2509a2e1e0208bcf5a7192bf5abaefaf7a43186ff9b453d724b6a0a4b9cc35ea

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install_28n004.msi
Size 7.7MB
Sample260730-dn4ylaah97
SHA256 2509a2e1e0208bcf5a7192bf5abaefaf7a43186ff9b453d724b6a0a4b9cc35ea
MD5 93ef769879558a362dd179421f82ff59
SHA1 014822a5089c235d27fe2aad9916500e69977eb7
SHA512 1b0d1eb030f4d5df2850929dcbfbe0a3358ac80d63e018dd393451868b1a3e3cbb2e294967aaef27864d40641663597056845b1cd8a2f4c5c144c09969fd7bb5
SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgU:xGSJty8TaCyLA+Ckyv
TLSH
T19A863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\lfMpzv = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3804	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2256	z5iuPa.exe

Loads dropped DLL 2 IoCs

pid	Process
5064	MsiExec.exe
2256	z5iuPa.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
252	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\lfMpzv\\z5iuPa.exe\""	z5iuPa.exe

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5064	MsiExec.exe
3	5064	MsiExec.exe
4	5064	MsiExec.exe
9	5064	MsiExec.exe
10	5064	MsiExec.exe
11	5064	MsiExec.exe
12	5064	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3832	cmd.exe
2212	cmd.exe
4404	cmd.exe
5368	cmd.exe
5348	cmd.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	z5iuPa.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\IJz35Q	z5iuPa.exe
File created	C:\Program Files (x86)\IJz35Q\oxE1UI.exe	z5iuPa.exe
File created	C:\Program Files (x86)\IJz35Q\XPSPLOG.dll	z5iuPa.exe
File created	C:\Program Files (x86)\IJz35Q\image.png	z5iuPa.exe
File created	C:\Program Files (x86)\IJz35Q\thumbs.db	z5iuPa.exe
File opened for modification	C:\Program Files (x86)\IJz35Q\oxE1UI.exe	z5iuPa.exe
File opened for modification	C:\Program Files (x86)\IJz35Q\XPSPLOG.dll	z5iuPa.exe
File opened for modification	C:\Program Files (x86)\IJz35Q\image.png	z5iuPa.exe
File opened for modification	C:\Program Files (x86)\IJz35Q\thumbs.db	z5iuPa.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e599253.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBCDE3DED5EE00006.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9988.tmp	msiexec.exe
File created	C:\Windows\Installer\e599255.msi	msiexec.exe
File created	C:\Windows\Installer\e599253.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2CE45FE66FB9057F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI988D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF102C8854B40F27E2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4C76822255263240.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2072	msiexec.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3352	cmd.exe
900	cmd.exe
1468	cmd.exe
3820	cmd.exe
4920	cmd.exe
2448	cmd.exe
3224	cmd.exe
5620	cmd.exe
5384	cmd.exe
5276	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000059e6eec40365f0360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380159e6eec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410159e6eec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e359e6eec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e659e6eec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n004.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "8B50C807D95C9EA48BAEBFA1A0DED392"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4448	schtasks.exe
4568	schtasks.exe
720	schtasks.exe
5632	schtasks.exe
4588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4500	msiexec.exe
4500	msiexec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
5064	MsiExec.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe
2256	z5iuPa.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2072	msiexec.exe
Token: SeSecurityPrivilege	4500	msiexec.exe
Token: SeCreateTokenPrivilege	2072	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2072	msiexec.exe
Token: SeLockMemoryPrivilege	2072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2072	msiexec.exe
Token: SeMachineAccountPrivilege	2072	msiexec.exe
Token: SeTcbPrivilege	2072	msiexec.exe
Token: SeSecurityPrivilege	2072	msiexec.exe
Token: SeTakeOwnershipPrivilege	2072	msiexec.exe
Token: SeLoadDriverPrivilege	2072	msiexec.exe
Token: SeSystemProfilePrivilege	2072	msiexec.exe
Token: SeSystemtimePrivilege	2072	msiexec.exe
Token: SeProfSingleProcessPrivilege	2072	msiexec.exe
Token: SeIncBasePriorityPrivilege	2072	msiexec.exe
Token: SeCreatePagefilePrivilege	2072	msiexec.exe
Token: SeCreatePermanentPrivilege	2072	msiexec.exe
Token: SeBackupPrivilege	2072	msiexec.exe
Token: SeRestorePrivilege	2072	msiexec.exe
Token: SeShutdownPrivilege	2072	msiexec.exe
Token: SeDebugPrivilege	2072	msiexec.exe
Token: SeAuditPrivilege	2072	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2072	msiexec.exe
Token: SeChangeNotifyPrivilege	2072	msiexec.exe
Token: SeRemoteShutdownPrivilege	2072	msiexec.exe
Token: SeUndockPrivilege	2072	msiexec.exe
Token: SeSyncAgentPrivilege	2072	msiexec.exe
Token: SeEnableDelegationPrivilege	2072	msiexec.exe
Token: SeManageVolumePrivilege	2072	msiexec.exe
Token: SeImpersonatePrivilege	2072	msiexec.exe
Token: SeCreateGlobalPrivilege	2072	msiexec.exe
Token: SeBackupPrivilege	4788	vssvc.exe
Token: SeRestorePrivilege	4788	vssvc.exe
Token: SeAuditPrivilege	4788	vssvc.exe
Token: SeBackupPrivilege	4500	msiexec.exe
Token: SeRestorePrivilege	4500	msiexec.exe
Token: SeRestorePrivilege	4500	msiexec.exe
Token: SeTakeOwnershipPrivilege	4500	msiexec.exe
Token: SeRestorePrivilege	4500	msiexec.exe
Token: SeTakeOwnershipPrivilege	4500	msiexec.exe
Token: SeRestorePrivilege	4500	msiexec.exe
Token: SeTakeOwnershipPrivilege	4500	msiexec.exe
Token: SeBackupPrivilege	248	srtasks.exe
Token: SeRestorePrivilege	248	srtasks.exe
Token: SeSecurityPrivilege	248	srtasks.exe
Token: SeTakeOwnershipPrivilege	248	srtasks.exe
Token: SeBackupPrivilege	248	srtasks.exe
Token: SeRestorePrivilege	248	srtasks.exe
Token: SeSecurityPrivilege	248	srtasks.exe
Token: SeTakeOwnershipPrivilege	248	srtasks.exe
Token: SeRestorePrivilege	4500	msiexec.exe
Token: SeTakeOwnershipPrivilege	4500	msiexec.exe
Token: SeRestorePrivilege	4500	msiexec.exe
Token: SeTakeOwnershipPrivilege	4500	msiexec.exe
Token: SeRestorePrivilege	4500	msiexec.exe
Token: SeTakeOwnershipPrivilege	4500	msiexec.exe
Token: SeRestorePrivilege	4500	msiexec.exe
Token: SeTakeOwnershipPrivilege	4500	msiexec.exe
Token: SeRestorePrivilege	4500	msiexec.exe
Token: SeTakeOwnershipPrivilege	4500	msiexec.exe
Token: SeRestorePrivilege	4500	msiexec.exe
Token: SeTakeOwnershipPrivilege	4500	msiexec.exe
Token: SeRestorePrivilege	4500	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2072	msiexec.exe
2072	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2072	msiexec.exe
4500	msiexec.exe
5064	MsiExec.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 248	4500	msiexec.exe	94
PID 4500 wrote to memory of 5064	4500	msiexec.exe	96
PID 2256 wrote to memory of 3804	2256	z5iuPa.exe	101
PID 2256 wrote to memory of 5368	2256	z5iuPa.exe	103
PID 5368 wrote to memory of 720	5368	cmd.exe	105
PID 5368 wrote to memory of 2692	5368	cmd.exe	106
PID 5368 wrote to memory of 2976	5368	cmd.exe	109
PID 2256 wrote to memory of 5348	2256	z5iuPa.exe	111
PID 5348 wrote to memory of 5632	5348	cmd.exe	113
PID 5348 wrote to memory of 5624	5348	cmd.exe	114
PID 5348 wrote to memory of 5412	5348	cmd.exe	117
PID 2256 wrote to memory of 3832	2256	z5iuPa.exe	119
PID 3832 wrote to memory of 4588	3832	cmd.exe	121
PID 3832 wrote to memory of 2928	3832	cmd.exe	122
PID 3832 wrote to memory of 6140	3832	cmd.exe	124
PID 2256 wrote to memory of 2212	2256	z5iuPa.exe	125
PID 2212 wrote to memory of 4448	2212	cmd.exe	127
PID 2212 wrote to memory of 2988	2212	cmd.exe	128
PID 2212 wrote to memory of 4944	2212	cmd.exe	130
PID 2256 wrote to memory of 4404	2256	z5iuPa.exe	133
PID 4404 wrote to memory of 4568	4404	cmd.exe	135
PID 4404 wrote to memory of 3964	4404	cmd.exe	136
PID 4404 wrote to memory of 4336	4404	cmd.exe	138
PID 3352 wrote to memory of 1248	3352	cmd.exe	141
PID 900 wrote to memory of 1076	900	cmd.exe	142
PID 2448 wrote to memory of 5312	2448	cmd.exe	143
PID 1468 wrote to memory of 2236	1468	cmd.exe	144
PID 3224 wrote to memory of 2700	3224	cmd.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n004.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2072

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:248
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7885D57F0CECE0374B89734EF1634F18 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1004

C:\Users\Public\lfMpzv\z5iuPa.exe
"C:\Users\Public\lfMpzv\z5iuPa.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\lfMpzv\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\lfMpzv\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4588
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2928
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4448
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2988
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3964
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4336
- C:\Program Files (x86)\IJz35Q\oxE1UI.exe
  "C:\Program Files (x86)\IJz35Q\oxE1UI.exe"
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:5620
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IJz35Q" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IJz35Q" /inheritance:r
      4⤵
      Modifies file permissions
      PID:252
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5276

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\lfMpzv" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\lfMpzv" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1248

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4824

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1076

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5312

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2236

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2700

C:\Program Files (x86)\IJz35Q\oxE1UI.exe
"C:\Program Files (x86)\IJz35Q\oxE1UI.exe"
1⤵
PID:4964

C:\Program Files (x86)\IJz35Q\oxE1UI.exe
"C:\Program Files (x86)\IJz35Q\oxE1UI.exe"
1⤵
PID:2124

C:\Program Files (x86)\SIN0VZG\g7FIkYFWA.exe
"C:\Program Files (x86)\SIN0VZG\g7FIkYFWA.exe"
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599254.rbs

Path C:\Config.Msi\e599254.rbs
Size 7KB
SHA256 69ae11b11087c6cb857d5bd85fabd66ad7c14be62b185da7fdcf600eb4815dea
MD5 2288d0290ca419e8a59cd1961afba74e
SHA1 91feb32a5cb2332ca67bd5b6151acc3034cb41a4
SHA512 5d9bf288afe627cbdb51efe5e871724dc481092e7d03896b231144e4769002a1200bd761010adc1694b020cdc5ef951ee52cab6d6b53c298fa812f2fc2f7da35
SSDEEP 96:uVsyGgu0CEcfc6xUUpdI21CsThqK/UpdI21C6jdAsDThqKjHKIK5RPWELEyE/YwZ:uVsyXCzzfI2IIBsfI2ISBaHtI5V8Kpf
TLSH
T102F1F046B20481E2E9D77731CF271B263BB3D3E49314630B1ADE84749E4738D6EA619E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\IJz35Q\XPSPLOG.dll
Size 4.6MB
SHA256 723ee93d0e8e939af0f2278b12b9ba9b8a1b3cd594c79742cbe048277bdbbd0f
MD5 ab8dcd555cd550444d9e143b9548a524
SHA1 2889d7c4256008bd643214ae5b1b67fd58d80c66
SHA512 1cf9fd5cf5b5a48888dd803794087f291cc853d4c0b6f0c2720a272bf0dd98a6669b798270f90d844cfdb1781562d3c03f1a761aa78ccdf13f880077dca0b166
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyT:BMWKfU+BcUTHCCCfqCiUffnT
TLSH
T16A263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\IJz35Q\image.png
Size 4.9MB
SHA256 85230af548e337b9cff21424eb4324fbcf78b5bae7f6d52aea514406a5002f48
MD5 aca40cdfb2c66b95f9a14e5491b415e0
SHA1 4215d8325ecceee9929c6b1826f2fff65b886ef5
SHA512 1b1615f4b72b8b3b66acf6f9a40e84ee0dda8294c9ead9874e4883ac1024359a4d9fec7536726af7d36b8c5173c9d20169d5f2c5df07f475334970e340fcd462
SSDEEP 98304:SXjR0PaemmeGXdG2BHmP46ziMd4hlx00SvotfTjZ7MWwFp+0MW+:SXjRUDXdvHuTBdIlUOT9z0n+
TLSH
T16636337D3D2DA53F9AA3CA9079CAFD2A57B6CB4A971B0D6ACB75F403354120402C7D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oxE1UI.exe

Path C:\Program Files (x86)\IJz35Q\oxE1UI.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\IJz35Q\thumbs.db
Size 358KB
SHA256 7cf727debd8b190b5249dd492e5c1cad4757ed229a758093b894d2fa01187e84
MD5 5782c5e4067fe6d4ee16d6b5aeb80849
SHA1 7ad151fac4531a11986a7a8eb921c0dd026b1f69
SHA512 65996f0d2fe02bcda308e05fd64c4a2031e5b90e181a2b3e9f4fe56982bc426da2af4075f6d9eb929c0f975cb71d278ed8d9124dda292ab968d1cf17b0429a1d
SSDEEP 6144:8iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:b8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T18E74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\SIN0VZG\XPSPLOG.dll
Size 3.1MB
SHA256 18d09d4aef04d05f5951630616b48b7a5c2311d7339a6e057b9fcdde75884393
MD5 f7e6af1febbeeb721796e954e772e608
SHA1 434055e5ff93475e129f91711dccdb840b664bdc
SHA512 674a76abc5f6623d5271abe6c65446d46ba71f5fddaf821e8b92fbf48b9e13ac9e5a4117b7caa04093dce3bce09956f30f74fb8c727f4eb128fe50694b8e5821
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn70:yCMWmcKfST5t+BceThTHfaCCUqmI
TLSH
T133E5338ABA9B461FE51172785F3CFC7E76B859C8030CFC88D865318B90A5B6D903DA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\SIN0VZG\XPSPLOG.dll
Size 1.8MB
SHA256 65794e29794f0b425fd98f1ca2a5f385f738e056cb723051f671677924a516e3
MD5 afd722a683a3b6ad91f59ea13977d053
SHA1 86ba051965efff7f956e5a7e37e99a7022074cc5
SHA512 4adf2f01fa15cf33c4ef154f1a2b6a2f20b5927206a79e5bc15ce6a028225140af587fe2357e7acc8db73ef12c54447ef15860d1be8154a5232c12fbe75cbf4c
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXT5tpB1JA6nvsNBFGGLncDYjs:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVT
TLSH
T1F085339BB2DB412EF6D073B52F4CED1CB57E58C881BEC86598E6718B1031AAE103974D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\SIN0VZG\image.png
Size 832KB
SHA256 05c25436d0771e8c878d6593e71e05b9ef64423a6b01d46e94cab82661780fcd
MD5 1d9e086b597d8199a33c23aa1291082b
SHA1 055a8f8d09dc336fde99688bea42e639981f9391
SHA512 89ea1c3609da68ba547e3fa2bbc9514208d18db5728a15246ee5a84bfbe3ed22301b58db626e949098bac1b52fc3c5e380c41de2cd29efd646301fb0b3819297
SSDEEP 24576:k3UKHCgpcTszsfLOC1FFWgjl1F4V6NJAz:k3UKjcgzsfq0FFTl0V6NJAz
TLSH
T1B805338A440A0DAFED8BD5E3786EA82F0FB2DF5C862D1DAD89379D475A073C140D6B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\lfMpzv\UxEnhance64.dll
Size 3.1MB
SHA256 bc2d951650a43da95b00c420de0e1153e4d505b5e238bc367425dd2ba7bf67df
MD5 208ee7d0772b6aa4ab40d84bd246d751
SHA1 841ce365caa0614179f62bdca910cb0a150b1d71
SHA512 9b41ed334c85efa64b4b17752986837d50f94170b4f4860cf8f14d10861def05a9d91182d49f2ef3865b9fe878c5c5cfcb7d5710cc21083e1af18ef4e8e587db
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+h:P9m29xx3Tiqt06ox6+z2rNNrKoh
TLSH
T15CE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\lfMpzv\adoresd.dat
Size 4.8MB
SHA256 b67b8064198380f78a41e71bb5f0c838836c3ab8ab9f99c967cfcb6170fd2681
MD5 8dd822be94efbcba8333d89b60b78d0d
SHA1 52aa396f019184e8e3aadb24cb112cc1f1092e07
SHA512 1b05c7113551a1646cf7d548e44aec732183c23aadcad55c9c486dc488e5ca551e6d40191c5983b1e6f5917fa15406d6ad76e1535e46b6f3c99d0e52baca1ab0
SSDEEP 98304:ruZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:sQDPnORb7AdPEm7Y7ltlVgxs
TLSH
T186363339536D9C62DDC7A0F8A49E4596FF683D60FAE2A006B47C1D213015DFB986FE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\lfMpzv\msadox.tb
Size 8KB
SHA256 94769727683291722c0e9d1c2b50148a807d66c543e4dd2e7aadf4e7d4940dc3
MD5 f078be737ee8d23231ff91b07bd4a482
SHA1 c21710e5cb874e01542e50e95a73d83d8539daa9
SHA512 e06883f764584675786526a74f84fbc938b19603ea9eb57a0af1576880b0cae4c4034080568c41583ad528465e536204c0a9fdbee2d1c0bd2ea40bbddbce7070
SSDEEP 192:oqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:osZqZOXQ3uqvR2Kfzp
TLSH
T15B029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z5iuPa.exe

Path C:\Users\Public\lfMpzv\z5iuPa.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9988.tmp

Path C:\Windows\Installer\MSI9988.tmp
Size 7.6MB
SHA256 b3c2c9b7ae11357da53cb6ba325949b2e73cd89aaaf2336257ba9f5709900f5e
MD5 853c5ee34aea40fa1aa4f8091bc72252
SHA1 17ced4d59c815dcc0108929d385cd882731b4311
SHA512 90ccc6a5c411627b6a91ec1fa71104a7de1bd1c6790b968ea857ef6bb61a6754304caaa6d3b9b38cb158de1fdcaaa28bd4c098f1aa7bf52231849403e45d1586
SSDEEP 196608:yGbukNfmtyxzmdV+HCNILJghIpo7h4kVg2prApXJTgY:yGSJty8TaCyLf+Cky7
TLSH
T1F6863399349A3570C297DBB02943287F7D6E37C4BE764C5EBBEA9A101C322390735366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599253.msi

Path C:\Windows\Installer\e599253.msi
Size 7.7MB
SHA256 2509a2e1e0208bcf5a7192bf5abaefaf7a43186ff9b453d724b6a0a4b9cc35ea
MD5 93ef769879558a362dd179421f82ff59
SHA1 014822a5089c235d27fe2aad9916500e69977eb7
SHA512 1b0d1eb030f4d5df2850929dcbfbe0a3358ac80d63e018dd393451868b1a3e3cbb2e294967aaef27864d40641663597056845b1cd8a2f4c5c144c09969fd7bb5
SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgU:xGSJty8TaCyLA+Ckyv
TLSH
T19A863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 a6fb8b4b9f0e04bb2d11e6019d3ee9f31fe4310847aed236b277dccfe7437a36
MD5 5b56039421a9b845f316607837331ba9
SHA1 c48247b08eeba26c3c5179757558c8d2a8d3aa18
SHA512 ebfef93aa16901d0ef9921941da6d8d04dfd0962695129d768adbf785a7744cecd11bb1e8d36a70451f32a19c2670843f11279015cc73f4ed6a4bed56cd107e2
SSDEEP 24576:nFo3DMPQdoO/vvTL/ygCCC1wfLeIpblREfUg9fMKU3MaZlTy84x2yrYj2+o:WHE
TLSH
T1FB57B22436F92210E7B79F3CA8F06A234D397D5B9D15DE8D05451B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8f977f74-55bb-42c2-92ca-78feb88ee7f9}_OnDiskSnapshotProp

Path \??\Volume{c4eee659-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8f977f74-55bb-42c2-92ca-78feb88ee7f9}_OnDiskSnapshotProp
Size 6KB
SHA256 d5148aabf843827c93c40b78d9ac91aaf611b27b1beb11d37b6394265b2b3ee0
MD5 1c112687f453f41e97a31f173c9c7bcd
SHA1 115f3c554d0c85dee2da3403d1beaa4ec34b5f6a
SHA512 a9223114ef490965350b4d2b0b5bf56d0f67c087ad198fbd7c42606e9129ee20b3c8ddf29e518c686d1ca5fed2b7e3002b1eff1b02009d84686d9251da8e7b59
SSDEEP 96:F02EamWvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:qetb++uVm
TLSH
T13AD187085AE54711E2B3AB322DF18557A877B911EF33CB8E0198238E6670910F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2124-237-0x0000000003160000-0x0000000003949000-memory.dmp

Download

memory/2124-261-0x0000000003160000-0x0000000003949000-memory.dmp

Download

memory/2124-232-0x0000000074B60000-0x00000000752AA000-memory.dmp

Download

memory/2124-231-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/2124-264-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/2124-260-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Download

memory/2256-69-0x00007FFA5AB80000-0x00007FFA5AB82000-memory.dmp

Download

memory/2256-61-0x00007FFA5AB70000-0x00007FFA5AB72000-memory.dmp

Download

memory/2256-91-0x000002BF134F0000-0x000002BF1357A000-memory.dmp

Download

memory/2256-90-0x000002BF134F0000-0x000002BF1357A000-memory.dmp

Download

memory/2256-92-0x000002BF134F0000-0x000002BF1357A000-memory.dmp

Download

memory/2256-94-0x000002BF12C30000-0x000002BF134EE000-memory.dmp

Download

memory/2256-97-0x000002BF12C30000-0x000002BF134EE000-memory.dmp

Download

memory/2256-98-0x000002BF12C30000-0x000002BF134EE000-memory.dmp

Download

memory/2256-67-0x000002BF12C30000-0x000002BF134EE000-memory.dmp

Download

memory/2256-76-0x000002BF12C30000-0x000002BF134EE000-memory.dmp

Download

memory/2256-70-0x000002BF12C30000-0x000002BF134EE000-memory.dmp

Download

memory/2256-89-0x000002BF134F0000-0x000002BF1357A000-memory.dmp

Download

memory/2256-87-0x000002BF12100000-0x000002BF1214E000-memory.dmp

Download

memory/2256-81-0x000002BF12C30000-0x000002BF134EE000-memory.dmp

Download

memory/2256-74-0x000002BF12C30000-0x000002BF134EE000-memory.dmp

Download

memory/2256-75-0x000002BF12C30000-0x000002BF134EE000-memory.dmp

Download

memory/2256-77-0x000002BF12C30000-0x000002BF134EE000-memory.dmp

Download

memory/2256-62-0x00007FFA37440000-0x00007FFA3795E000-memory.dmp

Download

memory/2936-208-0x0000000003260000-0x0000000003274000-memory.dmp

Download

memory/2936-197-0x0000000003D80000-0x0000000004569000-memory.dmp

Download

memory/2936-196-0x00000000019A0000-0x00000000019A1000-memory.dmp

Download

memory/2936-201-0x0000000003D80000-0x0000000004569000-memory.dmp

Download

memory/2936-194-0x0000000003D80000-0x0000000004569000-memory.dmp

Download

memory/2936-222-0x0000000003D80000-0x0000000004569000-memory.dmp

Download

memory/2936-190-0x0000000074B60000-0x00000000752AA000-memory.dmp

Download

memory/2936-189-0x0000000001980000-0x0000000001981000-memory.dmp

Download

memory/2936-228-0x0000000003D80000-0x0000000004569000-memory.dmp

Download

memory/2936-258-0x0000000003D80000-0x0000000004569000-memory.dmp

Download

memory/2936-246-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3640-272-0x0000000073010000-0x000000007375A000-memory.dmp

Download

memory/3640-271-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Download

memory/3804-109-0x0000015269080000-0x000001526908A000-memory.dmp

Download

memory/3804-108-0x00000152692B0000-0x0000015269362000-memory.dmp

Download

memory/3804-107-0x0000015269290000-0x00000152692AE000-memory.dmp

Download

memory/3804-104-0x0000015269030000-0x0000015269052000-memory.dmp

Download

memory/4964-244-0x00000000035A0000-0x0000000003D89000-memory.dmp

Download

memory/4964-236-0x0000000074B60000-0x00000000752AA000-memory.dmp

Download

memory/4964-235-0x0000000000F60000-0x0000000000F61000-memory.dmp

Download

memory/4964-266-0x0000000000F80000-0x0000000000F81000-memory.dmp

Download

memory/4964-267-0x00000000035A0000-0x0000000003D89000-memory.dmp

Download

memory/5064-47-0x00007FFA4A0A0000-0x00007FFA4A0B2000-memory.dmp

Download

memory/5064-16-0x00007FFA4A0A0000-0x00007FFA4A0B2000-memory.dmp

Download

memory/5064-13-0x00007FFA37310000-0x00007FFA3795E000-memory.dmp

Download

memory/5064-12-0x00007FFA5AB70000-0x00007FFA5AB72000-memory.dmp

Download