5e315e9391fb403264bfeaa07adc37e4dbac00a007e88914e06bf90f2388a845

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 131KB
Sample260723-amd41atsaw
SHA256 5e315e9391fb403264bfeaa07adc37e4dbac00a007e88914e06bf90f2388a845
MD5 c44a5d644c0fa6ee4eb8163271c99741
SHA1 71f1b980cfd88019f7d4bb890b60d0bd72d7db10
SHA512 dd242fee91a05eb9046e7a3eda69659ac3af9ac382fa2859a8011f5cf1e2e30337b1fba118cd28a1c1851ab553a7b6936307f39fbd39259bb8856e1e361d2cb9
SSDEEP 1536:LInbJiEbuoFSJVSx9sb60546ehxNPW8Yctwn5KT:LInbEEbvQM1X9WNcA5C
TLSH
T12FD3E64A7D41880CE57C05B6FA758D91423BADBA8C0C77C4A849B77E19B2039CEE3D76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery

Malware Config

Extracted

Credentials

Protocol
ftp
Host
umagpack.kz
Port
21
Username
assan
Password
Umag2021!

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5824	UmagPack.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\UmagPack.exe:Zone.Identifier	dfsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UmagPack.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\identity = 556d61675061636b2e6578652c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\Files\Resources\AnyDeskInstall.bat_5be3819b00b56 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\Files\Resources\Xprinter58x64.bat_6906110a317b57 = 01	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "ENPG3TWZM5659HGJ7D432KH0"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\appid = 68747470733a2f2f756d61677061636b2e6b7a2f556d6167496e7374616c6c2f556d61675061636b2e6170706c69636174696f6e23556d61675061636b2e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c2f556d61675061636b2e6578652c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\SizeOfStronglyNamedComponent = 6d84020000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\SizeOfPrivateComponentsInDeployment = 88000a0000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	UmagPack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\umag..tion_5153edb1559ac3ae_0001.0000_29bbfe9f340c5938\appid = 68747470733a2f2f756d61677061636b2e6b7a2f556d6167496e7374616c6c2f556d61675061636b2e6170706c69636174696f6e23556d61675061636b2e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag..tion_5153edb1559ac3ae_0001.0000_29bbfe9f340c5938	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\PreparedForExecution = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	UmagPack.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	UmagPack.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\umag..tion_5153edb1559ac3ae_0001.0000_none_d90cbe943139dfa3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software	UmagPack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\umag..tion_5153edb1559ac3ae_0001.0000_none_d90cbe943139dfa3\identity = 556d61675061636b2e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\umagpack_none_0001.0000_none_1f818f2f382a5fbb\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	UmagPack.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft	UmagPack.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_umag..tion_5153edb1559ac3ae_6a692c7378cd08f7	UmagPack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\umag..tion_5153edb1559ac3 = 680074007400700073003a002f002f0075006d00610067007000610063006b002e006b007a002f0055006d006100670049006e007300740061006c006c002f004100700070006c00690063006100740069006f006e00250032003000460069006c00650073002f0055006d00610067005000610063006b005f0031005f0030005f0030005f003100350033002f0055006d00610067005000610063006b002e006500780065002e006d0061006e00690066006500730074000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	UmagPack.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	UmagPack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\lock!09000000a5d5590ec0160000041200000000000000000000cf955 = 30303030313663302c30316464316133393266633365333636	UmagPack.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\umag..tion_5153edb1559ac3 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\umag..tion_5153edb1559ac3ae_0001.0000_none_d90cbe943139dfa3\identity = 556d61675061636b2e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\HasRunBefore = 01	UmagPack.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\umag..tion_5153edb1559ac3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\umag..tion_5153edb1559ac3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\umag..tion_5153edb1559ac3 = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag..tion_5153edb1559ac3ae_0001.0000_none_d90cbe943139dfa3\SizeOfStronglyNamedComponent = 2e43000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\SubstructureCreated = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\umag..tion_5153edb1559ac3 = 32003000320036002f00300037002f00320033002000300030003a00320031003a00320030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\umag..tion_5153edb1559ac3ae_0001.0000_29bbfe9f340c5938\reference!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\Files\Resources\Xprinter58x86.bat_68c2004e320b7b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\Files\Resources\setupToledo.bat_447ec18e3a383ec0 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	UmagPack.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "YV7MGHK6GBZAZQKOQRXLPQ36"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\identity = 68747470733a2f2f756d61677061636b2e6b7a2f556d6167496e7374616c6c2f556d61675061636b2e6170706c69636174696f6e23556d61675061636b2e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c2f556d61675061636b2e6578652c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\lock!0100000037d0590ee00400007c0900000000000000000000 = 30303030303465302c30316464316133393237646463363331	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\implication!umag..tion_5153edb1559ac3ae_0001.0000_29bbfe9f = 68747470733a2f2f756d61677061636b2e6b7a2f556d6167496e7374616c6c2f556d61675061636b2e6170706c69636174696f6e23556d61675061636b2e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\Files\UmagPack.exe.config_249acccb2602fba3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_umag..tion_ede41c087a115e6a\LastRunVersion = 68747470733a2f2f756d61677061636b2e6b7a2f556d6167496e7374616c6c2f556d61675061636b2e6170706c69636174696f6e23556d61675061636b2e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c2f556d61675061636b2e6578652c2056657273696f6e3d312e302e302e3135332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d353135336564623135353961633361652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	UmagPack.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\Files\Resources\Xprinter80x86.bat_6bb65d3924b7d6 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\umagpack_none_0001.0000_none_1f818f2f382a5fbb\identit = 556d61675061636b2c2056657273696f6e3d312e302e302e302c2043756c747572653d6e65757472616c2c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag..tion_5153edb1559ac3ae_0001.0000_29bbfe9f340c5938\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e7338006	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\umag..tion_5153edb1559ac3ae_0001.0000_none_d90cbe943139dfa3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c\Files\Resources\.cer_066385236330e2bf = 01	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\UmagPack.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\YV7MGHK6.GBZ\AZQKOQRX.LPQ\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\UmagPack.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
692	powershell.exe
692	powershell.exe
5824	UmagPack.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5748	setup.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	1248	dfsvc.exe
Token: SeDebugPrivilege	5824	UmagPack.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5748 wrote to memory of 692	5748	setup.exe	90
PID 5748 wrote to memory of 3872	5748	setup.exe	92
PID 3872 wrote to memory of 1248	3872	rundll32.exe	93
PID 1248 wrote to memory of 5824	1248	dfsvc.exe	94
PID 5824 wrote to memory of 2788	5824	UmagPack.exe	97

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Remove-Item 'C:\umagDownloader\UmagPack.application' -Stream Zone.Identifier
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:692
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication C:\umagDownloader\UmagPack.application
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Users\Admin\AppData\Local\Apps\2.0\YV7MGHK6.GBZ\AZQKOQRX.LPQ\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\UmagPack.exe
      "C:\Users\Admin\AppData\Local\Apps\2.0\YV7MGHK6.GBZ\AZQKOQRX.LPQ\umag..tion_5153edb1559ac3ae_0001.0000_e12b6b8c5b98e6b2\UmagPack.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5824
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" Dism /online /enable-feature /featurename:NetFx3 /All /Source:F:\sources\sxs /LimitAccess
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\YV7MGHK6.GBZ\AZQKOQRX.LPQ\manifests\umag...exe_5153edb1559ac3ae_0001.0000_none_e9e73380066f4a8c.cdf-ms
Size 23KB
SHA256 853d0c59253f3194c70e0a3d46654c5cbcf3e84648b7104ae22b0fc5755cba82
MD5 2a1520c1c9e6a1240f1d5702b1a3d1dd
SHA1 f106f4384ae8345f1f5ea55fc4462dbb829b8d01
SHA512 c0e26ac06075bd59a3dde4e56ef147697aa2d04decabde37c275f15a1ba41db82038defab528c9e218dab93054a8ab2b2462fd0340f06d160f3c24f482054da2
SSDEEP 192:bytUQM93hy0qPlaRxmPnZOhVy30w3SiGYHLYFpTh0lu4k4Eye9gPSqxZfjCuVc:byiQX0q8gPZcI39NrsThX4k4jeqK67Cv
TLSH
T12BB2C91277D9C922C21552338CC5C7E1763AFEA49E63234B340A7B6F6D71AC89C63A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umag..tion_5153edb1559ac3ae_0001.0000_none_d90cbe943139dfa3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\YV7MGHK6.GBZ\AZQKOQRX.LPQ\manifests\umag..tion_5153edb1559ac3ae_0001.0000_none_d90cbe943139dfa3.cdf-ms
Size 9KB
SHA256 08eb23afdc9085f1d1070a20d7755d5f39fbe1663b4c2e4e2ab3157253a28100
MD5 2c63134637823d27293834b98fefeabb
SHA1 f9da63a8fe681301b3efd746b06a84c2a6006fa8
SHA512 228faddd4e400310d907fdf01fab9c9ce2d9fa71c177588b04373d240131783069f2988993bfa760bc72a07266e62d913be857590239447f4710580de09eaae1
SSDEEP 192:+mcsVcGTF9VnLZnS4kWiTZoxUu4k4Ey9QuBEyl:+mc9GB9VnFnS4kWiTSxX4k4j9QuBnl
TLSH
T1C1222E85BB90DA13C50A6B339CD1C7E2723BBDA58E86C30B7146BB6F7C34B889942155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo2.ico

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Logo2.ico
Size 117KB
SHA256 c927efab8b17c42e4ca3b7e8d6732f233f8d4cb295c09f04a5ba17303cafb8a4
MD5 27f49383b38bb1a081e265885e103e6f
SHA1 f89ef2f0f99a70a0d9edf52599e8be8561091745
SHA512 90e542d24bf184ab8997efd68c5ef2c0a8b705bf9a7a050fd57948575c19b64afbe389c396ace5eca245a0a533ee71da6f4ffc9426876bc2e3a42777c85d1a7e
SSDEEP 1536:tEbuoFSJVSx9ab60546ehxNZW8YcKwn63t:tEbvQMzXvWNc369
TLSH
T152C3D54A7C01884CE56C05B7F6398D96423BADBA9C0C37C0A849F77D19B2039DAE7D76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnyDeskInstall.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\AnyDeskInstall.bat
Size 80B
SHA256 bfe6d16920f485b79ce7742e3f59f322e80401a965300c028425595a393e7d91
MD5 5b9782c1d1bcbb8f9c85106612fc6e29
SHA1 cda62a4529e8df6571ccb5ce46041de2136d6c34
SHA512 5bda41d62a7d91c401ec73d671a1ec93e23b7f561e521a7b5c915ab9c68d91cc42547b841924618e3c43e4b8718e3a7d8745e1b873bc617979c79c6d4a87f51c
TLSH
T1AFA02200282AC2FCB803EC333B02BC0030202C0023AE3082A0C8EA0F20C2C2F20E20C2
MD5 SHA1 SHA512 TLSH

Submit Download

Java32.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\Java32.bat
Size 114B
SHA256 87a5ea7875624ddedf6c73f717e384e656dbe858df97addd27b1a67a2e1066f9
MD5 efb16b0278adb5613757a2c7e73f6a61
SHA1 b60c98cb48a39070cf94b0e7cc6d955460bc9b4e
SHA512 09c73e57c20a1a3649a2a86f15198c52deb3b0a2425d3ab3241cdaa714cb144f3fd8ca6e6f93ed82acb312a4d013700dec111272fd957427c7b2ccff9f307b89
TLSH
T19EB01220B833D178B00DD37C3F495145F67A11D94D205BC2560D004BF165C86107DAEF
MD5 SHA1 SHA512 TLSH

Submit Download

Java64.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\Java64.bat
Size 126B
SHA256 4e143d2c8a7ca4701dbc2e3b76e468b6a35ca1ec2172eee96159576a5d947bfa
MD5 83189cf438442e7aebac38f0230e41ea
SHA1 954fbde40810e5060d922823f1dad8cf9070e853
SHA512 49c7f9ae95ed72c5dfdc789a202c3869975e6996520b4523874622a5ae68fe5a830400c2566c3d65e96ecd246360d2b95f9d7fa111f355ad26de99e60192d6f7
TLSH
T10AB02220A823C238B00EA3282B088222E23A008808200BC3020A020BA22088A203CAEB
MD5 SHA1 SHA512 TLSH

Submit Download

SleepMode.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\SleepMode.bat
Size 142B
SHA256 f83ab7d47afb7d393d78619661dd3875334a3c75096c0069d60239d8a14044e6
MD5 0e6e68bb3b7ee462fd5a5485615953b2
SHA1 5d695d0cd6ecf69135bae30645ef0d26c7745169
SHA512 8247119f47b1a28cdb5c984c83dcaff72f6dd5249362d01bd0057fb92804f2d8591a66bbd062a0b6334740d6a57b935aee2a9a3b0791fdbf140176d1cbc2e2ea
TLSH
T173C00873360A700711DFE77E63A2D08B9BF362143E509A97305EE13A0412015A7B48BE
MD5 SHA1 SHA512 TLSH

Submit Download

WinTurnOff.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\WinTurnOff.bat
Size 48B
SHA256 ab9adc16378740432ae78c36fc378e5f95bcd5ba2bf602f6fce1c412fec3f002
MD5 a86321d32dd379f85521bc3eee3ea6b3
SHA1 f37d1e70c97867a1471eca4a3c046cc688612e27
SHA512 3147a06c61308a5154cf454d307ed36d9cad8ec97017caf211ac08fe0689b82d72b8e6768511328bc4354d4500a091b99405bc61863a92eb880aa8a9c5c620fe
MD5 SHA1 SHA512

Submit Download

Xprinter58x64.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\Xprinter58x64.bat
Size 138B
SHA256 a554a9df925b9350b75d691395472e3ab56f9becd43b283a896e38bb632f94df
MD5 69b054aff36b0f8c6fb9a01a6a37ec7d
SHA1 ce043469afcb50bdd5acdf73c272693d3b1966b4
SHA512 06f3eec67a9078fbb9e04735d65f889a3434f82ca992d56a1c3719ce255debb828475fcd3cfa0fd07a08df3997b3c2711ec11637e9f3bdca262d0ea860840425
TLSH
T1F4C02B9300B5C95020B0C480CB3EB396550F05D222FF34120D04400C78C390140171F1
MD5 SHA1 SHA512 TLSH

Submit Download

Xprinter58x86.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\Xprinter58x86.bat
Size 141B
SHA256 3dc91144c49d24693aa2258bd7cbc4f7f77955934034b18b15bab0dce364e546
MD5 499e862d26335ffa4339e0649d8478b7
SHA1 aa6175112f4f817b00951f4c6028e06cccd3ed2f
SHA512 78661e7ebeb2647373ad308b6435e011ab1e0a1d1e96cf0d7bd48986433f29bfc8d3229d25615183c6241bdb8cd5ecd3c33dc6c542731221c5297f15af422e0d
TLSH
T113C02B9300B5C55020F0C490C73DB3D6461F059221FF74110904401C78C3610401B1F2
MD5 SHA1 SHA512 TLSH

Submit Download

Xprinter80x64.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\Xprinter80x64.bat
Size 140B
SHA256 64e0ddc966a304a507073ffe3447af5bab7bd4b64efa70629e88759c95af450a
MD5 122b7fd317767f737c033e7f0fa8407f
SHA1 2c476466170ba024f98a5a451ba01160081fac10
SHA512 fab5627ce9ba7a4a971bbac3d94fa17ac741240b20438f32be3a3946f3483e4fabe4b58e25a113b7430b80da74256d62c57fbe41e2ed61a6259f69768a37687a
TLSH
T1FDC02B83C0BDC92060B40C08CB3EB386550F05D32AFF34120D00400C7CD390140171F1
MD5 SHA1 SHA512 TLSH

Submit Download

Xprinter80x86.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\Xprinter80x86.bat
Size 143B
SHA256 b61b7ba61977a1a0457ee8c3b3fd6b8c24cd3d313083c6df58c32b94f5e9ecbc
MD5 14fec0257d60369e56927cb409feab6f
SHA1 2de1682e460edfffe65b9f2ee44c1ba3d47e3ff6
SHA512 ae11100c9e45e6e4540cb67f6260c7f4285cec928d58d0d106de0afb968c9860f898038a57e0851cbed1dc61380aa362c30acddb39ff715fffc49e34fdafcf5d
TLSH
T161C02B83C0BDC52060F40C18C73DB3C6461F05D329FF74110900400C7CD3610401B1F2
MD5 SHA1 SHA512 TLSH

Submit Download

setupMacca.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\setupMacca.bat
Size 25B
SHA256 8da1e1d141962c608fac132c00e4873a7feef715fd9dfc535a130c044c01ba31
MD5 a92e35245557495928c206702f6d6db2
SHA1 ec86102ce14a24527bbe7156379d03bd324c5d4d
SHA512 3bc04cdd0f84b91b72e824460d85fe86c2887769564b9dcf8b744598a4138d8845d878a4654950b45078353bba5dfd75193b507969724ecbd8de3226a4351923
MD5 SHA1 SHA512

Submit Download

setupShtrih.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\setupShtrih.bat
Size 18B
SHA256 658e6de99eafedacecfd0c6b2ac940390afd2c2446d2eaecab611fe628ce1bf5
MD5 986240cd42ccb43c0f2d6a197a891f6b
SHA1 630241f255d1d3ed7996bf5853dc23d19f41789e
SHA512 3895f40f8f8ee1fa80c73318590f4fc6a9676ab09577f2a4b0ae9bab92fcd49ab4c0c13d6e15d332ad90b2bccfdf9e126d11bdda2ba717fd95bfb123405b54da
MD5 SHA1 SHA512

Submit Download

setupToledo.bat

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\setupToledo.bat
Size 24B
SHA256 d9634929120e24c3b78e7454511de207edfe4df8203af421497fed06f22b510b
MD5 0fbd851aa5ad788c00f37be780c5f1cc
SHA1 bedafb05d76fc2036ecdb20c503c9ca0017c4145
SHA512 c7df73f73e30badcba72c5906f7792f6a925c68a75f8035ed2cdfd73347afe87e7b0976af3e99e73b91a8e734fe62d86b888adb9e9540776bd7bfa99d4d5e69f
MD5 SHA1 SHA512

Submit Download

Сертификат 2.cer

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\Сертификат 2.cer
Size 1KB
SHA256 847df6a78497943f27fc72eb93f9a637320a02b561d0a91b09e87a7807ed7c61
MD5 ce0490d5e56c34a5ae0be98be581185d
SHA1 8f43288ad272f3103b6fb1428485ea3014c0bcfe
SHA512 2ebfc4c17e241a665f558bccb038a5fb10a73e05db552a31e3f0eae48a93c9617d2a4968f79da677dcbcdb1d7a140be9848aaba26161948d7db44b4eabbb0763
TLSH
T10531B55441ACB883ED446982474C96CF693ED2E20101062E5867EBE624B1FD0DE3852A
MD5 SHA1 SHA512 TLSH

Submit Download

Сертификат.cer

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\Resources\Сертификат.cer
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
TLSH
T13831DA504B3AF2877F41E5C44798F996D87C369308191E124BF5D0D594E7FA5DB0182C
MD5 SHA1 SHA512 TLSH

Submit Download

UmagPack.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\UmagPack.exe
Size 631KB
SHA256 14e2d497c3f09d57f01c0f2b86df07e1356e5f24f86cef546628e454a1f0191a
MD5 2b0f83ef0aa28d2ddec0670083aa0b70
SHA1 258c0b1bf713de6afd0152712da566fd9b228e70
SHA512 5f3fca82d0ea8963832d38a0969eb03acafdccea6c17dae2a4e0cfd0db26ecc6213ff7afe3b622428c0b157fadfa4aac723a9cf33868369add095f95ba07e874
SSDEEP 6144:VRBAqvgHl7BFcblHL9Hp9bHOX+EbvpzXUL7EbvpzXULQuEbvpzXULUEbvpuX2WH:xAqvgHl7BOFOXPpz88pz8Cpz8tpujH
TLSH
T169D4184538148A0CE53D46F7E6358D81437AAD7A5808F3C0AC85B7FD09B2729CAA7DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UmagPack.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\UmagPack.exe.config
Size 544B
SHA256 6f14e0a9bd1653e49d78d3800659a394a52aa4d184abaa4c7c12212bb386e664
MD5 eb5cf2d1ad063f4b3a128d01b92eb92b
SHA1 31aa9eeaf09cdfe94f859c9844c7e53f6ae88c2e
SHA512 c58705ce7b6ae449a3a99befefa24d376c2cd40d300a22c358035755177980a24d8b3888cb357fcf8e8f178bd5252d7cf416c1e97519024717efb4365d7618e4
TLSH
T1E3F09EB325C4AD4ACA331923E511C602EF7412E761554828F4FE9B939F3308403533B9
MD5 SHA1 SHA512 TLSH

Submit Download

UmagPack.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZWQ9NM7.3H8\HXGGQXQL.ADY\UmagPack.exe.manifest
Size 15KB
SHA256 62dc50b588e4a84d425dee7e382451a718b5b470e183419059d4251136704d4e
MD5 1ae029e9ead3775608df0e53ea5264da
SHA1 9c7cada03126dcfe0d09e117d148a39247f39fe0
SHA512 371dfb5c925ffa7b9af8c5d501c180135ec4b724d2e5c6080cf582515dd72a6a0f604d0ad2c55118afea7ab7bf04403d8452598fccf87f05de15d18f6745bdce
SSDEEP 384:IJUc5tunzmt1kZziC+DK+UP0I4rcaZszT/VO4k4j3:Iqc5tunzUpZszTK4j3
TLSH
T1746253DA88F4A811A30191E9BFE199213D017B7341BD119D7D4E09EEAF81988DBD33B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UmagPack.application

Path C:\umagDownloader\UmagPack.application
Size 6KB
SHA256 0e5120008e4b119648f176993d0d53f98db072434b5fe07ec678f3dac64e1278
MD5 61ea9c9f209d2ab6bd6c99bd489e46d7
SHA1 a43dea3dab11ab4f4af0f939079dc5ffbae50971
SHA512 e32a4652a5b5e115525301bcdde86c96010b37863aaaaf401c3a98757f3aed807a67867fde9e088803e54747b5da403010aa1c432b4b3773168570b8463df33e
SSDEEP 96:0WLwO9Zc2Kcgx+dAMGPkgfDMRGfRmOeYaa8ExJs+ZoxVfR5BE4fv04PMywtlBDA:fmxB0gLkG22TZoxVHu4k4EyoA
TLSH
T1C7E1A989CDDCD411E105FA3176E1C113259A27B780EC8058BEDE45AEAF04ED9C6831AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-11-0x0000024834A60000-0x0000024834A82000-memory.dmp

Download

memory/692-12-0x00007FFDCB490000-0x00007FFDCB491000-memory.dmp

Download

memory/692-19-0x00007FFDCB300000-0x00007FFDCBCA4000-memory.dmp

Download

memory/692-18-0x00007FFDCB300000-0x00007FFDCBCA4000-memory.dmp

Download

memory/692-16-0x00007FFDCB300000-0x00007FFDCBCA4000-memory.dmp

Download

memory/692-15-0x00007FFDCB300000-0x00007FFDCBCA4000-memory.dmp

Download

memory/692-14-0x00007FFDCB300000-0x00007FFDCBCA4000-memory.dmp

Download

memory/1248-60-0x000001E56E190000-0x000001E56E232000-memory.dmp

Download

memory/1248-22-0x000001E569690000-0x000001E569818000-memory.dmp

Download

memory/1248-21-0x000001E54EF50000-0x000001E54EF58000-memory.dmp

Download

memory/1248-25-0x000001E569820000-0x000001E569870000-memory.dmp

Download

memory/5748-2-0x00007FFDCD650000-0x00007FFDCE088000-memory.dmp

Download

memory/5748-3-0x00007FFDCD650000-0x00007FFDCE088000-memory.dmp

Download

memory/5748-36-0x00007FFDCD650000-0x00007FFDCE088000-memory.dmp

Download

memory/5748-20-0x00007FFDCD94C000-0x00007FFDCD94D000-memory.dmp

Download

memory/5748-6-0x00007FFDCD650000-0x00007FFDCE088000-memory.dmp

Download

memory/5748-5-0x00007FFDCD650000-0x00007FFDCE088000-memory.dmp

Download

memory/5748-4-0x00007FFDCD650000-0x00007FFDCE088000-memory.dmp

Download

memory/5748-8-0x00007FFDCD650000-0x00007FFDCE088000-memory.dmp

Download

memory/5748-0-0x00007FFDCD94A000-0x00007FFDCD94B000-memory.dmp

Download

memory/5748-1-0x00007FFDCD650000-0x00007FFDCE088000-memory.dmp

Download

memory/5824-193-0x0000000000F00000-0x0000000000FA2000-memory.dmp

Download

memory/5824-194-0x0000000006060000-0x000000000661A000-memory.dmp

Download

memory/5824-195-0x0000000005B40000-0x0000000005BD2000-memory.dmp

Download

memory/5824-196-0x0000000005C70000-0x0000000005C7A000-memory.dmp

Download

memory/5824-197-0x000000000A2C0000-0x000000000A448000-memory.dmp

Download

memory/5824-198-0x000000000A1B0000-0x000000000A216000-memory.dmp

Download