ae5415cc968c0e8acddd99358c21d267a2c31ac4ff5182861aab9e6931001606

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
298s
max time network
205s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirtualBox-7.2.8-173730-Win.exe
Size 169.6MB
Sample260426-mwr4faew2w
SHA256 ae5415cc968c0e8acddd99358c21d267a2c31ac4ff5182861aab9e6931001606
MD5 64ba0c07f97edb4f49f27b3a14017470
SHA1 5ef21f3809c77fb9e35b587bf766f5a6bb48d55e
SHA512 53d65c2b9e92622b2678727862bacf76634931c30252923ed10373766440a17b492247b95e849562b0c33d37d723dae1452bd7da94ee0f50e2a81a893d6eb59d
SSDEEP 3145728:ColeZbplUmhv5+R4R70UBcpyPlyrjmaWf6XTUvPeHbjlq59l4zOWrSKnNatVdB:1le/7hvER4RN8yPlqCaWf6XkPgj42zOB
TLSH
T19E883341B7D53D36D34203FFC8939B715A2FAC344713846622B6E22E6DB27E463A62C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET29B6.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET29B6.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxSup.sys	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\H:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\U:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\T:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\Y:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\E:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\J:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\N:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\S:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\X:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\L:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\P:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\V:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\Z:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\R:	VirtualBox-7.2.8-173730-Win.exe
File opened (read-only)	\??\W:	VirtualBox-7.2.8-173730-Win.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2dd8b344-0a7e-d348-ac8c-c3a1fee24bb9}\VBoxSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2dd8b344-0a7e-d348-ac8c-c3a1fee24bb9}\SET27C3.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2dd8b344-0a7e-d348-ac8c-c3a1fee24bb9}\SET27C3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2dd8b344-0a7e-d348-ac8c-c3a1fee24bb9}\VBoxSup.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_d34af34f8dc5b17b\VBoxSup.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2dd8b344-0a7e-d348-ac8c-c3a1fee24bb9}\SET27C4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2dd8b344-0a7e-d348-ac8c-c3a1fee24bb9}\SET27C4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_d34af34f8dc5b17b\VBoxSup.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_d34af34f8dc5b17b\VBoxSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2dd8b344-0a7e-d348-ac8c-c3a1fee24bb9}\SET27B2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2dd8b344-0a7e-d348-ac8c-c3a1fee24bb9}\VBoxSup.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2dd8b344-0a7e-d348-ac8c-c3a1fee24bb9}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2dd8b344-0a7e-d348-ac8c-c3a1fee24bb9}\SET27B2.tmp	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\VBoxVMMArm.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VMMR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol8_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_id.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_tr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\installer\python\vboxapi\pyproject.toml	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6WidgetsVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\fedora_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\os2_util.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ubuntu_autoinstall_user_data	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAutostartSvc.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\installer\python\vboxapi\setup.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\cpumctx.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\License_en_US.rtf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ka.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ru.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxRT-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox_70px.png	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_id.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxProxyStub-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\DbgPlugInDiggers.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qwindowsVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6CoreVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel3_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ubuntu_autoinstall_meta_data	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestAdditions.iso	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_th.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UserManual.qhc	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDrvInst.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxVMM.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\vbox-types.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_tr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel4_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_postinstall.cmd	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxClient-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6SqlVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxBugReport.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\testcase\amd64\vbox-vm-struct-test.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\os2_cid_install.cmd	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_nl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ko.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxHostChannel.dll	msiexec.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0E4ED67413953E1F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC79.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D4E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D8E.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\SourceHash{534295E3-1E61-490D-B197-5DCC5437E591}	msiexec.exe
File created	C:\Windows\Installer\e590a66.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCB.tmp	msiexec.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI2745.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF777225EF253FF160.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C22.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DCE.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10A7.tmp	msiexec.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File created	C:\Windows\INF\oem2.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI1C82.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\e590a66.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICEC.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF32DB20A4A0198829.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B95.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6E38332EB273A8E8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFC.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem3.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSICCC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DAE.tmp	msiexec.exe

Loads dropped DLL 24 IoCs

pid	Process
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
5236	MsiExec.exe
5236	MsiExec.exe
5236	MsiExec.exe
5236	MsiExec.exe
5236	MsiExec.exe
5236	MsiExec.exe
5236	MsiExec.exe
5448	MsiExec.exe
5448	MsiExec.exe
5448	MsiExec.exe
5448	MsiExec.exe
5448	MsiExec.exe
5448	MsiExec.exe
5448	MsiExec.exe
5448	MsiExec.exe
5448	MsiExec.exe
5448	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirtualBox-7.2.8-173730-Win.exe

Checks SCSI registry key(s) 3 TTPs 31 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000adcdd9a6d08c0ad30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000adcdd9a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900adcdd9a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aadcdd9a6000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dadcdd9a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3204	msiexec.exe
3204	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
684	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeIncreaseQuotaPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSecurityPrivilege	3204	msiexec.exe
Token: SeCreateTokenPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeAssignPrimaryTokenPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeLockMemoryPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeIncreaseQuotaPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeMachineAccountPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeTcbPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSecurityPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeTakeOwnershipPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeLoadDriverPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemProfilePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemtimePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeProfSingleProcessPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeIncBasePriorityPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreatePagefilePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreatePermanentPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeBackupPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeRestorePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeShutdownPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeDebugPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeAuditPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemEnvironmentPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeChangeNotifyPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeRemoteShutdownPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeUndockPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSyncAgentPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeEnableDelegationPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeManageVolumePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeImpersonatePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreateGlobalPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreateTokenPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeAssignPrimaryTokenPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeLockMemoryPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeIncreaseQuotaPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeMachineAccountPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeTcbPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSecurityPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeTakeOwnershipPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeLoadDriverPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemProfilePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemtimePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeProfSingleProcessPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeIncBasePriorityPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreatePagefilePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreatePermanentPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeBackupPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeRestorePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeShutdownPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeDebugPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeAuditPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSystemEnvironmentPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeChangeNotifyPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeRemoteShutdownPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeUndockPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeSyncAgentPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeEnableDelegationPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeManageVolumePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeImpersonatePrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreateGlobalPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeCreateTokenPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeAssignPrimaryTokenPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe
Token: SeLockMemoryPrivilege	4184	VirtualBox-7.2.8-173730-Win.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4184	VirtualBox-7.2.8-173730-Win.exe
4184	VirtualBox-7.2.8-173730-Win.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4448	3204	msiexec.exe	81
PID 3204 wrote to memory of 4672	3204	msiexec.exe	85
PID 3204 wrote to memory of 5236	3204	msiexec.exe	87
PID 3204 wrote to memory of 5448	3204	msiexec.exe	88
PID 6112 wrote to memory of 5128	6112	svchost.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.2.8-173730-Win.exe
"C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.2.8-173730-Win.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4184

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6A8927E5058BDFB385E0ABDEA4C8E50E C
  2⤵
  - Loads dropped DLL
  PID:4448
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4672
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E3721364AF0E83445C494FA60198C802
  2⤵
  - Loads dropped DLL
  PID:5236
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0EEAE407976C5BBB6D1A2C26467F1446 E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Loads dropped DLL
  PID:5448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf" "9" "4ff1aec5b" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBoxSup.cat

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\vboxsup\VBoxSup.cat
Size 11KB
SHA256 d34ce079eb119f8f318b2a4aa00943ff7cd441fbfe5479ba11b1f5b47c58c3e2
MD5 9f08e28dbe87aaa8230fc853b86e63d2
SHA1 ac868773a42a87a13b2331a2e4c9f21c2c9a3df7
SHA512 7e61717d4509c3fb31a6fdfc850eeca9f1ce0e07e54cf37be80825e1a822a16ade4a3823eadcccd7fefe55d01bd7ab7dfcb19bd860ab28d435e4afbe51f5fac5
SSDEEP 192:hOH/L8zjJCFPXWEwGJhYCE4CDz5j4HsX01k9z3AsLDfSJ:hnUP3h3E4CR9zdnU
TLSH
T1EB3239E6416C1182ED97AC6013E8F59B7C3E37CB5910856622EBF7190C677C8F7181AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxSup.sys

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\vboxsup\VBoxSup.sys
Size 1.0MB
SHA256 ae8af7f943753a8765c9d505a8460a7cfd2cbdc959ac3ce504548cc8b929979e
MD5 5a0e91b7bd9d8515ddceca5c2cdebb53
SHA1 225788451a9ae4ba4ededf3b6045a1a71e2afd90
SHA512 751927e0488d22bffaa5b1975ce9581cf8ffaf352960ca04480526deeab2c7baa445f00e2af073ba23ed901bd55564b6f665f8914c67e9b7d233446a7f7756c7
SSDEEP 12288:r7ojSsLDLNNZz6dWdwDHrrTAJZgMqdgJ3ecwuCY1n8/3bue1KwqzW:PZanNNZz6dW+DHrq6o11n8Tuiqa
TLSH
T1CC35AF9EB6A41AE5C9AB8134D2C1451AD2B6780107B0C7EF06E693B51EB3FD61E3F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxSup.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf
Size 2KB
SHA256 e6a4dc9227d12ba919e27b2ef22ad6b24f829cbe9fafb4728a7f6407c9288926
MD5 bba3dc50f513612b6eb5b4804b7084e7
SHA1 f054676a0769b07e21703d6854bf05af76cd1168
SHA512 a39550b37af53f280d3cffb169b8589d73f3b8ae6e2a7aa59cdf03c568ab955ce3359d23c55a580e0dc4a24dea81c4085b30ca699dde2997380f3c2a1a8e155b
TLSH
T14851726E584087713AA6029A3F0FA6C7F3E9701A3DEB185030DECD16926DC2C83394F6
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 daae5cd62ac8d9e32baed178e39df1e0827d9a45e31276f65f6b75f122e24b65
MD5 819e2fdd59353a50783d149715a1bd33
SHA1 f8a5cc907344d6e243d0804e3610b6ddcd625653
SHA512 fa7a1adb1004de16f7860ef164f294da35c5f390abdd4ec99c5c1cfda1cd5d6f39a6500d35d28600d0a04c41440539adc7845f5a1e4130ddebd64c652aa57ca8
TLSH
T1DBF0DCAB29B66C9118079C6C3FF198BA22917ACD04CD917E603A1184C7D92E0960F806
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 727B
SHA256 e7c373e6384cea6ca441af5c6045dc66b15ae5c0abfa76ce92b9d63f29906c69
MD5 1228a6fca976c573b80b888418ea1a36
SHA1 c2a2d37c26748138f803cc392af6d5b28569454b
SHA512 260f30d36c149b2c101c6487feb87b1d9f6e4127c3e280e295664ce652d28be15adc5bd329ea64879c745ba1ac530bd0b9c3fa4281204651082db19cd8489667
TLSH
T17901943F13C9E200DB520C08D6A5D3AB73AAC4A179842709213F91A9A00E3118F3A0B0
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 58b69048c5f70ae64f3de2527aee030b864fca81b21f14d7732d3ff3f7c3fafd
MD5 633a9a692c847dc06035ebcd3dad27f8
SHA1 87c73eaadb1559b60409f10c822bff03cc6e60d0
SHA512 fbc891ae0e3d07838246510ed7d4eeb90fa33879c54f1a9627f785e8698fbce02bbde1fcf222812ee59708258b408a89b921cfa0d136bfe609ffa537e7e2e48e
TLSH
T17001151718E9A7063C319C2FDBFCD2D87571D7C45CCD12471278E196015F77495638A6
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 a9d5ccb4cea44b510a8517ed39d4dd8393da7cff071c6c732647807b3efebe17
MD5 0e52b9efe06ee990c5054c908a48c28a
SHA1 8553fd683dea0256d6e69b28c058acf079d0f3d3
SHA512 a6f6c820641749d079899f63f9606970e45edc1c89bc79158f82a5370ae283edeecf84fe456f0bb0277de3fff83f96a5b59c2042412625744b335c32d71b6f9b
TLSH
T196E0202027FB502EF1649B7842D690D9AF25F2522C6556BD1995151D6905E008CA3D71
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 408B
SHA256 9075347b2c215eb024783dd980dc582c9babc68cb55e286f046e4e14ead11b66
MD5 aa894dc1c4f66789ef1087d019737b8d
SHA1 ffd348522c78f77ef3462bfbe5cb446fff0d15b3
SHA512 db0de12a821878e92383d6ea199cec79d72096357257cde68e5f659899dcdfbac54d5d7945a71d2f4516de0f5ca34566ea59b9fc04afcc50c38001f915f6349b
TLSH
T14DE0C03421F7815EF0F4E87801E1AF228AB9F2131506827D02900201BA21B009DA2630
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 cab2121b9627e6f55c1ce5d2bc38503b07a40178fe0404f73c85a1bfb619f0ab
MD5 a5de488a77ee1bc269c8be918cfeb89f
SHA1 c6261f5b3f2a7e5258d6a50610a409d05d47b4e6
SHA512 677cf7c02613d51604c731def54965cbd8a7f610ccdee7c6b29aef4230432af722f8602c56d5f01bd5d24488c8c0c54ff5734d382581764d5e71d6725bc34354
TLSH
T1C5E06F282AABB02EF0A08C3486FAF9B60D48F201249082BA12C00308FB12F005C10AB8
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8aa74.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI8aa74.LOG
Size 108KB
SHA256 0c2a908eb46f8cf74e791a9b64c640e154f61b05fcbc890b0a74d0632ffafea4
MD5 69f90ea0b008def1a02e2a9d49b34deb
SHA1 965434774da4d8c6be74dda3215b3f6bd969d86b
SHA512 e5fa12a089147e8d933a1506892375367910e3419cb03be22ca3c0012d9d9b07c6d2dd15a382d21ff8664b0aaa436ba762180708114edf605239725a1c114e90
SSDEEP 1536:JV531VvlHbjWUzr+V9dHBD9/NiVbFPFjFPFXtBD9/NiVbFPFjFPF3NBD9/NiVbF6:MFb97DmEynpFvxMgC8ADwmXlck
TLSH
T17CB36D206FF50144B2B76A4BDEF34427AA7BB9066A36DA0D6083C30D0572F04996D7BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB263.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIB263.tmp
Size 493KB
SHA256 958e9b7a398b5896f1e4ed9e17fb69ab134d8804303de053f9424e3312b0a0ea
MD5 a342268f51454d6cd8c1d474cb5ce93c
SHA1 2e198d4c98d9d7e48cb6f1e7d2f7a3e2fa1f5120
SHA512 ae5cc2b3b835c5a190b350f3db189a1fe3f932353fe2356568dc28b26d02441e4affcb6e79c8626867715dc30cbdbcb508367317989ccc7ed953d709f86f3e55
SSDEEP 12288:c+CdCOGw0NI56FphW5nOtlmVI3OXdOwZTGDU9:5CbGbNI58phW5nO3sdV6q
TLSH
T121B4BD667BD12B75D85BC13E88A38002E7B37445031482EB47A682694EB3FD6773EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem0.PNF

Path C:\Windows\INF\oem0.PNF
Size 5KB
SHA256 8dd8c159500563f3f20e541b46aca5217e5ea5f654c33dde769cce29fc6c47b5
MD5 1aa351e766b3b7e59ae464002f089396
SHA1 50adbbfc9f37aa68ea1e3a424464db81e8bce5aa
SHA512 ec2eaa36778fbead1a51fda0682fd54301527a6ac4b6366017992d0d1ecdc39e06a4ef1569d7a0c54e4ab040de1c58fa303a7f3fe257892a4602067e1b1716ce
SSDEEP 96:MWG/Yfb9NdSu3HS5PjLIcU808l9t6aXkRj1fsn7enFWhkq:FXtSuXqPjLIP808l9ga00n7OEt
TLSH
T1C4C1464573E94F15F0BA8E706DF456E26836BC425E12DB4F2264730D1C32E94DBB0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem1.PNF

Path C:\Windows\INF\oem1.PNF
Size 5KB
SHA256 c29adae45757be1c53ba8de460551426ba443bd8a4d03be97f56f539a7d134ed
MD5 628d46a68d15453c91c60261139cd78d
SHA1 1cc5d12237fa1056efe362e90e3c3736028e9c01
SHA512 b5707b23875bd696f56b0948952aeaea4e12976c096f59b8fefca32694ccb07a0a4e2fc1e3bed5a37780264f782dd698bd4e735a55d8a83e6188276d23e07dab
SSDEEP 96:8Di0PEnktiuIR0a8pjnWUk8q5Fh6uXkRM1fsCY3ekSDr7:8WaiuCZ4jWH8q5F0u0FCY3WH7
TLSH
T1DBC1495673E98B11F1FA8E716EF4A6E65872BC025D11CB4F7154331D0C72E909AB0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem2.PNF

Path C:\Windows\INF\oem2.PNF
Size 6KB
SHA256 5c1b83ab8c9bb19f175b06bc973af77375d869310fc13cd88de071ae06b7477e
MD5 e578aeb779f343e62303d30a723c42e4
SHA1 f4c466709248803d0a5fd2a950efa7b7b3ab7144
SHA512 980e8607a373db1ba2e67caa41040aa6f301030ae1f5f2998c4087c730909222ce860ba870303fd1136ce8f4b0f1f640f859923d0a509720fbbd0ef4f14885e3
SSDEEP 96:C4rgQY2e/NI0IXSu6o4zvM181fQ1UvZUuQSCUJ:i2e/BfosxZUK/
TLSH
T14AD13646B7F88B15F1BA9B306DB512E65436BC61AC12C65F3160334E0D72E949AB0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICEC.tmp

Path C:\Windows\Installer\MSICEC.tmp
Size 383KB
SHA256 61a20a2e5b2e759c2db35545419cb75ab9db16e66fd21ce580a6f9836f3e7a9b
MD5 bca7365c591167f140b6ee5af5cda59e
SHA1 a6f299b5e70bd7c5b6a724fa869b0d8fcd0bb4a0
SHA512 c5651e422034c625e4abd3a46458069e6a9c6e74fb189ab06a3ff32ddc843e023cd68106a52c6d850532d0ca4650d370f063b8fde9624fcf8fd2f6ef700b9bd5
SSDEEP 6144:UEMG77h/h+OuGMgdH2NjItYRzCuY88tTUP8Mng8:UwJZbMtItYRzCuYVTe8M
TLSH
T12D846B29B7E408EDE4B78276C5A68131FF75744D3720D5AE8BA8452D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 294434311a3ecef292e4fc0d6f4ecbc2358f2ecb0eb646362c96a1994044ca69
MD5 92bfdfd539ce1943a9966e52ac45b79e
SHA1 6af9ddba76935ce73ef7802268f21961d22db968
SHA512 f64997a0adf97b327142740a23e2d02c1b6ef0d43bec4c4e141d2812e9f4f9e3dd60b410f300e9cd0218114006789462705910f954e5047a02a70aa1bddf8e31
SSDEEP 24576:z2gmSp13doO/vvTLtmmeBkH6fapdwoi82GVtHZUGvNqYUqCDY93B7r8Rh:N
TLSH
T19647C12836F92250E7F79E3C68F06A234E3A7D5B9C159A8D05451B4E0D21FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8b63ebbb-8977-4968-9bd8-0df1266546c9}_OnDiskSnapshotProp

Path \??\Volume{a6d9cdad-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8b63ebbb-8977-4968-9bd8-0df1266546c9}_OnDiskSnapshotProp
Size 6KB
SHA256 b9f7bc7e4ef7bf3662c0b776b243e87aaa7624dcfd1dbf110375fbed8960a352
MD5 e34cdbb416ffbd9e397cfeffbeb4b2cf
SHA1 e08377124747b4f39e1af211df97205f22423a31
SHA512 2401b2c6e0fe179859489ab1bfbbefcd9a06b39fe7126ff03d9218bec0a3978c44d3ba457a54e0995eeee4931ac46352fd2c308892a1fa332fef2f396700412b
SSDEEP 96:FxMShwyVsvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:bMQV2b++ZVm
TLSH
T197D1880C5AE54311E2B3AB7229F14557A877B811EF33CB8E0198238E6670A10F935F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3204-393-0x000001E05C1C0000-0x000001E05C1CC000-memory.dmp

Download

memory/4184-54-0x000000000D420000-0x000000000D427000-memory.dmp

Download

memory/5128-407-0x000001AFA82A0000-0x000001AFA82AC000-memory.dmp

Download