5fb111f32a15763d519bf9ef23e0111153521f641cde7460e5b8e895ca27a1d2

Resubmissions

29/07/2026, 16:41

260729-t7ljcsbe728

29/07/2026, 16:31

260729-t1fdrsbn218

Analysis

user interaction
yes
max time kernel
989s
max time network
709s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirtualBox-7.2.14-174565-Win.exe
Size 169.8MB
Sample260729-t1fdrsbn21
SHA256 5fb111f32a15763d519bf9ef23e0111153521f641cde7460e5b8e895ca27a1d2
MD5 b22e2c92b002609d46790a3c48ed3ad7
SHA1 015310c470b46d1fb55a16d775f8117931ca318a
SHA512 a7e9bcdc2542a674eff48be9f84948a005fe32833f8144c0c2a133c08907117b5000d70a8b1f68b8fcbd2ad9fa3a4b96b75b9e10b93351101b6ab37af8c7bd1e
SSDEEP 3145728:xkF7YfMnLAsLhEczP0mM+1UZRpsuZmNL6DquImhKx837H73+SmIj0EBPfs2R:xk60nLAu2cP0mM+CLHZmNWDquzhx7GbS
TLSH
T17888335473E12C32D78643FFC5935B75AA2FA8344313449B22B6E22E5DB27E853A27C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET3E91.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET3E91.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxSup.sys	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\R:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\Q:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\V:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\K:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\W:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\Y:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\M:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\S:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\T:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\Z:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\L:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\N:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\O:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\U:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\X:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9496cf7c-9eda-4a46-b0b2-a821b486c580}\VBoxSup.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_1c81afc043e2b4e1\VBoxSup.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9496cf7c-9eda-4a46-b0b2-a821b486c580}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_1c81afc043e2b4e1\VBoxSup.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_1c81afc043e2b4e1\VBoxSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9496cf7c-9eda-4a46-b0b2-a821b486c580}\SET3C10.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9496cf7c-9eda-4a46-b0b2-a821b486c580}\SET3C10.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9496cf7c-9eda-4a46-b0b2-a821b486c580}\VBoxSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9496cf7c-9eda-4a46-b0b2-a821b486c580}\SET3C12.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9496cf7c-9eda-4a46-b0b2-a821b486c580}\SET3C12.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9496cf7c-9eda-4a46-b0b2-a821b486c580}\SET3C11.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9496cf7c-9eda-4a46-b0b2-a821b486c580}\SET3C11.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9496cf7c-9eda-4a46-b0b2-a821b486c580}\VBoxSup.sys	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\License_en_US.rtf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_postinstall.cmd	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ca.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxBugReport.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_nt6_unattended.xml	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_bg.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxCAPI-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel5_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxClient-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\DbgPlugInDiggers.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuth.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxCAPI.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UserManual.qhc	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ka.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuthSimple.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAutostartSvc.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\vbox-types.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_eu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_id.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxRT-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat67_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ubuntu_autoinstall_user_data	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ubuntu_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_uk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ru.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ca.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6PrintSupportVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UICommon.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxManage.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sqldrivers\qsqliteVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\os2_response_files.rsp	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_nl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSharedClipboard.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UserManual.qch	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_de.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\CPUMInternal.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\styles\qmodernwindowsstyleVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_it.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_lt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDbg.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_CN.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox_70px.png	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\testcase\amd64\vbox-vm-struct-test.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\debian_postinstall.sh	msiexec.exe

Drops file in Windows directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI1EA8.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EC992132-5693-4D1D-85DC-2629AA025B28}	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\e5a1acd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DCB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E49.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3070.tmp	msiexec.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI3AC8.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI1CEF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F85.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30FD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI31F9.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI33B2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3440.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3EC1.tmp	msiexec.exe
File created	C:\Windows\INF\oem3.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI31AA.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2003.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\Installer\e5a1acd.msi	msiexec.exe
File created	C:\Windows\INF\oem2.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3297.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3315.tmp	msiexec.exe

Loads dropped DLL 24 IoCs

pid	Process
3796	MsiExec.exe
3796	MsiExec.exe
3796	MsiExec.exe
3796	MsiExec.exe
3796	MsiExec.exe
3796	MsiExec.exe
3796	MsiExec.exe
2552	MsiExec.exe
2552	MsiExec.exe
2552	MsiExec.exe
2552	MsiExec.exe
2552	MsiExec.exe
2552	MsiExec.exe
2552	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirtualBox-7.2.14-174565-Win.exe

Checks SCSI registry key(s) 3 TTPs 31 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
896	msiexec.exe
896	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeIncreaseQuotaPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSecurityPrivilege	896	msiexec.exe
Token: SeCreateTokenPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeAssignPrimaryTokenPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeLockMemoryPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeIncreaseQuotaPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeMachineAccountPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeTcbPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSecurityPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeTakeOwnershipPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeLoadDriverPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemProfilePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemtimePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeProfSingleProcessPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeIncBasePriorityPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreatePagefilePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreatePermanentPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeBackupPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeRestorePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeShutdownPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeDebugPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeAuditPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemEnvironmentPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeChangeNotifyPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeRemoteShutdownPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeUndockPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSyncAgentPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeEnableDelegationPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeManageVolumePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeImpersonatePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreateGlobalPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreateTokenPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeAssignPrimaryTokenPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeLockMemoryPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeIncreaseQuotaPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeMachineAccountPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeTcbPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSecurityPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeTakeOwnershipPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeLoadDriverPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemProfilePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemtimePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeProfSingleProcessPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeIncBasePriorityPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreatePagefilePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreatePermanentPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeBackupPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeRestorePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeShutdownPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeDebugPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeAuditPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemEnvironmentPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeChangeNotifyPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeRemoteShutdownPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeUndockPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeSyncAgentPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeEnableDelegationPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeManageVolumePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeImpersonatePrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreateGlobalPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreateTokenPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeAssignPrimaryTokenPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe
Token: SeLockMemoryPrivilege	4668	VirtualBox-7.2.14-174565-Win.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4668	VirtualBox-7.2.14-174565-Win.exe
4668	VirtualBox-7.2.14-174565-Win.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 3796	896	msiexec.exe	101
PID 896 wrote to memory of 2120	896	msiexec.exe	110
PID 896 wrote to memory of 2552	896	msiexec.exe	112
PID 896 wrote to memory of 4424	896	msiexec.exe	113
PID 988 wrote to memory of 4024	988	svchost.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.2.14-174565-Win.exe
"C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.2.14-174565-Win.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4668

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1F744657F3CCA704E277D83610C16D8F C
  2⤵
  - Loads dropped DLL
  PID:3796
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2120
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8B32224D5616F376208178C3BCD1B52A
  2⤵
  - Loads dropped DLL
  PID:2552
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7D14D4095DCA85A729EDB3818E965C7F E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Loads dropped DLL
  PID:4424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf" "9" "4ff1aec5b" "0000000000000140" "WinSta0\Default" "0000000000000124" "208" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBoxSup.cat

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\vboxsup\VBoxSup.cat
Size 11KB
SHA256 191d53d9d65efcd8cb2d48962f71d529b2ede51d1dca50dfc764a8103c5129fa
MD5 4659483f4910cc61c4ab5a25bd4bda57
SHA1 ac7323520471250d5afcc00bba664f45f7e0180d
SHA512 7df48e998f976bfc39442ada6a5594b3d2468ab08d71cd15d38793984967e65a72f904c585495feb36b32e185ea11bccc3940c82bd18f380efaad0589f0bb128
SSDEEP 192:YzXEqJCfT+/OXJEwlLdthYCISUFTsX01k9z3AS5n2uMg:kUT+/ORdth3ISSoR9zb52uZ
TLSH
T111323AA649681183FDABAC6053E8F947BC3D27CB5C50486562AFF3090D973C9E71816E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxSup.sys

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\vboxsup\VBoxSup.sys
Size 1.0MB
SHA256 257fb12b25cd673ca1bfabd957f9c183a2f1f08192581fa365e279c080db8124
MD5 73b3ad4907c7078498ac9fee3edcdff2
SHA1 f79a601e5bdd5b3aeafcde2537fdecca774b240f
SHA512 936ee9f6831d6451c43f9510d3b504fbea7b4e6c48a3e608ad4853e017f3f3da7f22ff15c56ecae205d2b156ef2ac9751cefde65c9b1fab790a23f1215a79a2d
SSDEEP 12288:BOOgiLyqHEuFQTVVTyvRBPHuOrEzBGUMnVZJ3eQDO1PanF/wLA3o:gOVRlQTVVTyvPOOrTaanF4h
TLSH
T1A0359E9EF6A40AE5C5AB8134D2C1452BD2B678011760C7EF06E693A51EB3FDA1E3F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxSup.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf
Size 2KB
SHA256 472f69d3b956ea8eb7579c144c438533704f4cfe905604931a0658ffdeab9ddb
MD5 4cac39eeb410260aa5c79b042b495f23
SHA1 2d51874e0a0d6a21b61ce7c5ecdb222d4ce3b286
SHA512 dc8fc327773ded37956364879220cacdb472ecb8a8e9d4a3c8c0d19a111e413f500306d228e44295d3be41a925dfa12a4d6655022ef96fd8655d401fcbb74612
TLSH
T11051616E5840877139A6029A3F0BA6C7F3E9701A3CEB286030DEC916925DC2C87394F6
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 90e373b63e7d3be82dbd5ce611613f89884f09e72666d691a6af7c6a0fb77361
MD5 e750ff772407b634eea4e1589ce1f31e
SHA1 f53ccf67cf4b982e66f05eb92073af987e1287d4
SHA512 b5e2654f667db8eb9492767a1e1319aa3d01bd36f99a5c32f82e4dcb38b7948eb9207eb53735335dfc91efcf9fd72c1402d4ec863b45874f772f5ca3792502b3
TLSH
T111F0D4775CBE60C2210BE0AC07E8BD7A152249891995C177257D95C447465E7B94F908
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 727B
SHA256 9deb25d54eb68f0bfa6f4f8104992f9aba57a23032700f2d558f47cca238331e
MD5 0bc44dc0b3217938b43dd22315c5d189
SHA1 48f39f772a9a1b3671e64168c24244b0cee42341
SHA512 2a56638b31b54624eef587cf397eb83e13a9e0117a96d8c40e756676eec91d529d63ddb88be20d59b3459fb7f69086620a88351dad531f1343adec01faf591de
TLSH
T1C40194090E3BA5896E61EC0D2F4C89B0B61D83CC56C862A73C3DC0F3F25771A651AC20
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 a979724fe78a75e9ebd04b45951bedf4560a843e90fe02283b2da2d01c3c6f11
MD5 e08d7206c6b1328162021158be2a3bba
SHA1 b2be6544fe648af07b04b5df08ed12055966c822
SHA512 7f7ad41d29021a1402267706e79dcaaefb26e46ed9e65b37901098745ed0a863e0f897d54ce1c35592719b92bc2aaaf95bd95443c0707e664f45b31be848f07e
TLSH
T18301991744B5D3603523050AFB9C65A93A670E8408E283B53E920CFF2C8DCFD0F8E410
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 160002fa8304fcef67ae5953f2b2286c9942437fa2dfbeccfac1a565dc09527c
MD5 1ae2ec304484ac81d9e1d6de7ff2bbd2
SHA1 091b7cec77d123b5524843908c1904e8de4cca0d
SHA512 ce8aba642594e693bb98bc5587d8866cea3dc7b561cd9c960d753c9b96e2f946a06db9a9c9590e515ad1e4a6ee27ce1ddbdf1bc896cf272feb5412df8c23db7a
TLSH
T1F3E0C63023FF002EF1B0CBB803C4909AAF2AF1072C4962BE0EC1192C981EE000CA2E30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 408B
SHA256 35fa7e4fefbd5eef70759d2dff6a2638f0a41069af461044c4daad150301667a
MD5 2059bf37b5f62a57ac0e4ca528de63e7
SHA1 80775d8ce5fc47f8fc9e3f1bce3d777334e34317
SHA512 da3dc7c2f7eff8d8d040140b917ace7d25abc41c0bea54aee81de572a7c6393aee34210a848554c517fcaf7311820efb30aab623d40c0795eaa7018de4b00d65
TLSH
T127E0C03C20F7449DF0F1E97502E1EA329F5DF3465505817C058426016A347401DA2520
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 0141996682dcfd5dad7e6fa2da3209f3db6515c3343be429db386160e96fdb10
MD5 12977d17e40d7a01ed4af78cfc6bf36f
SHA1 95f4770c37471140f7e74817ddebda13ecc7517b
SHA512 d39a3f58cd63a8d0a8fdd9be685dfb3cbb35966c157f59448d4a4698929a9cab1ecf70a94fdddaa0f25d1fe34286cbe5b54ae8fca80bd4aedc5f3783dbf99e0c
TLSH
T1DDE06F3C21FBA45EF0A0DC3042F9A0BA2E89E2062000A2B80AC05348FB1AE405E50AB4
MD5 SHA1 SHA512 TLSH

Submit Download

MSI74B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI74B9.tmp
Size 494KB
SHA256 98a4a140ff5195bb9564efe60457e495289d9808b28eb86d672d8425535a42d4
MD5 70470dfc01443fe1a8937a10fc137dd7
SHA1 7fc1fd54c11b3a35d2578486e0758b109eb0beae
SHA512 937e00deb88b078bbc3ccc7ef52f8b636e240213a190f76904da093a8bde98fcdbbfb1e75ffcf6a2abdd124b77f5669c84311b0aa2739c7c9f810ec3cd4d210e
SSDEEP 12288:BnnOZtHHUd0UxCcsWnOtlmVI3OXdOwZ+cA2sPT:1AtHHUmUxCcsWnO3sdVx8T
TLSH
T159B4AD66B7D12B75D85BC13D88A34002E7F37442131482EB47A682594EA3FD2BB3EF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8fbd0.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI8fbd0.LOG
Size 110KB
SHA256 ffdba03b2b017a41f82e2d55e4e0e0d09c3e9cf50d98252ca7a4e6a56f27f70f
MD5 8d0d7657ee42fbf4387a49b78b9c822f
SHA1 c95b132864ec9ac33eda888de79acd56785ad899
SHA512 2e71922de166c65c63eb4ceb57f6c3793fbe40843f6a9f92c354dde615a206accf73a6492242fb5027546895ce1329d7f1515b10236e9845a9633cf081dd44fc
SSDEEP 1536:zlEfJK2e3yLeftY9WFqUOgKca1yoisiAisik6OgKca1yoisiAisiEaOgKca1yoiU:5cySySmNFc7I2odizdvPsmDGhO
TLSH
T186B31C296FF40105F2BB67876EF754264E77F95A6A31CE4D20C1C20D04B1E04AEAD7BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem0.PNF

Path C:\Windows\INF\oem0.PNF
Size 5KB
SHA256 c0d9c4ed8bd953ea3ae8e03e70e49fd993328cec5373e5c54099688198ad654f
MD5 78bc4700783b9b288022aac13b0455f9
SHA1 aaa15248a3504a6eb2ab866daa0e229bd05458ec
SHA512 6ec1fdf0cf97ed7ec317b7fe31984002258b6eba6b2c281db59b91f4eedc701a13f7a3111802c172d704accddf7cc05c378e7670c593bcea515a572d7771cf3d
SSDEEP 96:AUB4Aa5IjNAuLScz8Ui7cg06fXkRx1fsX+daDsu20:OIeuLSQ8Ui7cgZf0GXCkP7
TLSH
T1E7B1594573E98B15F0B68E742CF46AE66876BC526D12DB4F2250331C1C32F94DBB0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem1.PNF

Path C:\Windows\INF\oem1.PNF
Size 5KB
SHA256 3f78463fcdf24263527c2c9065b1a88887588387dcbe056bbab3cad94aa3f071
MD5 6c7a2c59c125e129778b30a723deb6ef
SHA1 acb726ae9321eaf09a38701f4d4a5c0f3b5528eb
SHA512 b6641e03f8ccd9c17472dff6a53fcdaa82dc5aa65453e066475aaa5ce5d3f43d6e16dedfe032a432c2fcdd38bf9146aede6df722f324d470815fedfa86ab0af2
SSDEEP 96:Gwlh4C0VJTnNAw5nbbUD8F5DI6sXkRN1fsCY+M2sH:4TaWbbI8F5Dts0CCYwe
TLSH
T1C6B1661677EA8B01F1BA8E742DF4A6E75471BC026C11CB9F2250731C5C72E509BB0B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem2.PNF

Path C:\Windows\INF\oem2.PNF
Size 6KB
SHA256 48528fbf0d09a8fdaa1c37b667639d8c5233c6071f83cd764101f6c9ea9316bd
MD5 cd426379226b0321fa61fbb924f0ba0c
SHA1 8ea6b21bffd3ec4ebb9c722e04d4d91e30d80685
SHA512 cfd7ab8d83a95b6ee75643a3065f40bef98d5260033b9d097a086d70fef8087cafe0e4ed7a5eda9d84217d6f7ace6516dd0751fa588ddd13f014974d0e0dee69
SSDEEP 96:74rgQY2e/NI0IXSu6o4zvM181fQ1UvZUuQSCUJ:/2e/BfosxZUK/
TLSH
T130D12545B7F88B15F1BA9B306DB512E65436BC619C12C65F3160334E0972E949AB0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1F85.tmp

Path C:\Windows\Installer\MSI1F85.tmp
Size 383KB
SHA256 61a20a2e5b2e759c2db35545419cb75ab9db16e66fd21ce580a6f9836f3e7a9b
MD5 bca7365c591167f140b6ee5af5cda59e
SHA1 a6f299b5e70bd7c5b6a724fa869b0d8fcd0bb4a0
SHA512 c5651e422034c625e4abd3a46458069e6a9c6e74fb189ab06a3ff32ddc843e023cd68106a52c6d850532d0ca4650d370f063b8fde9624fcf8fd2f6ef700b9bd5
SSDEEP 6144:UEMG77h/h+OuGMgdH2NjItYRzCuY88tTUP8Mng8:UwJZbMtItYRzCuYVTe8M
TLSH
T12D846B29B7E408EDE4B78276C5A68131FF75744D3720D5AE8BA8452D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 495f1b2a4d95c68cf4087c035f93cbbaa88329d0bc33c59f4c3e334fee7f6290
MD5 f78f2f95c6c70b123e7d29c3e0575da6
SHA1 b11a40e2e251f9ffc99e4b274c1d8aaa1b37c6da
SHA512 3355348b86433ed0f521b8ea6c92616e4bd16491529c22c18c4ee912de46a4207fe4624a7f0dc1471a811074328456f22140d79cc93b356a24284a966e5262dc
SSDEEP 24576:9u8m+1zFdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:T
TLSH
T14147C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{df15baf7-7c1c-419d-8d16-62f7b901b6b5}_OnDiskSnapshotProp

Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{df15baf7-7c1c-419d-8d16-62f7b901b6b5}_OnDiskSnapshotProp
Size 6KB
SHA256 8aa709836b09b7a1c939f6712a8691efe25fe4ec063d16ed3b8646b26dc01212
MD5 fa104efab7656e7b90406dfaa4c54570
SHA1 ef6a48df2d79a5c55f04291aa255b62a27c7ad0c
SHA512 0f27a74b0dfe9faf754a1e6172caa80b243f987fb4308bdb1e781c18331e962540976576f061dc66b244d9f1e492c4812b302f59c79546e5f5e11a3241e64e9b
SSDEEP 96:FPZs/BA1vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:ZZskb++ZVmN
TLSH
T109D188184AF54711E2B3AB3229F58553A877B911EF33CB8E0198238E6671910F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download