donutloader | 171bfe80f568b5df69d1775f5c008356f775b5f5d0c53140ea7db0233a87403c

Resubmissions

01/06/2026, 21:51

260601-1qhvgafz7s10

01/06/2026, 20:08

260601-ywph4aev9x10

01/06/2026, 18:36

260601-w8xn5adt3z10

Analysis

user interaction
yes
max time kernel
1048s
max time network
1053s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order_Details.zip
Size 157.9MB
Sample260601-ywph4aev9x
SHA256 171bfe80f568b5df69d1775f5c008356f775b5f5d0c53140ea7db0233a87403c
MD5 015f67da29e537ce1c5121bb63340e41
SHA1 e8758e065906e58aed6abd7c75210f850891f2b4
SHA512 eac9e3e1fdbaed2e99104b10f89c4cd6322cd0292dac04a566f76d86444ca6d090cc6a9b23d27b399079cbf6fb986d0f0b77cbb4c359fa3ae206a4ee151c45dc
SSDEEP 3145728:FKJbQAgS2dzp2gXgd8FLILNk6Pb3iiDclj7wnhtE0cwMyiDgxoZd:4lZ2dzogdLqkqzi3GtE0jMyi0CZd
TLSH
T1DB883360EFB4CB47DDA775BF443DF8A1E89EA19034B1E4E9DE68825834CC9120D1C66B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery donutloader loader spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5276-155-0x0000000004050000-0x00000000040FD000-memory.dmp	family_donutloader

Executes dropped EXE 8 IoCs

pid	Process
848	Order_Details.exe
2064	pythonw.exe
5828	zhen.mkv
6092	pythonw.exe
2248	pythonw.exe
5276	pythonw.exe
5148	pythonw.exe
3664	pythonw.exe

Loads dropped DLL 29 IoCs

pid	Process
848	Order_Details.exe
848	Order_Details.exe
848	Order_Details.exe
848	Order_Details.exe
848	Order_Details.exe
2064	pythonw.exe
6092	pythonw.exe
6092	pythonw.exe
6092	pythonw.exe
6092	pythonw.exe
6092	pythonw.exe
2248	pythonw.exe
2248	pythonw.exe
5276	pythonw.exe
5276	pythonw.exe
5276	pythonw.exe
5276	pythonw.exe
5276	pythonw.exe
5148	pythonw.exe
5148	pythonw.exe
5148	pythonw.exe
5148	pythonw.exe
5148	pythonw.exe
5148	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zhen.mkv
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	pythonw.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5388	WINWORD.EXE
5388	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3200	7zG.exe
Token: 35	3200	7zG.exe
Token: SeSecurityPrivilege	3200	7zG.exe
Token: SeSecurityPrivilege	3200	7zG.exe
Token: SeRestorePrivilege	5828	zhen.mkv
Token: 35	5828	zhen.mkv
Token: SeSecurityPrivilege	5828	zhen.mkv
Token: SeSecurityPrivilege	5828	zhen.mkv
Token: SeIncreaseQuotaPrivilege	2808	WMIC.exe
Token: SeSecurityPrivilege	2808	WMIC.exe
Token: SeTakeOwnershipPrivilege	2808	WMIC.exe
Token: SeLoadDriverPrivilege	2808	WMIC.exe
Token: SeSystemProfilePrivilege	2808	WMIC.exe
Token: SeSystemtimePrivilege	2808	WMIC.exe
Token: SeProfSingleProcessPrivilege	2808	WMIC.exe
Token: SeIncBasePriorityPrivilege	2808	WMIC.exe
Token: SeCreatePagefilePrivilege	2808	WMIC.exe
Token: SeBackupPrivilege	2808	WMIC.exe
Token: SeRestorePrivilege	2808	WMIC.exe
Token: SeShutdownPrivilege	2808	WMIC.exe
Token: SeDebugPrivilege	2808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2808	WMIC.exe
Token: SeRemoteShutdownPrivilege	2808	WMIC.exe
Token: SeUndockPrivilege	2808	WMIC.exe
Token: SeManageVolumePrivilege	2808	WMIC.exe
Token: 33	2808	WMIC.exe
Token: 34	2808	WMIC.exe
Token: 35	2808	WMIC.exe
Token: 36	2808	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2808	WMIC.exe
Token: SeSecurityPrivilege	2808	WMIC.exe
Token: SeTakeOwnershipPrivilege	2808	WMIC.exe
Token: SeLoadDriverPrivilege	2808	WMIC.exe
Token: SeSystemProfilePrivilege	2808	WMIC.exe
Token: SeSystemtimePrivilege	2808	WMIC.exe
Token: SeProfSingleProcessPrivilege	2808	WMIC.exe
Token: SeIncBasePriorityPrivilege	2808	WMIC.exe
Token: SeCreatePagefilePrivilege	2808	WMIC.exe
Token: SeBackupPrivilege	2808	WMIC.exe
Token: SeRestorePrivilege	2808	WMIC.exe
Token: SeShutdownPrivilege	2808	WMIC.exe
Token: SeDebugPrivilege	2808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2808	WMIC.exe
Token: SeRemoteShutdownPrivilege	2808	WMIC.exe
Token: SeUndockPrivilege	2808	WMIC.exe
Token: SeManageVolumePrivilege	2808	WMIC.exe
Token: 33	2808	WMIC.exe
Token: 34	2808	WMIC.exe
Token: 35	2808	WMIC.exe
Token: 36	2808	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2128	WMIC.exe
Token: SeSecurityPrivilege	2128	WMIC.exe
Token: SeTakeOwnershipPrivilege	2128	WMIC.exe
Token: SeLoadDriverPrivilege	2128	WMIC.exe
Token: SeSystemProfilePrivilege	2128	WMIC.exe
Token: SeSystemtimePrivilege	2128	WMIC.exe
Token: SeProfSingleProcessPrivilege	2128	WMIC.exe
Token: SeIncBasePriorityPrivilege	2128	WMIC.exe
Token: SeCreatePagefilePrivilege	2128	WMIC.exe
Token: SeBackupPrivilege	2128	WMIC.exe
Token: SeRestorePrivilege	2128	WMIC.exe
Token: SeShutdownPrivilege	2128	WMIC.exe
Token: SeDebugPrivilege	2128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2128	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3200	7zG.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5388	WINWORD.EXE
5388	WINWORD.EXE
5388	WINWORD.EXE
5388	WINWORD.EXE
5388	WINWORD.EXE
5388	WINWORD.EXE
5388	WINWORD.EXE
5388	WINWORD.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2064	848	Order_Details.exe	87
PID 2064 wrote to memory of 5388	2064	pythonw.exe	88
PID 2064 wrote to memory of 5428	2064	pythonw.exe	89
PID 2064 wrote to memory of 5452	2064	pythonw.exe	91
PID 2064 wrote to memory of 5596	2064	pythonw.exe	94
PID 2064 wrote to memory of 4600	2064	pythonw.exe	96
PID 2064 wrote to memory of 1480	2064	pythonw.exe	98
PID 2064 wrote to memory of 1264	2064	pythonw.exe	100
PID 2064 wrote to memory of 5828	2064	pythonw.exe	103
PID 2064 wrote to memory of 6092	2064	pythonw.exe	105
PID 6092 wrote to memory of 392	6092	pythonw.exe	106
PID 392 wrote to memory of 2808	392	cmd.exe	108
PID 6092 wrote to memory of 2024	6092	pythonw.exe	109
PID 2024 wrote to memory of 2128	2024	cmd.exe	111
PID 6092 wrote to memory of 4764	6092	pythonw.exe	112
PID 4764 wrote to memory of 3824	4764	cmd.exe	114
PID 6092 wrote to memory of 5160	6092	pythonw.exe	116
PID 5160 wrote to memory of 2328	5160	cmd.exe	118
PID 5276 wrote to memory of 5352	5276	pythonw.exe	121
PID 5352 wrote to memory of 3764	5352	cmd.exe	123
PID 5276 wrote to memory of 3220	5276	pythonw.exe	124
PID 3220 wrote to memory of 1108	3220	cmd.exe	126
PID 5276 wrote to memory of 4072	5276	pythonw.exe	127
PID 4072 wrote to memory of 3124	4072	cmd.exe	129
PID 5276 wrote to memory of 564	5276	pythonw.exe	130
PID 564 wrote to memory of 2456	564	cmd.exe	132
PID 5148 wrote to memory of 4016	5148	pythonw.exe	137
PID 4016 wrote to memory of 5228	4016	cmd.exe	139
PID 5148 wrote to memory of 4356	5148	pythonw.exe	140
PID 4356 wrote to memory of 3576	4356	cmd.exe	142
PID 5148 wrote to memory of 1284	5148	pythonw.exe	143
PID 1284 wrote to memory of 3696	1284	cmd.exe	145
PID 5148 wrote to memory of 2800	5148	pythonw.exe	146
PID 2800 wrote to memory of 5096	2800	cmd.exe	148
PID 3664 wrote to memory of 2420	3664	pythonw.exe	150
PID 2420 wrote to memory of 5888	2420	cmd.exe	152
PID 3664 wrote to memory of 3216	3664	pythonw.exe	153
PID 3216 wrote to memory of 4344	3216	cmd.exe	155
PID 3664 wrote to memory of 4624	3664	pythonw.exe	156
PID 4624 wrote to memory of 3744	4624	cmd.exe	158
PID 3664 wrote to memory of 1388	3664	pythonw.exe	159
PID 1388 wrote to memory of 2804	1388	cmd.exe	161

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5428	attrib.exe
5452	attrib.exe
5596	attrib.exe
4600	attrib.exe
1480	attrib.exe
1264	attrib.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Order_Details.zip
1⤵
PID:2864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4984

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Order_Details\" -spe -an -ai#7zMap30402:106:7zEvent22712
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3200

C:\Users\Admin\AppData\Local\Temp\Order_Details\Order_Details.exe
"C:\Users\Admin\AppData\Local\Temp\Order_Details\Order_Details.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\Order_Details\_\pythonw.exe
  "C:\Users\Admin\AppData\Local\Temp\Order_Details\_\pythonw.exe" "C:\Users\Admin\AppData\Local\Temp\Order_Details\_\setup.dat" "C:\Users\Admin\AppData\Local\Temp\Order_Details"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Order_Details\Order_Information.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:5388
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Order_Details\AppVIsvSubsystems64.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5428
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Order_Details\msvcp140.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5452
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Order_Details\Order_Details.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5596
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Order_Details\vcruntime140.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4600
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Order_Details\vcruntime140_1.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1480
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Order_Details\_
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1264
- - C:\Users\Admin\AppData\Local\Temp\Order_Details\_\zhen.mkv
    C:\Users\Admin\AppData\Local\Temp\Order_Details\_\zhen.mkv x -y -predteamvn16 C:\Users\Admin\AppData\Local\Temp\Order_Details\_\REDTEAMVN.pdf -oC:\Users\Admin\AppData\Local\Microsoft\MediaService
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5828
- - C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe
    C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll conssnet C:\Users\Admin\AppData\Local\Temp\Order_Details
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __EventFilter where "Name='CoreFontSync'" get Name /format:list"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:392
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic /namespace:"\\root\subscription" path __EventFilter where "Name='CoreFontSync'" get Name /format:list
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __EventFilter create "Name=\"CoreFontSync\",EventNameSpace=\"root\\cimv2\",QueryLanguage=\"WQL\",Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 900 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\"""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic /namespace:"\\root\subscription" path __EventFilter create "Name=\"CoreFontSync\",EventNameSpace=\"root\\cimv2\",QueryLanguage=\"WQL\",Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 900 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\""
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path CommandLineEventConsumer create "Name=\"CoreFontSync\",CommandLineTemplate=\""C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe" "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"\"""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic /namespace:"\\root\subscription" path CommandLineEventConsumer create "Name=\"CoreFontSync\",CommandLineTemplate=\""C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe" "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"\""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __FilterToConsumerBinding create "Filter=\"__EventFilter.Name=\\\"CoreFontSync\\\"\",Consumer=\"CommandLineEventConsumer.Name=\\\"CoreFontSync\\\"\"""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5160
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic /namespace:"\\root\subscription" path __FilterToConsumerBinding create "Filter=\"__EventFilter.Name=\\\"CoreFontSync\\\"\",Consumer=\"CommandLineEventConsumer.Name=\\\"CoreFontSync\\\"\""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2328

C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe
C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2248

C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe
C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __EventFilter where "Name='CoreFontSync'" get Name /format:list"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path __EventFilter where "Name='CoreFontSync'" get Name /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __EventFilter create "Name=\"CoreFontSync\",EventNameSpace=\"root\\cimv2\",QueryLanguage=\"WQL\",Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 900 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\"""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path __EventFilter create "Name=\"CoreFontSync\",EventNameSpace=\"root\\cimv2\",QueryLanguage=\"WQL\",Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 900 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path CommandLineEventConsumer create "Name=\"CoreFontSync\",CommandLineTemplate=\""C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe" "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"\"""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path CommandLineEventConsumer create "Name=\"CoreFontSync\",CommandLineTemplate=\""C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe" "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __FilterToConsumerBinding create "Filter=\"__EventFilter.Name=\\\"CoreFontSync\\\"\",Consumer=\"CommandLineEventConsumer.Name=\\\"CoreFontSync\\\"\"""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path __FilterToConsumerBinding create "Filter=\"__EventFilter.Name=\\\"CoreFontSync\\\"\",Consumer=\"CommandLineEventConsumer.Name=\\\"CoreFontSync\\\"\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2456

C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe
C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __EventFilter where "Name='CoreFontSync'" get Name /format:list"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path __EventFilter where "Name='CoreFontSync'" get Name /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __EventFilter create "Name=\"CoreFontSync\",EventNameSpace=\"root\\cimv2\",QueryLanguage=\"WQL\",Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 900 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\"""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path __EventFilter create "Name=\"CoreFontSync\",EventNameSpace=\"root\\cimv2\",QueryLanguage=\"WQL\",Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 900 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path CommandLineEventConsumer create "Name=\"CoreFontSync\",CommandLineTemplate=\""C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe" "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"\"""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path CommandLineEventConsumer create "Name=\"CoreFontSync\",CommandLineTemplate=\""C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe" "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __FilterToConsumerBinding create "Filter=\"__EventFilter.Name=\\\"CoreFontSync\\\"\",Consumer=\"CommandLineEventConsumer.Name=\\\"CoreFontSync\\\"\"""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path __FilterToConsumerBinding create "Filter=\"__EventFilter.Name=\\\"CoreFontSync\\\"\",Consumer=\"CommandLineEventConsumer.Name=\\\"CoreFontSync\\\"\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5096

C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe
C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __EventFilter where "Name='CoreFontSync'" get Name /format:list"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path __EventFilter where "Name='CoreFontSync'" get Name /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __EventFilter create "Name=\"CoreFontSync\",EventNameSpace=\"root\\cimv2\",QueryLanguage=\"WQL\",Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 900 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\"""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path __EventFilter create "Name=\"CoreFontSync\",EventNameSpace=\"root\\cimv2\",QueryLanguage=\"WQL\",Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 900 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path CommandLineEventConsumer create "Name=\"CoreFontSync\",CommandLineTemplate=\""C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe" "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"\"""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path CommandLineEventConsumer create "Name=\"CoreFontSync\",CommandLineTemplate=\""C:\Users\Admin\AppData\Local\Microsoft\MediaService\pythonw.exe" "C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll"\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic /namespace:"\\root\subscription" path __FilterToConsumerBinding create "Filter=\"__EventFilter.Name=\\\"CoreFontSync\\\"\",Consumer=\"CommandLineEventConsumer.Name=\\\"CoreFontSync\\\"\"""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:"\\root\subscription" path __FilterToConsumerBinding create "Filter=\"__EventFilter.Name=\\\"CoreFontSync\\\"\",Consumer=\"CommandLineEventConsumer.Name=\\\"CoreFontSync\\\"\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pythonw.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pythonw.exe.log
Size 422B
SHA256 7b1528e04110e827cb63cf2ad9c267a5ffe913b0980d24818f10d2ce5c9714d1
MD5 aa1906abec5cb7944a16dc89379ba776
SHA1 ef30993387d03c2828ac3183920c2ad039d96d9b
SHA512 ebc130f76ed9c9bf2c57dea432a9eb314df70923c75cbb1f044cfece0d9497fdf11b67edca8d0392de91af71ddae4dba0f90407a71ed432e8e48102f512d2d96
TLSH
T105E022302375A1E589963F820D6DAA8865EF0A45B260EF253584276ED92A0172F322E3
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\MediaService\VCRUNTIME140.dll
Size 74KB
SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
MD5 1a84957b6e681fca057160cd04e26b27
SHA1 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA512 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
SSDEEP 1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
TLSH
T157739F4278C0C272D1AE4A79057AF612663DAA204FD15EDB7FD85C88AF75AC1EF31213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Microsoft\MediaService\_bz2.pyd
Size 70KB
SHA256 b682e9e8152036bdebf4ca5410d3c0f88fa3272a969830f63c7b61bb1f0da89f
MD5 5c952e57426e429f6f4cec9feb841815
SHA1 83bfd2108e188909c7ff3b294ab9c99336d02d06
SHA512 2b6ab5f24e7e232c8906ac12c5a4994cfcf1b061ffc25407f278de3d97664716c24e58237ee6ec48949ac6c1f4522aa1ca4c5238015d128e3a9be602d2ce0ed2
SSDEEP 1536:QxDhX4Vb2zMIsTRGxT+0q8i9qK5ILCVwQ7Sy8Pxer:mhi2zvsCK0ti9qK5ILCVwQ6xw
TLSH
T1B7638D15E5C11AB9E9D720B022D5C636B639E33147108AF3B25AD6781F14BE3AE3522F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Microsoft\MediaService\_ctypes.pyd
Size 105KB
SHA256 f879f86bf65ce05ee3467df65c55b9837f9dffb0f024c350c9a9869a08609759
MD5 ff0992dfb0d4d90bdceaad68246c5c22
SHA1 3508b7d730dde3db94ae413625451ae8caa0bd7d
SHA512 8bebc01958d71b327cbc39ed04bc53f6484caa0232a1fd71e6691bdaa89fcbc766bc888d45870dc24d1190c48a0ae0a58c447ec936e34db23059ee6f35a138bb
SSDEEP 3072:qS6mSAe9tVW/dhyGfnH/Jt5Phld/7VILLPf17Mxk:qS6mzInWlhyiH/Jt1d/7wJ
TLSH
T16EB36C42B6D59431EAD6C0BCA7D9D6BA7A3F70B49F6A00F316B9198810B05D32F3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Microsoft\MediaService\libffi-7.dll
Size 28KB
SHA256 0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57
MD5 bc20614744ebf4c2b8acd28d1fe54174
SHA1 665c0acc404e13a69800fae94efd69a41bdda901
SHA512 0c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b
SSDEEP 384:l69PtXvz8cLBN3gHhY4AFlfIvDzqig2c2LuRRClfW23JLURlV5uH+6nYPLxDG4yG:l65tXvz2CTIvy2c26A35qYvWDG4yG
TLSH
T139D26C429F0550F2FFCDA93A70A99B3AEE3ABB001BD180E787365A515F44AE1617C14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

support.ico

Path C:\Users\Admin\AppData\Local\Microsoft\MediaService\support.ico
Size 932KB
SHA256 923c15d3023e14bfea01aaeead03c17062f50c9acd2fc2698db49a21e83409a3
MD5 5564ba2d1e776139359c46b6755e199e
SHA1 bba38745b9d469cb334224c6465c7351bfcab5c2
SHA512 9496c571da855f6971cb94c9d754ead50a0b825dd85d3f185d3e2f5ed5d8ab5f059e6276462eb5b34c434da5e2cca53bb7282de228420e15c7ff04e2e08b042d
SSDEEP 24576:vWe7dyFL0/ER9kXxrF3nRL/oAugcyef2y+JH3JGuun:vW6yFLyERIxrFhLgrtyCsdI
TLSH
T1FB15339E583BC34B48EBE942E51F1C3D6D9A52C0C5C7470ADA6CB8D528E482672CF26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.dll

Path C:\Users\Admin\AppData\Local\Microsoft\MediaService\update.dll
Size 8KB
SHA256 19889ae2aa753b2ca5630ceecb50701af2ac0873bcc88d62cefda6e1a9a04c7e
MD5 a7fae25c112feb0186f7055932d5b4ae
SHA1 1066fcedaeac9e7d28acdd3ace0a773a98380323
SHA512 7d137b7a39e988c0f9faaae7dee2430ece26dbd2960ba619eaf4a1d5ea5d91c48af5dad7f6d40b88859a5b525580baf5c481f1bbf39f2635ba98c414c9b34a98
SSDEEP 192:v1vJR6KER6xEx0muPQZwenoFfEcGO2diF56O4nCyuOjJ:v1v/6JHSEwenoFMcGjIF56Oqtl
TLSH
T1300263B25CDA1272D3F6C3041E69D1AFC76D45833A283072BB9CC499AFB585742207EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Order_Details.exe

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\Order_Details.exe
Size 1.5MB
SHA256 59dbc225207fb303c9eccc7b962c82ae212f5d302703d3154178b8afceeccd3c
MD5 aa17ece2443ed014ea50139ce09ec500
SHA1 f3c70c8032af59a4477e826c92da38e6bf974ff3
SHA512 4a9332e23fb2254adf92ba1a34ececf5be3b3e4c3c075221fd3f3abd4f32ec9e42672d9187cfb2d67c9fdfad37c96e13cc1d04a2c46d76a9caa0468a2141f88f
SSDEEP 6144:gkL/A968meGyDW1T3yDW1TjkAzkAZqrEdrEAZUCwFjNN5Y9PRwmcpAbCN4:gkL/A9k6kfNPqrEdrEURwmcpsm4
TLSH
T180750D03F63AFCAAF96D3CF1D888DE902C1F3C5A4A8779613972FA5ED5331916600256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Order_Information.docx

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\Order_Information.docx
Size 36KB
SHA256 e698cca3d1fa68a898e4777ec722d2f4f21edb30b72f99086d7e5aa66a2334ac
MD5 8cd3661bed6af0497b49420c90850df6
SHA1 a4821cc2312e31039f8e1d24b5dd1dccde845c23
SHA512 44c476d0c7bd09dca7e5a89ba4f532225886f3c74249eff03f628f2b970318a4e68196e714ba5af4f51e68a7057795cbc17c3000468e1d1438a3f24bb88aaf24
SSDEEP 768:lZopanm7rdW8RhejnaCRWrY/CGD5uLiNTKUUPhvA/foZ4wa:rTm7rZHITr/CGD5uLmdUpYB
TLSH
T1D103F134C61FA071F4A6F775FA1A4BA1F1685AA050C52BBB3C37C26D90B374FAA17204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REDTEAMVN.pdf

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\_\REDTEAMVN.pdf
Size 5.7MB
SHA256 d686d7a8b3f2de2016c8cede86e38022e6edd1f4556dcaa0408d4a89733e4c3f
MD5 12b0ef6826c707ddaf132b2876cf48cf
SHA1 bb22e5ea5183febef72b25b1602ca19923ae56f1
SHA512 fe85b9d17b7fd733e1c3b8b2c79ea92dc33872ed8f96b8965cb7ccfc8bffd47c0544b9c46b1337e8e27566c46664e286b21d3523b6380961007603b686e63f87
SSDEEP 98304:c0SVIKsGBdlVsGISZO6+SEzHyCKqwxaXAuJYdE+gCHZ/RegrrwT:c0wIAvSGISc6+SEzHQP0TJYJgOZ/RDrC
TLSH
T10F5633F877AA11F108CD77FEC4E466AB445368E94A649CC839F6034D2A17D2097F92BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310._pth

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\_\python310._pth
Size 80B
SHA256 e9ae01c8efc72ff96484d7f54ae47805a16c0eb842721e6f03e677f356e781e9
MD5 0c2d1a15406e669769ac3e7808a815df
SHA1 9cf43b4194501b816dbbb83e2911db48f0a5ae11
SHA512 c88854660cd87c04138efaa867c84a8942272f607e1bc036b10195c154fb2eb339a58739d1388d9c0dcebda094fae47c28106f1da16837e3d817f439d0fcf6e8
TLSH
T139A0220208A30080002020283FC000F88F32330C8B00320CAAC02E380200E30ABE203F
MD5 SHA1 SHA512 TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\_\python310.dll
Size 4.0MB
SHA256 b4893ed4890874d0466fca49960d765dd4c2d3948a47d69584f5cc51bbbfa4c9
MD5 73cadab187ad5e06bef954190478e3aa
SHA1 18ab7b6fe86193df108a5a09e504230892de453e
SHA512 b2ebe575f3252ff7abebab23fc0572fc8586e80d902d5a731fb7bd030faa47d124240012e92ffe41a841fa2a65c7fb110af7fb9ab6e430395a80e925283e2d4d
SSDEEP 49152:0izdDWQcAdLh1ckY/wqIEh8rvZGsIBGfHP2MZnaPxQ1w7OEnGI8wgJyf:0uAk3rWBcH+MZ0Q1wlnYZJY
TLSH
T109167E31E541A164E9F626F3A3FF4AF708E59C982726E0D3A1D978C446712D322F924F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.zip

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\_\python310.zip
Size 2.5MB
SHA256 9d20556e004db4eb76fdb10ea907e38e777653a6cc9878d5b53b31287fb4c36d
MD5 ea0e614730782ddcdafaf0c0c1369655
SHA1 f17020596a57681748057f9eb12f50129d664e0c
SHA512 d295b8d7abd11f07f79ea6de0c0bc92104f8f6e81fb1a89a6348bd97b5ced69542dd39deae176321a1b1eb3ea7b031a7e55f20ee4ff66f95f662613d7aa87afe
SSDEEP 49152:zfcH/E97OMYHoXa6RqbY1xoTvyUL3XH2WHUkRnlcjJFyPWoSqJ:DcfE9SMXXoTv7L3XVBF4m
TLSH
T11FC52323CBACCF5AEE8BB3BD151CC72685AD9B5035D0E5CE682850D8ED4B4C44B4F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\_\pythonw.exe
Size 97KB
SHA256 ff507b25af4b3e43be7e351ec12b483fe46bdbc5656baae6ad0490c20b56e730
MD5 8ad6c16026ff6c01453d5fa392c14cb4
SHA1 69535b162ff00a1454ba62d6faba549b966d937f
SHA512 6d8042a6c8e72f76b2796b6a33978861aba2cfd8b3f8de2088bbff7ea76d91834c86fa230f16c1fddae3bf52b101c61cb19ea8d30c6668408d86b2003abd0967
SSDEEP 1536:93b37AhIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/O5sX7Sy1Px0e:977ASwMpdCq/IM8uIGf1/O5sXzx0e
TLSH
T14BA3E552E66CBCCDE51CC4351A76E0F25E24EC316680A15EB7F3BF062935253F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.dat

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\_\setup.dat
Size 1KB
SHA256 73514dddff7aa6f7da07ef804529fa8d2f9d2a4160e5dfaaf256e2db5b9cae8d
MD5 93eec9b6ad6822ede287dafedf767abc
SHA1 555709330e25bfa7a5fd5a94289e8be9e34a54f1
SHA512 b520a1c741ec7854a3ae463751397e0ef645ff5c5809a3093b8270c04158531d9267f0450ed600ec07ec573c28d9880f2a51e40277a40f712e54b29e7375189b
TLSH
T1E32144A24C87180485B2C2871E2394D783892FA2933BBD3775EE49C5FF14CD08348B2D
MD5 SHA1 SHA512 TLSH

Submit Download

zhen.mkv

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\_\zhen.mkv
Size 587KB
SHA256 4bec0bc59836a890a11568b58bd12a3e7b23a683557340562da211b6088058ba
MD5 63cdadb8047e200ef81d63dbcfac7bbb
SHA1 c25e716a9e9b968df045aef541001a229082c8e4
SHA512 a30f8a214cbe5c0efcbfc4f2cae80f23e821044d167e8d33d882415f0544ae8ba78ad23fa17d58ad92cf7e46c31bded170eefb3d3bd8130d1fa78c6f2dcd5f58
SSDEEP 12288:DuZjs0po2L7FwGeMAi1T2U5Vqkv811uG7hw6suPv/uDprIgIg:DKs+LZZUi1qUfJS1Hh5scv/uDp5
TLSH
T10BD4AE173AE5C07ED25215308A1D6BB590FBC7680B3608C763809E6D2B359E6D73B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\msvcp140.dll
Size 572KB
SHA256 7de531e0daa941b923e227ed478d4c7848c9a5dc8d8ce29f941c075803922bc0
MD5 ce664e686e70981520922211a69aa698
SHA1 f3052df3f340a3e205cd2f3e631728505fd0f946
SHA512 a12caace9c931d1f1ca331ce7ec070a4b6c52f3f4344183efea97afa5dced13da0d9a184d32f16d6edd83f127428f7fc108c8d352badb8e91130858eca20ce2d
SSDEEP 12288:q9zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVhVsS:q4wPrALhAYvogQEKZm+jWodEE7f
TLSH
T1F6C41923B74905E0E195E3B891878706D7F1BC4A4312A3C792EBD69D2F673D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\vcruntime140.dll
Size 127KB
SHA256 80c1ba8d8e6327e828808446b87951ff435b93cb02336fc23b1d8d333c5e8627
MD5 e6cf62b48ed5ec70fab42623ed6c8f7f
SHA1 0d3f6ef1f2f8ef30e59da5ce9552456ff2ae3cae
SHA512 53d29a094c6327f0cc903ac2fbe9ec1dc8e96af989a047c4d3b73dac710263e2b6f87a29f5c197eb4eee14421a3f22b44a6e9ad819b9a658f6eaec120860b264
SSDEEP 1536:29TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaRLIzJ64zEU0m:2EnsvReGsWyxLizXFkecbd1aFIfuwFJ
TLSH
T139D39D85B2A002B7D16BD174C1A3AE17FB75B54483A0A3CF03B59A650F53BE0AE3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\Order_Details\vcruntime140_1.dll
Size 58KB
SHA256 0b2d7a91ee207da9ec48ced80b9baea712a23fd27472eb712167cc0e5752d136
MD5 9addb6dab16076e3bc8de3c35117815f
SHA1 b4098ad5c815ca8b03e6b1e86a7879f6e6e66640
SHA512 83c238cc9e38e96d8bfab7a814cb7405f1504ee60bd7475e8aec1c501b67a88436437e3ec08b3e871c0301bfa2ff3b3f9cb98102646e1f4a8bfffa74bd64265d
SSDEEP 768:jzzO6ujT3MbR3v0Cz6Sz5q83ywZg1HxV9zxfdED+9zkn1WbK9zI:aq/oMx3hWHxnzxfdEWzk1WizI
TLSH
T180436C9597784086D89BA8B081DAEE537D3CF7D60B10964B07A0E5981F633C5EB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 8db0078a4e0dc03593dc834d3b421d2762c6696ac626d102c30563dcd13453e7
MD5 60ff5048595cf9087ae37a0d8e51dfec
SHA1 8853bdd0d86b731628dc467f0d7158e7b499ddf4
SHA512 b204e2a00dbfa471a04d7cacc790ed2b1bece5a9d8a72533e943a0742474bcb487f0bc3bd9cdf68d589bd167b465f758a1392a825c9d7d91ff92421f47ff18ae
TLSH
T134211E5356DF3B0AE00143B2813A977BEE307C02D740520FA988110BBEB8E404B4CB6E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5148-2063-0x0000000006DF0000-0x0000000006E54000-memory.dmp

Download

memory/5276-204-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-246-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-2054-0x0000000008A30000-0x0000000008FD6000-memory.dmp

Download

memory/5276-2053-0x00000000083E0000-0x0000000008472000-memory.dmp

Download

memory/5276-2052-0x00000000074A0000-0x0000000007506000-memory.dmp

Download

memory/5276-2051-0x0000000007100000-0x0000000007106000-memory.dmp

Download

memory/5276-170-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-176-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-180-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-155-0x0000000004050000-0x00000000040FD000-memory.dmp

Download

memory/5276-156-0x0000000006D60000-0x0000000006E0E000-memory.dmp

Download

memory/5276-157-0x0000000006E10000-0x0000000006E74000-memory.dmp

Download

memory/5276-158-0x0000000006FF0000-0x00000000070CC000-memory.dmp

Download

memory/5276-160-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-159-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-162-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-164-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-166-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-168-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-172-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-174-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-178-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-182-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-188-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-196-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-184-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-218-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-242-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-260-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-258-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-256-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-254-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-252-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-250-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-248-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-186-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-244-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-240-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-238-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-236-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-234-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-232-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-230-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-228-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-226-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-224-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-222-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-220-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-216-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-215-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-212-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-210-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-208-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-206-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-202-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-200-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-198-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-194-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-192-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5276-190-0x0000000006FF0000-0x00000000070C5000-memory.dmp

Download

memory/5388-91-0x00007FFB616D0000-0x00007FFB616E0000-memory.dmp

Download

memory/5388-54-0x00007FFB616D0000-0x00007FFB616E0000-memory.dmp

Download

memory/5388-51-0x00007FFB616D0000-0x00007FFB616E0000-memory.dmp

Download

memory/5388-53-0x00007FFB616D0000-0x00007FFB616E0000-memory.dmp

Download

memory/5388-55-0x00007FFB5EF50000-0x00007FFB5EF60000-memory.dmp

Download

memory/5388-56-0x00007FFB5EF50000-0x00007FFB5EF60000-memory.dmp

Download

memory/5388-89-0x00007FFB616D0000-0x00007FFB616E0000-memory.dmp

Download

memory/5388-90-0x00007FFB616D0000-0x00007FFB616E0000-memory.dmp

Download

memory/5388-92-0x00007FFB616D0000-0x00007FFB616E0000-memory.dmp

Download

memory/5388-52-0x00007FFB616D0000-0x00007FFB616E0000-memory.dmp

Download

memory/5388-50-0x00007FFB616D0000-0x00007FFB616E0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads