab955ce3359d23c55a580e0dc4a24dea81c4085b30ca699dde2997380f3c2a1a8e155b
TLSH
T14851726E584087713AA6029A3F0FA6C7F3E9701A3DEB185030DECD16926DC2C83394F6
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 daae5cd62ac8d9e32baed178e39df1e0827d9a45e31276f65f6b75f122e24b65
MD5 819e2fdd59353a50783d149715a1bd33
SHA1 f8a5cc907344d6e243d0804e3610b6ddcd625653
SHA512 fa7a1adb1004de16f7860ef164f294da35c5f390abdd4ec99c5c1cfda1cd5d6f39a6500d35d28600d0a04c41440539adc7845f5a1e4130ddebd64c652aa57ca8
TLSH
T1DBF0DCAB29B66C9118079C6C3FF198BA22917ACD04CD917E603A1184C7D92E0960F806
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 727B
SHA256 e7c373e6384cea6ca441af5c6045dc66b15ae5c0abfa76ce92b9d63f29906c69
MD5 1228a6fca976c573b80b888418ea1a36
SHA1 c2a2d37c26748138f803cc392af6d5b28569454b
SHA512 260f30d36c149b2c101c6487feb87b1d9f6e4127c3e280e295664ce652d28be15adc5bd329ea64879c745ba1ac530bd0b9c3fa4281204651082db19cd8489667
TLSH
T17901943F13C9E200DB520C08D6A5D3AB73AAC4A179842709213F91A9A00E3118F3A0B0
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 58b69048c5f70ae64f3de2527aee030b864fca81b21f14d7732d3ff3f7c3fafd
MD5 633a9a692c847dc06035ebcd3dad27f8
SHA1 87c73eaadb1559b60409f10c822bff03cc6e60d0
SHA512 fbc891ae0e3d07838246510ed7d4eeb90fa33879c54f1a9627f785e8698fbce02bbde1fcf222812ee59708258b408a89b921cfa0d136bfe609ffa537e7e2e48e
TLSH
T17001151718E9A7063C319C2FDBFCD2D87571D7C45CCD12471278E196015F77495638A6
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 dbb2cb4c49d6e0ee441400c26e8f449fa13a9a937b832bbc4be23d1d578afb1a
MD5 e77d0d41469584fc31aa833f9d5bc19a
SHA1 a7670c31595d9a60b51bbf7dd28292badc8bbed3
SHA512 103c8efaab3962c1f84590f812d0218d1a273091a27a6414a731c281665c2ddef9b693ca631d6e1b07422f95f4cb05c1f738fd7aa0dc14aed2c10cd9a0ba4404
TLSH
T138E0C03022FB002EF1788B3C42D5C0D9AF26F1122C9452BD0D85181DA901D008CB3C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 408B
SHA256 92fc2fc1e22410ed3e11332b5f1fc91afad58fc6a5c5a58e5f1251fe9b5c1e26
MD5 d9c3bc29355fae8908d9fa0236765a87
SHA1 9125fe053d8ebd8f86f479953a9073bd3d055dca
SHA512 85b265c28b73f996c1eac296ef1e83a1932380ce812d6abfa809133e01eebb7c590b0e959fd8f006e1ec73d02f777922deacd08567efe9e91ba299eeac07b410
TLSH
T103E0C03421F7805DF0FCEC3801E1AF21CAAAF3121549827E02905602B620F40DDA6630
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 d92553c9b309e8812455e83307afd72ead1c17a2980c3b6ba232b31e7e966b5a
MD5 4ff1c41ff19a0540128a7dcf2ce3d312
SHA1 c1f7a2e396d850861f53cf15a945caa7f90d372e
SHA512 d53514974c7236dc5434efda3b7305835fd093eecf67548750609a89f229b723f87b5ce349baabca4556e8bfaf765555fad03d348348ce9ad749714d35db925f
TLSH
T159E06F392AABB02EF0A4D83446F9F5B60E49F300248896BA16D00308FB62F006D20AB0
MD5 SHA1 SHA512 TLSH

Submit Download

MSI43BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI43BB.tmp
Size 493KB
SHA256 958e9b7a398b5896f1e4ed9e17fb69ab134d8804303de053f9424e3312b0a0ea
MD5 a342268f51454d6cd8c1d474cb5ce93c
SHA1 2e198d4c98d9d7e48cb6f1e7d2f7a3e2fa1f5120
SHA512 ae5cc2b3b835c5a190b350f3db189a1fe3f932353fe2356568dc28b26d02441e4affcb6e79c8626867715dc30cbdbcb508367317989ccc7ed953d709f86f3e55
SSDEEP 12288:c+CdCOGw0NI56FphW5nOtlmVI3OXdOwZTGDU9:5CbGbNI58phW5nO3sdV6q
TLSH
T121B4BD667BD12B75D85BC13E88A38002E7B37445031482EB47A682694EB3FD6773EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI83d23.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI83d23.LOG
Size 111KB
SHA256 b53adcaf3ff39bd57c53ebaf5ddcd45a94bfe3b4751ec493bc372dfa17157ec0
MD5 577e0f983b57a37f7b21831ff028e188
SHA1 d38a05c9280a28af17296c8568aeb3f6c5b2795f
SHA512 4cd3f1c25efc7ade150078a57ef0dd823c8e8d6a825f830b8a8f4f8bc2216b0c1dc4ad4b9e2d34215e63be10df1971232a0180de56300127fe1b0b017be3abe3
SSDEEP 1536:7xhXduHZ3Cb+aERrs1WgSE2oGheMO4OkO4OwmSE2oGheMO4OkO4OQGSE2oGheMOg:fMzl+wYtYmPC4hcEqyjpHvHom//Pk
TLSH
T170B34B247FF4014AB3B72697DEF7446A4B77FA656932CA0D6081C20E0473E05AD9C7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem0.PNF

Path C:\Windows\INF\oem0.PNF
Size 5KB
SHA256 10f12e0c2112ab15d1da6f752fdb135f3370d7d527723a7ce2da79a8070f163b
MD5 d1e353dca7baf1052c723d028547e0e1
SHA1 02eb655b10e718101879a93b197cf7713b0d4e19
SHA512 1f02fa023b03016cec7d34cbe400146264659f884df1b0a5fdd1b70ae1f86e5fd2c49f430ee35feeeb71e84cb3ca0a90b6bd846120fd72bdbc0fea060bd56200
SSDEEP 96:g6T0j7vWLlB9Su3H65DjLocg8IwJR56mXkR/1fszenFWhH:dCiZSuXiDjLor8IwJRMm0wzOEp
TLSH
T15DC1255673E88F15F0B68E706DF4A5E16836BC426E11DA4F2264734C1C32E94DBB0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem1.PNF

Path C:\Windows\INF\oem1.PNF
Size 5KB
SHA256 5f6ea9650ec1fe9863949c2f2f4bbe24ed6613f2479ca01db090e88aeb7582ca
MD5 7aaca5b4591c0ededd48804cecfabfe3
SHA1 be99539404924c12f3ea5c357bd28fc72803a267
SHA512 f8b2535d3434ecac9e63cae8b3df2699f0efcbec4c7b2fbf7e5098b41455b6435c44f80fa0a856b43d57d3f54995567bfbf8038ed7d46520a848ca13e59cc7dc
SSDEEP 96:dDv3lP0/4NiuIR0OoNjnuUw8u5pF6KXkRQ1fsCncekSDzD:dhviuCVIjuT8u5p4K05CcWDzD
TLSH
T135C13456B7E98B15F1FA8E716DF465E65872BC026C12CA4F7125330D0832E909BB0B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem2.PNF

Path C:\Windows\INF\oem2.PNF
Size 6KB
SHA256 5e45b5076cec32d1cb848014c0d157f937e49c4a1afff11c359f73106dad5a8b
MD5 c7696104cfc45d8bd720fcf5625abb1e
SHA1 731e93ff0f0f39070b688c364e6ff603e16e2abc
SHA512 7db722f6d6ff7301edf266c27bb975517fcc62e460ceda3764b1e1cabf97aaa364b5da5f7b082fb7525e96894f0d5d18af0b41a2fa753c9eee24146ca7142f53
SSDEEP 96:iu4rgQY2e/NI0IXSu6o4zvM181fQ1UvZUuQSCUJ:v2e/BfosxZUK/
TLSH
T150D14645B7F88B15F1BA9B306DB512E65432BC61AC12C61F3160338E0D72E949AB0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3C39.tmp

Path C:\Windows\Installer\MSI3C39.tmp
Size 383KB
SHA256 61a20a2e5b2e759c2db35545419cb75ab9db16e66fd21ce580a6f9836f3e7a9b
MD5 bca7365c591167f140b6ee5af5cda59e
SHA1 a6f299b5e70bd7c5b6a724fa869b0d8fcd0bb4a0
SHA512 c5651e422034c625e4abd3a46458069e6a9c6e74fb189ab06a3ff32ddc843e023cd68106a52c6d850532d0ca4650d370f063b8fde9624fcf8fd2f6ef700b9bd5
SSDEEP 6144:UEMG77h/h+OuGMgdH2NjItYRzCuY88tTUP8Mng8:UwJZbMtItYRzCuYVTe8M
TLSH
T12D846B29B7E408EDE4B78276C5A68131FF75744D3720D5AE8BA8452D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 c8678a9e29f8819f488703f0896d2bb1bfa13e66ba18ed430cd9bfb15e7985ab
MD5 4a9f30f9c4163d347ea2b648d0bf1b68
SHA1 df24adfc274beec3ba65a908d94d30211bcb4776
SHA512 fa2a604beb8bb03ff093ca69a3ae18f25a48befab4d67808b07fcff5d5bb4c95573ffd2742070a252644d64f951e548dd2dafa143e2e18bdd841c35b98f93804
SSDEEP 24576:AEpmg3MLdoO/vvTLj/tOXp2D18bRglCLhtYNLTx/c4Kjh2jdIo+GIhBGzq:cs
TLSH
T14047E51436F92210E7B39E3CA8F0AA278D3A7D579C15DE8D45411B4E0862F71E873F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{12828d4f-caea-49d8-8aa6-f79104a77e7d}_OnDiskSnapshotProp

Path \??\Volume{ca39f564-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{12828d4f-caea-49d8-8aa6-f79104a77e7d}_OnDiskSnapshotProp
Size 6KB
SHA256 9e366fa1e77fa2b5e5e63f4dbb8193da661cf5eb758f7ecca0c6175f8eb4bf82
MD5 d095adacb6fd3e123d3418676384a8c5
SHA1 e4ffb1acbdc385208a96154a808ac8100c1c07ad
SHA512 4e3bf554a96acba00777d88f9da820c5311d04f430472643cdb74d71b3f86b2af1d3d0a07198ce47f3214eb44fc2d50be442163510a5f44e9b74530afb14c764
SSDEEP 96:F8LMSYm7vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:IMfib++ZVm
TLSH
T19DD189085AF54311E2B3AB3129F58557A877B811EF33CB8E0298238E2671910F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2196-123-0x00000206F9360000-0x00000206F93D9000-memory.dmp

Download

memory/2196-59-0x00000206F9360000-0x00000206F93D9000-memory.dmp

Download

memory/2196-390-0x00000206F9360000-0x00000206F93D9000-memory.dmp

Download

memory/3464-48-0x000000000D850000-0x000000000D8E6000-memory.dmp

Download

memory/3464-391-0x000000000D850000-0x000000000D8E6000-memory.dmp

Download