c0146a17a79a0863fec7e0f782f3dd625debe67338ded603fb218a32b503ae8d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
Size 1.1MB
Sample260601-e3mhjaew2r
SHA256 c0146a17a79a0863fec7e0f782f3dd625debe67338ded603fb218a32b503ae8d
MD5 90bae0060a22383ab38f52cd68908f96
SHA1 e91b9415e3ce5dddf1b29db9eedc0301988521ad
SHA512 b1bb192d4655ba8883afb59c791100a36141e7995be909492cbf1bc0ea0a6cfcae02fd0969eb816fc684652529ab9ebd91e9771759a104bec07e9368729a6418
SSDEEP 24576:leMvQoCAOB+aOrsVdbuKXCaJlycCs4jsqS:fYoVaOw8Kyab/z4dS
TLSH
T1D73523457EF6D421C00752B454CA6B30A7079F7291B9C5ADE72BF4E66FBF3A04820A36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
3260	eidolon.exe
4808	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
3748	Shortcut.exe
4744	Uninstall.exe
3552	Uninstall.exe
1672	USBServers32.exe
568	USBServers32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\USBServers32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\USBServers32.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell32.dll	eidolon.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]\AliceGreenfingers.ico	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
File opened for modification	C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]\Uninstall.exe	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
File created	C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]\Uninstall.ini	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
File opened for modification	C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]	compact.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinRAR.exe	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
File opened for modification	C:\Windows\WinRAR.dll	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
File opened for modification	C:\Windows\MessageBox.exe	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
File opened for modification	C:\Windows\Shortcut.exe	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
File opened for modification	C:\Windows\PopCap.ico	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eidolon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBServers32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	compact.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shortcut.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1468	taskkill.exe
4856	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	taskkill.exe
Token: SeDebugPrivilege	4856	taskkill.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3260	4712	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe	81
PID 4712 wrote to memory of 4032	4712	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe	82
PID 4712 wrote to memory of 3496	4712	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe	84
PID 3496 wrote to memory of 4808	3496	cmd.exe	86
PID 4808 wrote to memory of 4332	4808	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe	87
PID 4332 wrote to memory of 1468	4332	cmd.exe	89
PID 4808 wrote to memory of 2744	4808	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe	91
PID 2744 wrote to memory of 244	2744	cmd.exe	93
PID 4808 wrote to memory of 2712	4808	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe	94
PID 4808 wrote to memory of 944	4808	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe	96
PID 944 wrote to memory of 3748	944	cmd.exe	98
PID 4808 wrote to memory of 4828	4808	2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe	99
PID 4828 wrote to memory of 4744	4828	cmd.exe	101
PID 4744 wrote to memory of 3552	4744	Uninstall.exe	102
PID 3552 wrote to memory of 1744	3552	Uninstall.exe	103
PID 1744 wrote to memory of 4856	1744	cmd.exe	106
PID 3552 wrote to memory of 852	3552	Uninstall.exe	107
PID 3552 wrote to memory of 1172	3552	Uninstall.exe	109
PID 1172 wrote to memory of 3236	1172	cmd.exe	111
PID 1172 wrote to memory of 4784	1172	cmd.exe	112
PID 3552 wrote to memory of 3792	3552	Uninstall.exe	113
PID 3792 wrote to memory of 4128	3792	cmd.exe	115
PID 3792 wrote to memory of 3300	3792	cmd.exe	116
PID 3496 wrote to memory of 1672	3496	cmd.exe	117
PID 1672 wrote to memory of 3272	1672	USBServers32.exe	118
PID 3272 wrote to memory of 4608	3272	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\eidolon.exe
  "C:\Users\Admin\AppData\Local\Temp\eidolon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Users\Admin\AppData\Local\Temp\2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-01_90bae0060a22383ab38f52cd68908f96_elex_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "Taskkill /im "AliceGreenfingers.exe" /t /f"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\Windows\SysWOW64\taskkill.exe
        
        Taskkill /im "AliceGreenfingers.exe" /t /f
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "If not exist "C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]" (MD "C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]" & Compact /c "C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]")"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Windows\SysWOW64\compact.exe
        
        Compact /c "C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]"
        5⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:244
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "If exist "C:\Users\Admin\AppData\Local\Temp\Alice Greenfingers v1.06 [PopCap].dll" "C:\Windows\WinRAR.exe" x -o+ -pJ5w[.1NfT5/6#+}ne;~]D~14xL\85] "C:\Users\Admin\AppData\Local\Temp\Alice Greenfingers v1.06 [PopCap].dll" "C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]""
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "If not exist "C:\Users\Admin\Desktop\PopCap Game Pack.lnk" if exist "C:\Windows\Shortcut.exe" "C:\Windows\Shortcut.exe" /F:"C:\Users\Admin\Desktop\PopCap Game Pack.lnk" /A:C /T:"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games for Windows\PopCap" /I:"C:\Windows\PopCap.ico""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:944
    - - C:\Windows\Shortcut.exe
        
        "C:\Windows\Shortcut.exe" /F:"C:\Users\Admin\Desktop\PopCap Game Pack.lnk" /A:C /T:"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games for Windows\PopCap" /I:"C:\Windows\PopCap.ico"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "If not exist "C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]\AliceGreenfingers.exe" "C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]\Uninstall" /s"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]\Uninstall.exe
        
        "C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]\Uninstall" /s
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Uninstall.exe" end /s
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "Taskkill /im "AliceGreenfingers.exe" /t /f"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\taskkill.exe
        
        Taskkill /im "AliceGreenfingers.exe" /t /f
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "If exist "C:\ProgramData\Arcade Lab\Alice Greenfingers" if exist "C:\Windows\MessageBox.exe" ("C:\Windows\MessageBox.exe" /C:Full Uninstall /M:Remove game data from locations other than the game's folder? /T:36 & if not errorlevel 7 (Del "C:\ProgramData\Arcade Lab\log.txt" & RD /s /q "C:\ProgramData\Arcade Lab\Alice Greenfingers"))"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "Dir "C:\ProgramData\Arcade Lab"|Find " 2 Dir(s)" & if not errorlevel 1 RD "C:\ProgramData\Arcade Lab""
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Dir "C:\ProgramData\Arcade Lab""
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
        
        C:\Windows\SysWOW64\find.exe
        
        Find " 2 Dir(s)"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "Dir "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games for Windows\PopCap\Uninstall"|Find " 1 File(s)" & if not errorlevel 1 del "C:\Windows\PopCap.ico" "C:\Users\Admin\Desktop\PopCap Game Pack.lnk""
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Dir "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games for Windows\PopCap\Uninstall""
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4128
        
        C:\Windows\SysWOW64\find.exe
        
        Find " 1 File(s)"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
- - C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
    "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3272
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4608

C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
1⤵
- Executes dropped EXE
PID:568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AliceGreenfingers.ico

Path C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]\AliceGreenfingers.ico
Size 106KB
SHA256 987c5164be6f96cf60d726e514d27fa7eba7d6ef3378703e8c03545589ff0454
MD5 cafd5e2ce09c63fe103f72056bda6c3f
SHA1 00026d89afcde69449fa42ab2e0ed9ac3343af9c
SHA512 bf5babe705669019211553cf23fedf3e53f6a938952c4059c1e62682096aed6895c4a1906ea4cac937830fc016eaa3c6dfb79f0b5701a37956bbc64050f32389
SSDEEP 3072:SatDYMAM2AQuwi+PsPke1tx0UbTwqquQ0olqAX6dtZ6:StM/HPwiEI1L9wzr0AX6Xc
TLSH
T15CB3F185765BDC39C5492738609BC036B9450FBE8A1290DA358BC4F2CD68BE4CC6AD6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\Games for Windows\Alice Greenfingers [PopCap]\Uninstall.exe
Size 208KB
SHA256 00300455680369aba7ccc89e448a77d69af29a9c1766678b0e864dbbbc506790
MD5 e3887c5f5536f404e09413d32ecc3d56
SHA1 e17bda11bbaac91ab719ccc822783c22e77d6c2c
SHA512 9ad1cc9e87a823253136d5833dc87b9b199e39dc61f998f103da421d7ca9a180ac5c9f74ca2ead1f5e0b173d15a57ca19d15d34dc5faf86eb0a862f2a8a2d911
SSDEEP 6144:czgOjRePDm+G5iWetM/HPwiEI1L9wzr0AX6XLxP:UNePDm+j5MvPwiEoE3yLxP
TLSH
T15724D042F683CC3AC035163D5C4BD23BE6397F412A1A24C7F29EB958DE39785494A29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Alice Greenfingers.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games for Windows\PopCap\Uninstall\Alice Greenfingers.lnk
Size 1KB
SHA256 d347e6b4dea2d1c0c96863fed499b925e257071847cc1247320fa0c4e0dd742d
MD5 588c97514dc799a0bbe396941f4d01da
SHA1 e354eabe2a6240163e11f7d115cfcb1d026d455c
SHA512 c30f9c0cc556f8699eabb1c3618f49ff31eaa382f0a2475bad1c3ca13715ccaac88a26e6998c8c49feb85ec509ab5244162924bfaa53bf670cd79e4b1338ef08
TLSH
T14D21899007D27B29F3FB6B72653117712A3AFC05EB685B0E809D124448B5A01D979FBA
MD5 SHA1 SHA512 TLSH

Submit Download

USBServers32.exe

Path C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
Size 54KB
SHA256 8f53ab3cd172f685568e0cbb51eb7dfd2389a5fe6aaf47d0aa7d823253e673ee
MD5 6428b1de8971e837926de5b464725f64
SHA1 19d7ce6fff617b790f9de7bf99406e61061f0594
SHA512 7938b01ce48bcdd3276c83f82fc71407d101f2e884b3f271a17fcf4c60af642faf57047edab97906351217f79847107757283af3fbfc3059cf4eb8e8d778d026
SSDEEP 768:nj27aTwKrJgJapOgV0jvQbtgDDM1MEprbhrCTyYrKjA70QkwWyit3JvsgZaphsL7:nj2AwKrSEqLQxK+oyEIXQ7+JLIzbPhwj
TLSH
T1D643D083BA8688E2C410357025977B32CA176FD25085F4A6EF31FDA0E4FF15A942DE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.ini

Path C:\Users\Admin\AppData\Local\Temp\Uninstall.ini
Size 3KB
SHA256 700be7c476856ab791343bfdf7f5bca244fdf665726640487de0903f31da3925
MD5 45e3315310f62d43d86025ffc99a0d23
SHA1 e8ac908529865faf9539ccb33f6c2737288aa5e4
SHA512 d9b538fc47e98d90f840ca5ab63fc4c3d1b22e2c771beddd0f534bb77d001eb9da03e1d790da8237932102a627711d762ba74626dcad4208d13fbc9d65488af1
TLSH
T10381D0118A18E56BF5B33B62170E2B597BEDC54931F7622151AFA10A693730DF0EE1C3
MD5 SHA1 SHA512 TLSH

Submit Download

eidolon.exe

Path C:\Users\Admin\AppData\Local\Temp\eidolon.exe
Size 24KB
SHA256 a1bf9bc23f97fee5a83ddcb3ba4d8fbbcc70fb2d871b325261be0ded72196fe9
MD5 f3858fb30c8ddb74a11e85381009c438
SHA1 ab388dbb45109acd543d28030daf065e50e20a1b
SHA512 6aeb783c6ed7108480f956fd5b54a39a26d6257dc1c472d4d16700eb76be4276690596702fbc9a078662627673965584accf90449cd08dec461806ae3d57c0d1
SSDEEP 384:NxJGCZWgs7ZS1DJKfkojki7gMbaoSnWbwPxTP3CUJ5tvOb/jl81:NGMWb74DJKcaki1v4fP3Cme0
TLSH
T16FB23A03FAC744F6E905A570456B7B3A9A2F6E5A0710D6CBCB4CFDA484321E2D9B124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Alice Greenfingers.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games for Windows\PopCap\Alice Greenfingers.lnk
Size 1KB
SHA256 b50db3b7303ebd6e02690c05fb958ef7628afd760cfb049fa584b02d17693fd5
MD5 3dd19fa4dfeb4370443316f641d5ffd1
SHA1 dd42e2d68e711ce69a32f62a14a5eeeea1e3848b
SHA512 496f668c1c13da0a75da04edacea141981a8e1b57ccb497053d77e707f6076b539269dd0ec6c14c03bb57e23484871d4ff9e2caae63bfdc4fb3df1ebfa797950
TLSH
T1CA41029417E03B28F2F3ABB125722360A836FC15FE78538D105A528514B2D14EDB9F77
MD5 SHA1 SHA512 TLSH

Submit Download

PopCap Game Pack.lnk

Path C:\Users\Admin\Desktop\PopCap Game Pack.lnk
Size 2KB
SHA256 3a9a713e90248955545a624837cb873e484bfde4595280b684b0a1288a90a42d
MD5 5a2c5bcc97fd40bac5f5a3584f3d554c
SHA1 7d3df621f5a0d647bd660d08335795b495b0d203
SHA512 04542c9660a12e282c682654cd7f5c73700003bd7af9bf3e4028dfebfe99787ee06bd2bbf462a11ec8e7626047ecb1e4168a7ade27893e68895d10099e86e4a6
TLSH
T1CB41834057F62715F6FB96B366F36731933AD803AB01F689454052091D25B02F939B6F
MD5 SHA1 SHA512 TLSH

Submit Download

PopCap.ico

Path C:\Windows\PopCap.ico
Size 24KB
SHA256 d3a82dd3163c4de6c2f7ea77c2e0dfc692b3ccb3d9ffb403982de2f4e2f51520
MD5 cd339a0dd4640928ac5a12fc1cd6a44f
SHA1 17033ce45e7774d09f38649ae520266f49e763c3
SHA512 b65770ed9ba2b6333e8d2438c3070e431bb3a032e79a9f25dcb8dc80c09671e3082b6a1586257558071ffaf196c83b3e54cfa5d01de2b9b2571cab8221d87009
SSDEEP 384:wOZ0GD2LzOroaza/3BVxd3syNEM8WVvUnIongPKPj:wp4bcHd7NS/VngiL
TLSH
T181B25B5A3309B29ADC9C45B38C838F654AB56C761D6609B327E6BB8F4C762207C1325B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shortcut.exe

Path C:\Windows\Shortcut.exe
Size 56KB
SHA256 74cd07ef186d995ad75a0c2a153d1dd6f7b563987f5aa0fefef0a095708c02dd
MD5 59375510bde2ff0dba7a8197ad9f12bb
SHA1 b7aef73fd5c9610860e2f3f6a3b8a21cb6873261
SHA512 eaa013b4885a4f05e998366317fe5bc46b7057c1f29653004787b0a6c40b445728a8ec63d0fa577e56293c34a27b508b7cc17a7a6ac95de3c42541a51ecd12cc
SSDEEP 768:p8AcstBy9afhyO45SqNf/mmjVrqvn84Bhbrqtuv:p5csny9TVheqhQn8Igt+
TLSH
T118438D0339D24173D8E98BF055FB0B76EB371AA11220D94B8B609D695C719A1E73E38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 951KB
SHA256 7cca5045296fd5db28de43f2f86d92934648328e80bdd384bdda348862d38c07
MD5 a8cb7a8cd7d6191449c08862790154ba
SHA1 602ac347a868d0bbe770be47525bf20a3f08ecf9
SHA512 a9e9180cc87a9db55295fe9ba6c465a64a01b9591f40e15c9385676aae50421a2f29a9b45defe557422c3189f25acd4a2977395f685a8881f50c0220c6e8a158
SSDEEP 24576:KAT8QE+kMMvQopRLbZIjCXjec0uyrJsh5eciwjH:KAI+yYopRfZIe9915ec/
TLSH
T148251366B742857BD4510A39484FD276B63FBB48073844DFB3CE096C8D3334999AA2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\temp\tttbrozzz.bat
Size 598B
SHA256 9eec6a6d2bd9188ab3ea8145a3675c72455ca977934495899b3c5e79059efc43
MD5 e7cd9ca37ae433052f3a3130df7d0bd5
SHA1 e4955081a8b1eee442352980d6f65264e0f03822
SHA512 fa78ffd445206d0d6c11f5e738e8cdcd86a6bc79eb0fc0025a5337b01ba41ca394dad0ce5033b8d599d87908b054d936f38e458cd0906e4484dc31d08c254026
TLSH
T1AEF07D1046AAC5B658F890A35AE16A8FD260F56A6F6A17004F4185CEB0914CEFE93203
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\temp\tttdelzzz.bat
Size 313B
SHA256 0b6f762cd70aab929d529c62cf9580d8fd0e5085c967bba84baaf81e13d0640c
MD5 978df0ab6cab37a32f5e5219eec8d822
SHA1 3cf74fd28f764b27c6591db4b8e3164ee69c436d
SHA512 167aa6a30b5895a14283a73121f5e6ec3bf50b8c22dd87a7191cc64eb59082cc1aee7a7e3503c66c87451b1f6937f625a163e574e004c792508b7f0a2f9c55cd
TLSH
T164E07D241EA885A39CF890E2A7E12ECBC650F6DB1E2B03445F0685C9E4920CDFD92203
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3552-208-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4744-82-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4808-37-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4808-209-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4808-36-0x0000000000400000-0x000000000044D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads