f4750f6f64c44df03ee2921de77e63c30e84e03a3aad07fd00f292265ff164c7

Analysis

max time kernel
898s
max time network
439s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
26/06/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirtualBox-7.2.10-174163-Win.exe
Size 169.6MB
Sample260626-sd63jact4s
SHA256 f4750f6f64c44df03ee2921de77e63c30e84e03a3aad07fd00f292265ff164c7
MD5 fdd157ad9dbe552346ad4b89a06342d6
SHA1 152ec8d70b228d52574d8c44772ec4a755ba2b78
SHA512 6a4cd6b170911d0fc0094af05e69ac75703141043f58f63ad19d2c58628c05e4a6dcf032d08c198ffc29f8b9b135a72da06d10466d22839d445884454cb582a0
SSDEEP 3145728:MvXPa9TVFLI7HlYjBQbggIzeW2ZmNL6DKxQruT0l7L/r+I2HC9s/BywjRtOq:s/axVpIajwgxze/ZmNWDK2o0lL6xHWy1
TLSH
T141883344B3D13C36D78A43FFC4925BB19A2FAC384313405762B6E25E5DB6BE493A22C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET4CBF.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET4CBF.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxSup.sys	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\T:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\X:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\B:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\I:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\O:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\S:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\V:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\W:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\K:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\M:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\P:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\Z:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\R:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\Y:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\Q:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	VirtualBox-7.2.10-174163-Win.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_28e8be98fb7e7cd3\VBoxSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{afa10cd0-94ce-b74c-9f6e-7b09f9c61338}\SET4B48.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_28e8be98fb7e7cd3\VBoxSup.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{afa10cd0-94ce-b74c-9f6e-7b09f9c61338}\SET4B48.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{afa10cd0-94ce-b74c-9f6e-7b09f9c61338}\VBoxSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{afa10cd0-94ce-b74c-9f6e-7b09f9c61338}\SET4B49.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{afa10cd0-94ce-b74c-9f6e-7b09f9c61338}\VBoxSup.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{afa10cd0-94ce-b74c-9f6e-7b09f9c61338}\SET4B59.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{afa10cd0-94ce-b74c-9f6e-7b09f9c61338}\VBoxSup.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{afa10cd0-94ce-b74c-9f6e-7b09f9c61338}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{afa10cd0-94ce-b74c-9f6e-7b09f9c61338}\SET4B49.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{afa10cd0-94ce-b74c-9f6e-7b09f9c61338}\SET4B59.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_28e8be98fb7e7cd3\VBoxSup.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_nt5_unattended.sif	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxCAPI-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_bg.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\installer\python\vboxapi\src\vboxapi\VirtualBox_constants.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\debian_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol9_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel4_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_th.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_es.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qoffscreenVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6GuiVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox.VisualElementsManifest.xml	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\lgw_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UserManual.qhc	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_it.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuth.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qminimalVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_de.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ko.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_lt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_zh_CN.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxClient-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxExtPackHelperApp.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\vbox-types.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_CN.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxProxyStub-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxRT-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\installer\python\vboxapi\setup.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6CoreVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UICommon.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxBugReport.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxC.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDbg.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\vbox-arch-types.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\fedora_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxBalloonCtrl.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\styles\qmodernwindowsstyleVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_th.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox_70px.png	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UserManual.qch	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ubuntu_autoinstall_meta_data	msiexec.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI4370.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3489FA13951FAADB.TMP	msiexec.exe
File created	C:\Windows\Installer\e593687.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4450.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4ABB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43A0.tmp	msiexec.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI389B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4460.tmp	msiexec.exe
File created	C:\Windows\INF\oem3.PNF	MsiExec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI385C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI443F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\e593687.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI392D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3FD6EAB5DD9DCC6A.TMP	msiexec.exe
File created	C:\Windows\INF\oem2.PNF	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\MSI390C.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B6677AC4-AFE4-4CA0-A2DE-9C5F72048B7B}	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4CFE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI391C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3A8ABE3A56F1A110.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43C0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4481.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5157B3748413FCF6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38EA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B22.tmp	msiexec.exe

Loads dropped DLL 24 IoCs

pid	Process
1656	MsiExec.exe
1656	MsiExec.exe
1656	MsiExec.exe
1656	MsiExec.exe
1656	MsiExec.exe
1656	MsiExec.exe
1656	MsiExec.exe
3944	MsiExec.exe
3944	MsiExec.exe
3944	MsiExec.exe
3944	MsiExec.exe
3944	MsiExec.exe
3944	MsiExec.exe
3944	MsiExec.exe
5692	MsiExec.exe
5692	MsiExec.exe
5692	MsiExec.exe
5692	MsiExec.exe
5692	MsiExec.exe
5692	MsiExec.exe
5692	MsiExec.exe
5692	MsiExec.exe
5692	MsiExec.exe
5692	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirtualBox-7.2.10-174163-Win.exe

Checks SCSI registry key(s) 3 TTPs 31 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ab511af7d208ca820000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ab511af70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ab511af7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aab511af7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dab511af7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5044	msiexec.exe
5044	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeIncreaseQuotaPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSecurityPrivilege	5044	msiexec.exe
Token: SeCreateTokenPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeAssignPrimaryTokenPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeLockMemoryPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeIncreaseQuotaPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeMachineAccountPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeTcbPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSecurityPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeTakeOwnershipPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeLoadDriverPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSystemProfilePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSystemtimePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeProfSingleProcessPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeIncBasePriorityPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeCreatePagefilePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeCreatePermanentPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeBackupPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeRestorePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeShutdownPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeDebugPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeAuditPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSystemEnvironmentPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeChangeNotifyPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeRemoteShutdownPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeUndockPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSyncAgentPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeEnableDelegationPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeManageVolumePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeImpersonatePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeCreateGlobalPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeCreateTokenPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeAssignPrimaryTokenPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeLockMemoryPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeIncreaseQuotaPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeMachineAccountPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeTcbPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSecurityPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeTakeOwnershipPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeLoadDriverPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSystemProfilePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSystemtimePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeProfSingleProcessPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeIncBasePriorityPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeCreatePagefilePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeCreatePermanentPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeBackupPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeRestorePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeShutdownPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeDebugPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeAuditPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSystemEnvironmentPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeChangeNotifyPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeRemoteShutdownPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeUndockPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeSyncAgentPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeEnableDelegationPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeManageVolumePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeImpersonatePrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeCreateGlobalPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeCreateTokenPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeAssignPrimaryTokenPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe
Token: SeLockMemoryPrivilege	5104	VirtualBox-7.2.10-174163-Win.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5104	VirtualBox-7.2.10-174163-Win.exe
5104	VirtualBox-7.2.10-174163-Win.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1656	5044	msiexec.exe	80
PID 5044 wrote to memory of 2464	5044	msiexec.exe	84
PID 5044 wrote to memory of 3944	5044	msiexec.exe	86
PID 5044 wrote to memory of 5692	5044	msiexec.exe	87
PID 3484 wrote to memory of 5200	3484	svchost.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.2.10-174163-Win.exe
"C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.2.10-174163-Win.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5104

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CC2117A7271F43A64BEF5DA8ECE95493 C
  2⤵
  - Loads dropped DLL
  PID:1656
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2464
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C77419B8F17C70A32A2DE072170FE553
  2⤵
  - Loads dropped DLL
  PID:3944
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9559D77B10DEC2CFE892EAFAC354DB3A E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Loads dropped DLL
  PID:5692

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf" "9" "4ff1aec5b" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBoxSup.cat

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\vboxsup\VBoxSup.cat
Size 11KB
SHA256 f24510cbe7c05887e17dcd6b3cf2fa7411a4cdf54853a25b3a9bb3bca42f82db
MD5 4b09b6950d55378e7da14c76a367c6a8
SHA1 c1789608407d823828588483cb707afb5c2fd655
SHA512 fc70c632ea8f0fccb84bed4040701d27041b4cc9ec051b3ea90f44459e17281b8b0359d80b351588b13d37335bef3933fa4f029e7ff48b8395badcfbc285aef7
SSDEEP 192:XOcqWJCFPXWEwGJhYCUpQcNpcspKLX01k9z3A8L3GRT:hUP3h3USscmeR9zB70
TLSH
T127322CE245A84083ED97BC6003E8E5577C7E37CB5950947662EBF6190C573C8F72426D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxSup.sys

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\vboxsup\VBoxSup.sys
Size 1.0MB
SHA256 96aaef16e8b4905f2e7d599bc069b21eae1f6fa5953f5bfd5ddfa7b620ed9fef
MD5 0b32ee4127f8c618c84b5398b54e326e
SHA1 f369b1abb23c486683efba8b26a421c6fdea2d63
SHA512 7d9977fd7e2b1889454ea7ace75d043d9b8bbe5beeea701dc50723b79bf5f0dd43850766217fa584d24e39ad0744a7c1a5d402465b4cd45e79a7f36b48c086c0
SSDEEP 12288:HOOyiLyqHEuFQTVVTyvRBPHuOrEzBGUMnVZJ3eQDO1Pan6/wLAT+:uOrRlQTVVTyvPOOrTaan647
TLSH
T1B2359E9EF6A40AE5C5AB8134D2C1452BD2B678011760C7EF06E693A51EB3FDA1E3F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxSup.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf
Size 2KB
SHA256 088112b6f835c1cac95ce7199a37f0d78d8752031f0f717f5e2fa70d06df5041
MD5 c7ea004c0346f411dbab8a3f921ebde6
SHA1 dc8403e9d591c81de799595c626f06e8b8812619
SHA512 7423d14095f134d871fde1ee9e37b69e9bd21a817eb8ef80fbbc8edb8a65ceee254ff30a7fe04f28f6757325ca38dab3de51126058c1ece15328d80808b3b7c6
TLSH
T17E51616E5840877239A6069A3F0BA6C7F3E9701A3CEB186030DECD56925DC2C87394F6
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 43b230edeb0078e6f97dfeb593e9fd44daf6d13f94053c923050a8dcc7a3ea6f
MD5 59aebe45dfcd3309ac6f7e718247b423
SHA1 a7ea32b209731d07db552449d8fdf51be8e5678e
SHA512 bf41daf2df84a0bf16c8b0ac288b3bc4575c55123b3c0c6434fe0a26b74c2014fc271e785e466d323f967cc7ce3c75860f3e216f213e3c772d470724cd504497
TLSH
T10DF0DCA368FA20D2B41698FC49F9093820B05BCF08D60267383E46928DAB16C624E025
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 727B
SHA256 c4c6a0ebf332ceaad6a6bdb5afc900e96d76e92b729865d11cd71cfd6276fd72
MD5 56cbea556219e281c4585444330a8614
SHA1 d8aac06173894fed8200f9f11c98ed017c60b3b9
SHA512 6a803d89f804f8d7de46ba84a564c001cbd0ec462c9f4eedc82946de9bd446a02c49d5f7eb849fc33f2614adf28f1794d1c86e89bfa208df6795072451466da9
TLSH
T1FB0115810B7EB751BD6A1D5CDA6C51B232D0C16404D965EF747590A1D5827262701460
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 43f5b735b417c2c9e8b78d2148f56c0637886cadd57222748e4da41e5e123afb
MD5 b044919f12450fa72690c1689c6bc702
SHA1 cd596c44bcd9a42a2c12af9e0677d8a7957390b5
SHA512 f02f01ba750a96dacc1e77aa0def64fee9951b89217c083e299b762c7a297a2fabcd9a14123734d7075264aa61eaae2291b4a483392f13ff81ac58f9162e25c1
TLSH
T1CB011093B1E4BE007C460EE5EFFE97B03A7A538414C5D225364138DE26D97612E62C8E
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 cdff248b1a53878fb0b6fdc9c1f9bed77fb9549dfa18699ac39ccb480c65d662
MD5 e7ca6617265a12c20613b0d0c35a6db1
SHA1 aa6fe46728008290a03ce8a2e8dc174f9b7c0d37
SHA512 ac05acde1e7db775ed8609c2f91861f4d824059f8d0ed829605a225116aba8a63d5e44d363a7fae95dd347f5aeab72c1167063f61a7e8267c6e16d9afa20df89
TLSH
T17EE0203416FE501EF2B4DBB803D9D0D56F3AF1126D45A6BE1DC11C2D9519A004C62C35
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 408B
SHA256 c901688969a16684097b00d449ec0e0a3eeb76233f21e551438178019cb16764
MD5 d8fe494bf0245e46d88a7028a0d15e88
SHA1 8535fb152f2c1cb27283e00939fad96a31a5681e
SHA512 0537ab372363865d79d5f3e82f1550fc817daad205b07fb43be38743ca51b9dbb1752ee4a82e885afb110e292a1088bbfd65664cff4f90efec51fe3f3fb40d39
TLSH
T196E0C03C20F7454DF1B0E47A02E466258A7AF2050D08D27C11C002016A357006CB2A34
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 42df42a7733d1e3b99698736089103a13e2009aff1349f0480f132a6a38342b5
MD5 329c83cf834b3d1327ca7129cdebf82a
SHA1 843210de8b40b93d58221df74d6b2882f24580e9
SHA512 fbdbb0c27c3f62d98ee8847485db90cc2676d52526a59984a4203462659335ebeadbe82b21de4c54a372f26db7d525391b33f482ed2e122c4b911981cb57d083
TLSH
T1EEE06F2821EBB91EF090D83542E9F0B61E69F2001840E2B816C0030EAB8AE005C21AB8
MD5 SHA1 SHA512 TLSH

Submit Download

MSI431F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI431F.tmp
Size 493KB
SHA256 6db31aab8ce4b66da645ec1afa003b1482287e1509a152bfa9794902643f56cf
MD5 7782584ca06b61fd337a1809c48a75a6
SHA1 f423e9344eb05d28e5b3e7e9a9c6fe8033515da0
SHA512 be4644e627c36a28c58d05996874aca958fd9bdbf835f523f8f89b1258804f203892f0caaf2792cade56c4c9dfefd055256df01470d497a11d1e5827d7e1e666
SSDEEP 12288:I+CdCOGw0NI56FphWPnOtlmVI3OXdOwZzGDUd:FCbGbNI58phWPnO3sdVa2
TLSH
T13DB4BD667BD12B75D85BC13E88A38002E7B37445031482EB47A682694EB3FD6773EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI83dfe.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI83dfe.LOG
Size 112KB
SHA256 9f70efd44d714ad4a87a7cab54af8d4779b9ae3bfc0e9868f1cc34c98489842e
MD5 aa8a9b489cb9c51da842ff4120114760
SHA1 f6fbc6071c84f9f730bbdb8b44f2c70b66d51d1a
SHA512 3bf006445b3e52a7776fba9cd77b3ae4a2ff576e28350c1d8247e60ab2e13612f568dc0d766f19cedae712aaf5ba087d110cd555dc032937fcd15db583230cab
SSDEEP 1536:NMwv87qq3oL+yGvWLlaE+A68KFSYCMCgCMCUq+A68KFSYCMCgCMC0K+A68KFSYCw:pRvGfvmwIylR7FF2uA/6+mxt8S
TLSH
T17EB36D2C6FF4024BB2B797479EF348165B77B9597931CA0D3081C21E04B2E09AD6D7BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem0.PNF

Path C:\Windows\INF\oem0.PNF
Size 5KB
SHA256 b0056a1249030dd675164646dd969ef4d4ffa98bf0c0659d8bd0aebfe9074439
MD5 8d9cdee80933bffa7dfa2fb69b7306cb
SHA1 1fd4a2fd520fc0f11aae30c127fe9f50970906a0
SHA512 2c418d201014446be1ee6ac7a931a044d8fa7180754e870d07f4203da66850e44e9579f58a79ccc3964bde79eccb6d8c3d556b400b5e7abfa4aeb883f4f711ae
SSDEEP 96:DWG/Yfb9NdSu3HS5PjLIcU808l9t6aXkRj1fsn7enFWhkq:aXtSuXqPjLIP808l9ga00n7OEt
TLSH
T1C6C1244573E94F15F0BA9E706DF466E26836BC425E12DA4F2264730D1C32E94DBB0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem1.PNF

Path C:\Windows\INF\oem1.PNF
Size 5KB
SHA256 c9805ee48341ec3fb80b319dffeb20fff3ad4024700a1b815a948761fb9a7a6b
MD5 7340f798c957f32f59aa815e8d9af9fe
SHA1 e5f5951e3a5b12f2268a906be8d5dd9af3fb0050
SHA512 36143028a700e89d3f8768935c30c7e07585b835bdcfb61a1e0ef9886ff5dd23afa913c46dbb2b89d38edf2ddd27f746e905e65a2f8b04294b4210435a38308e
SSDEEP 96:CDi0PEnktiuIR0a8pjnWUk8q5Fh6uXkRM1fsCY3ekSDr7:CWaiuCZ4jWH8q5F0u0FCY3WH7
TLSH
T1BFC1495673E98F11F1BA8E716EF4A6E65872BC025D11CA8F7154331D0C72E909AB0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem2.PNF

Path C:\Windows\INF\oem2.PNF
Size 6KB
SHA256 8ea4b547115492067dadccb59f86655e8b8115e1f53559c78eeab73a41c71f20
MD5 0c2a41935f16755dd26bc1a40ada3250
SHA1 06ec44a2ff842a4dddcb3ba8831ff0cf8aec52ae
SHA512 e958722478fe933b898b611c56f6ae52bdb67dd0c67d09d30bfd806b858c04f7d1e34dedaacec8ff8d56daebf4c4f0072aab5136737bfcdd8f89c5ba779a6a81
SSDEEP 96:v4rgQY2e/NI0IXSu6o4zvM181fQ1UvZUuQSCUJ:L2e/BfosxZUK/
TLSH
T1E8D14645B3F88B15F1BA9B306DB512E65436BC619C12C65F3160338E0D72E949AB0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI391C.tmp

Path C:\Windows\Installer\MSI391C.tmp
Size 383KB
SHA256 61a20a2e5b2e759c2db35545419cb75ab9db16e66fd21ce580a6f9836f3e7a9b
MD5 bca7365c591167f140b6ee5af5cda59e
SHA1 a6f299b5e70bd7c5b6a724fa869b0d8fcd0bb4a0
SHA512 c5651e422034c625e4abd3a46458069e6a9c6e74fb189ab06a3ff32ddc843e023cd68106a52c6d850532d0ca4650d370f063b8fde9624fcf8fd2f6ef700b9bd5
SSDEEP 6144:UEMG77h/h+OuGMgdH2NjItYRzCuY88tTUP8Mng8:UwJZbMtItYRzCuYVTe8M
TLSH
T12D846B29B7E408EDE4B78276C5A68131FF75744D3720D5AE8BA8452D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 3af2dd0e91c5d0184a3229345f590f7d4e14b2dfbecc6f46e58bb0237e2e7b6a
MD5 3b4009d72972f092776448575ea07488
SHA1 d80fd8d52a5dc5646eff80fa9debdf6f39a1ce5b
SHA512 cbf5e9d6d94cb4472b4b7e90daf7a9ad6cff793815633120a7a7f1435a79ade3d7a886680977df8eac279f22da7a3029db6789385343c7db9c445a4ab14e290d
SSDEEP 24576:c2gmSp19doO/vvTLjWouhknavK5jQI8iGmrtX50ohTa40UM9oDJfrFyvR:U
TLSH
T1A247E32432F92210E7F79E3C68F06A67493E7D5B9C15DE8D05421F4E0A61BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f6afb980-127e-48ca-8552-53d24b0e9c65}_OnDiskSnapshotProp

Path \??\Volume{f71a51ab-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f6afb980-127e-48ca-8552-53d24b0e9c65}_OnDiskSnapshotProp
Size 6KB
SHA256 c5ca3075b2d5234fc6e2dafe3bc85e7e44c50eb673129e05dd7294ad196bddf0
MD5 0cfa556b93a15cb39d50cc17d193008f
SHA1 476afdf66299fc4c23c3990e3082196efd74d767
SHA512 40364b31d78cfc87561091f35f0b173edb3f8523a46e2399d2142e0818ca329e2cf931c0cb15ba27d36dc259a4caf98af48c2a0c9eda8380ca7d1d3d8fe4f4f5
SSDEEP 96:F5hxsbsrvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:dxsYb++ZVmN
TLSH
T1F1D189185AE54311E2B3AB712DF14557A877B911EF33CB8E0198638E2670910F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1560-460-0x000001DCDE750000-0x000001DCDE9BE000-memory.dmp

Download

memory/1560-472-0x000001DCDE750000-0x000001DCDE9BE000-memory.dmp

Download

memory/1560-470-0x000001DCDE750000-0x000001DCDE9BE000-memory.dmp

Download

memory/1560-97-0x000001DCDE750000-0x000001DCDE9BE000-memory.dmp

Download

memory/1560-468-0x000001DCDE750000-0x000001DCDE9BE000-memory.dmp

Download

memory/2464-429-0x000001D771D50000-0x000001D771FBE000-memory.dmp

Download

memory/5044-449-0x0000022265730000-0x000002226599E000-memory.dmp

Download

memory/5044-463-0x0000022265730000-0x000002226599E000-memory.dmp

Download

memory/5044-440-0x0000022265730000-0x000002226599E000-memory.dmp

Download

memory/5044-469-0x0000022265730000-0x000002226599E000-memory.dmp

Download

memory/5044-428-0x0000022265730000-0x000002226599E000-memory.dmp

Download

memory/5044-59-0x0000022265730000-0x000002226599E000-memory.dmp

Download

memory/5044-485-0x0000022265730000-0x000002226599E000-memory.dmp

Download