ed060d367539a4ad022a7fb9e3a8c6d4ce3d1192a059b68387a7fe7fb3306369

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpiderSetupAll.msi
Size 8.6MB
Sample260731-qevpsaba39
SHA256 ed060d367539a4ad022a7fb9e3a8c6d4ce3d1192a059b68387a7fe7fb3306369
MD5 7c337d3aa8a3fbde56b87fb9c822673d
SHA1 75e36182b97ed8a2c733207f23a71b96ee65af0a
SHA512 ae3ea93f806a98aa51341f0986758ea339ee5d0067d591c8c39b502437fd1d72f2ef7905296d0f5899d0873d1471094a1ece91880dc78a994fe79f7aded25a96
SSDEEP 196608:UiqMqiKkaQvMqi+5mHaYDV1fvPMGSU0oToEdmfF+r6rp/5Yn1aB07u:eMqLkaQvTlNGPkfU0QNdG+r6rl5Y77u
TLSH
T1529633127741D133E26A06B46A7D2B7159BB6C7012E0154FE324BBDE5C323D293F8EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
3892	MsiExec.exe
3892	MsiExec.exe
4436	MsiExec.exe
4436	MsiExec.exe
656	MsiExec.exe
656	MsiExec.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2848	msiexec.exe
9	2848	msiexec.exe
11	2848	msiexec.exe
12	2848	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\novac.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\LANGS\English.txt	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Spider.exe	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\Chat\Run2.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhBankingToTreasury.rtf	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\FXForward.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\IBDataMod.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhConfirmDenominations.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhBankingSellCashToCurrencyOrderRtf.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\spider.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhVAL.rtf	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\RxTxBonds.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhTreasuryCashToCurrency.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\FXSpotStart.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\TicktBondStartTrans.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\templates\cbbhTreasurySuplementWithdrawWithChangeTypeOrder.rtf	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\KlijentRemoteObject.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\Bonds.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\TradeTypes\CashTrans.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\Chat\p2phost.1.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Interop.VBIDE.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhTreasuryCurrencyToCash.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\Transactions.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\templates\cbbhTreasuryDemagedMoneyOrderGet.rtf	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\BondsStart.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhBankingEURReserveToBAMReserveOrderRtf.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\TradeTypes\SpotTrans.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\Recycle Bin empty.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cashRtf.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Manual\Manual.pdf	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhTreasuryPlacementWithdrawalOrder.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\Chat\p2phost.2.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\ExcelTemplates\Bond.XLT	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\TradeTypes\Cash.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhBankingTreasuryRtf.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\ClientSockMod.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhBankingBuyCashToCurrencyRtf.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\Chat\Floppy2.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\ReferenceRate.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\Chat\mobsync.09.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhBankingSellCashToCurrencyRtf.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhBankingCashToCurrencyRtf.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Tenfore\Spider Client\templates\cbbhTreasuryNonEuroCashOrder.rtf	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\FXForwardStartMali.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\sysbondspotBZ.mak.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\Chat\41.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\Chat\50.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\DepositsStart.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhTreasuryPlacementWithdrawal.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\spider.server.cer	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\TradeTypes\ForwardTransBrockenDate.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\templates\ChangeDenominationStructureOrder.rtf	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\TradeTypes\CashAdd.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\ChangeDenominationStructureOrder.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhTreasuryNonEuroCashOrder.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\TicktBond.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhBankingBuyCashToCurrencyOrderRtf.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\MMFXSpot.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\NDde.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\ClientWindows.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\Icons\TradeTypes\Spot.ico	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\templates\cbbhTreasuryWithdrawRegularOnlyOrder.rtf	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\sysfxspot.dll	msiexec.exe
File created	C:\Program Files (x86)\Tenfore\Spider Client\System\cbbhBankingCurrencyToCurrencyRtf.dll	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C8846C76-605E-478D-A975-12243C7B5D70}	msiexec.exe
File created	C:\Windows\Installer\e5925e2.msi	msiexec.exe
File created	C:\Windows\Installer\e5925dd.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D61.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5925dd.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2716.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI28EC.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2848	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E38FD381-6404-4041-B5E9-B2739258941F}\Compatibility Flags = "1024"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E38FD381-6404-4041-B5E9-B2739258941F}\AlternateCLSID = "{9171C115-7DD9-46BA-B1E5-0ED50AFFC1B8}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FBAB033B-CDD0-4C5E-81AB-AEA575CD1338}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FBAB033B-CDD0-4C5E-81AB-AEA575CD1338}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{65104D73-BA60-4160-A95A-4B4782E7AA62}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E38FD381-6404-4041-B5E9-B2739258941F}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FBAB033B-CDD0-4C5E-81AB-AEA575CD1338}\AlternateCLSID = "{17E3A1C3-EA8A-4970-AF29-7F54610B1D4C}"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{65104D73-BA60-4160-A95A-4B4782E7AA62}\Compatibility Flags = "1024"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{65104D73-BA60-4160-A95A-4B4782E7AA62}\AlternateCLSID = "{550C8FFB-4DC0-4756-828C-862E6D0AE74F}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{78E61E52-0E57-4456-A2F2-517492BCBF8F}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{78E61E52-0E57-4456-A2F2-517492BCBF8F}\Compatibility Flags = "1024"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{78E61E52-0E57-4456-A2F2-517492BCBF8F}\AlternateCLSID = "{91D221C4-0CD4-461C-A728-01D509321556}"	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED4E4ED4-FDD8-476E-AED9-5239E7948257}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E38FD381-6404-4041-B5E9-B2739258941F}\ProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CAPICOM.ExtendedProperty\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22A85CE1-F011-4231-B9E4-7E7A0438F71B}\ = "Utilities Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{976B7E6D-1002-4051-BFD4-824A74BD74E2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{208E5E9B-58B1-4086-970F-161B582A846F}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4778A66-972F-42E4-87C5-5CC16F7931CA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB166CF6-2AE6-44DA-BD96-0C1635D183FE}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB166CF6-2AE6-44DA-BD96-0C1635D183FE}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C3E4934-9FA4-4693-9253-A29A05F99186}\ProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77F6F881-5D3A-4F2F-AEF0-E4A2F9AA689D}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A694C896-FC38-4C34-AE61-3B1A95984C14}\TypeLib\Version = "2.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E38FD381-6404-4041-B5E9-B2739258941F}\TreatAs\ = "{9171C115-7DD9-46BA-B1E5-0ED50AFFC1B8}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CAPICOM.EncryptedData\ = "EncryptedData Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA55E8FC-8E27-451B-AEA8-1470D80FAD42}\TypeLib\ = "{BD26B198-EE42-4725-9B23-AFA912434229}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F10FFCE-C922-476F-AA76-DF99D5BDFA2C}\TypeLib\ = "{BD26B198-EE42-4725-9B23-AFA912434229}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{659DEDC3-6C85-42DB-8527-EFCB21742862}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B57C04B-1786-4B30-A7B6-36235CD58A14}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F7F23E8-06F4-42E8-B965-5CBD044BF27F}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBAB033B-CDD0-4C5E-81AB-AEA575CD1338}\Programmable	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CAPICOM.Signer.2\ = "Signer Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CAPICOM.EncryptedData.1\ = "EncryptedData Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4EAB890-0786-406B-9B31-2746F31F8D87}\TypeLib\Version = "2.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF3D04A9-B0DA-4153-B45E-6CCFA5AC715B}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC7A72A7-C83A-4049-85F4-4292DE9DBFD3}\TypeLib\Version = "2.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CAPICOM.Certificate.3\ = "Certificate Class"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9171C115-7DD9-46BA-B1E5-0ED50AFFC1B8}\Programmable	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BBA0B86-766C-4755-A443-243FF2BD8D29}\TypeLib\ = "{BD26B198-EE42-4725-9B23-AFA912434229}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3604C9DD-A22E-4A15-A469-8181C0C113DE}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A996E48C-D3DC-4244-89F7-AFA33EC60679}\VersionIndependentProgID\ = "CAPICOM.Settings"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{976B7E6D-1002-4051-BFD4-824A74BD74E2}\ = "IEKU"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CAPICOM.Certificate.1	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CAPICOM.ExtendedProperty\ = "ExtendedProperty Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB769053-6D38-49D4-86EF-5FA85ED3AF27}\TypeLib\ = "{BD26B198-EE42-4725-9B23-AFA912434229}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6FE450DC-AD32-48D4-A366-01EE7E0B1374}\TypeLib\Version = "2.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E860EF75-1B63-4254-AF47-960DAA3DD337}\TypeLib\ = "{BD26B198-EE42-4725-9B23-AFA912434229}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4778A66-972F-42E4-87C5-5CC16F7931CA}\TypeLib\Version = "2.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC7A72A7-C83A-4049-85F4-4292DE9DBFD3}\TypeLib\ = "{BD26B198-EE42-4725-9B23-AFA912434229}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CAPICOM.Certificates.3\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54BA1E8F-818D-407F-949D-BAE1692C5C18}\VersionIndependentProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CAPICOM.Signer.2\CLSID\ = "{60A9863A-11FD-4080-850E-A8E184FC3A3C}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AFFFCC-6C05-4814-B123-A941105AA77F}\TypeLib\ = "{BD26B198-EE42-4725-9B23-AFA912434229}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47C87CEC-8C4B-4E3C-8D22-34280274EFD1}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{41DD35A8-9FF9-45A6-9A7C-F65B2F085D1F}\TypeLib\Version = "2.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE2C051D-33A1-4157-86B4-9280E29782F2}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC7A72A7-C83A-4049-85F4-4292DE9DBFD3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA65D842-2110-4073-AEE3-D0AA5F56C421}\TypeLib\ = "{BD26B198-EE42-4725-9B23-AFA912434229}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DA6ABC4-BDCD-4317-B650-262075B93A9C}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E38FD381-6404-4041-B5E9-B2739258941F}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22A85CE1-F011-4231-B9E4-7E7A0438F71B}\InprocServer32\ = "C:\\Program Files (x86)\\Tenfore\\Spider Client\\capicom.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A24104F5-46D0-4C0F-926D-665565908E91}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68646716-BDA0-4046-AB82-4444BC93B84A}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F701F8EC-31C7-48FB-B621-5DE417C3A607}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91D221C4-0CD4-461C-A728-01D509321556}\ProgID\ = "CAPICOM.Store.3"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE32ABF6-475D-41F6-BF82-D27F03E3D38B}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4EAB890-0786-406B-9B31-2746F31F8D87}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB769053-6D38-49D4-86EF-5FA85ED3AF27}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3D460F2-E7F3-4AF3-8EC6-8EB68C61C567}\TypeLib\Version = "2.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B5A8AB6-597D-4398-AC63-1036EF546348}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB166CF6-2AE6-44DA-BD96-0C1635D183FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CAPICOM.Chain\ = "Chain Class"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A440BD76-CFE1-4D46-AB1F-15F238437A3D}\Programmable	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A0780F8-9E6B-4BB0-BF54-87CD9627A8B4}\TypeLib\ = "{BD26B198-EE42-4725-9B23-AFA912434229}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77F6F881-5D3A-4F2F-AEF0-E4A2F9AA689D}\TypeLib\Version = "2.1"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1224	msiexec.exe
1224	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2848	msiexec.exe
Token: SeSecurityPrivilege	1224	msiexec.exe
Token: SeCreateTokenPrivilege	2848	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2848	msiexec.exe
Token: SeLockMemoryPrivilege	2848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2848	msiexec.exe
Token: SeMachineAccountPrivilege	2848	msiexec.exe
Token: SeTcbPrivilege	2848	msiexec.exe
Token: SeSecurityPrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeLoadDriverPrivilege	2848	msiexec.exe
Token: SeSystemProfilePrivilege	2848	msiexec.exe
Token: SeSystemtimePrivilege	2848	msiexec.exe
Token: SeProfSingleProcessPrivilege	2848	msiexec.exe
Token: SeIncBasePriorityPrivilege	2848	msiexec.exe
Token: SeCreatePagefilePrivilege	2848	msiexec.exe
Token: SeCreatePermanentPrivilege	2848	msiexec.exe
Token: SeBackupPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeShutdownPrivilege	2848	msiexec.exe
Token: SeDebugPrivilege	2848	msiexec.exe
Token: SeAuditPrivilege	2848	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2848	msiexec.exe
Token: SeChangeNotifyPrivilege	2848	msiexec.exe
Token: SeRemoteShutdownPrivilege	2848	msiexec.exe
Token: SeUndockPrivilege	2848	msiexec.exe
Token: SeSyncAgentPrivilege	2848	msiexec.exe
Token: SeEnableDelegationPrivilege	2848	msiexec.exe
Token: SeManageVolumePrivilege	2848	msiexec.exe
Token: SeImpersonatePrivilege	2848	msiexec.exe
Token: SeCreateGlobalPrivilege	2848	msiexec.exe
Token: SeCreateTokenPrivilege	2848	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2848	msiexec.exe
Token: SeLockMemoryPrivilege	2848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2848	msiexec.exe
Token: SeMachineAccountPrivilege	2848	msiexec.exe
Token: SeTcbPrivilege	2848	msiexec.exe
Token: SeSecurityPrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeLoadDriverPrivilege	2848	msiexec.exe
Token: SeSystemProfilePrivilege	2848	msiexec.exe
Token: SeSystemtimePrivilege	2848	msiexec.exe
Token: SeProfSingleProcessPrivilege	2848	msiexec.exe
Token: SeIncBasePriorityPrivilege	2848	msiexec.exe
Token: SeCreatePagefilePrivilege	2848	msiexec.exe
Token: SeCreatePermanentPrivilege	2848	msiexec.exe
Token: SeBackupPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeShutdownPrivilege	2848	msiexec.exe
Token: SeDebugPrivilege	2848	msiexec.exe
Token: SeAuditPrivilege	2848	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2848	msiexec.exe
Token: SeChangeNotifyPrivilege	2848	msiexec.exe
Token: SeRemoteShutdownPrivilege	2848	msiexec.exe
Token: SeUndockPrivilege	2848	msiexec.exe
Token: SeSyncAgentPrivilege	2848	msiexec.exe
Token: SeEnableDelegationPrivilege	2848	msiexec.exe
Token: SeManageVolumePrivilege	2848	msiexec.exe
Token: SeImpersonatePrivilege	2848	msiexec.exe
Token: SeCreateGlobalPrivilege	2848	msiexec.exe
Token: SeCreateTokenPrivilege	2848	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2848	msiexec.exe
Token: SeLockMemoryPrivilege	2848	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2848	msiexec.exe
2848	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3892	1224	msiexec.exe	90
PID 1224 wrote to memory of 1664	1224	msiexec.exe	98
PID 1224 wrote to memory of 4436	1224	msiexec.exe	100
PID 1224 wrote to memory of 656	1224	msiexec.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SpiderSetupAll.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1A8A33B4F21AF8087D4F7D0096B6D428 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3892
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8CC5D1FD850BF115D70ECDE5A5B3E3EA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4436
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Tenfore\Spider Client\capicom.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5925de.rbs

Path C:\Config.Msi\e5925de.rbs
Size 80KB
SHA256 f348b23c1856b414547c9112121add4caf2a42f11baed631f596ff3103fd6311
MD5 7dfabf4f7e81c289118542cd2b357053
SHA1 e920fb28fffcf7a6b65d1856ab5c1bdd26ca742f
SHA512 2a0e2c2402dc990919b94ac5f2e86c2901f5f94158ac286d9034ac81bd4da181fd306dbc7af8ec879370380152650a87b72f79b384765c1394d7eb03e68ecb48
SSDEEP 1536:ZzxIhM071yGvy7yTx6HJ4ivr7wISZEa15thqydyIzyqPja/:Zz0MMtja/
TLSH
T1A1833422B997DAD4F391A7B3B3C46F0DB6048E5AA6D6C42D10CD466EC982F62373C0D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AxInterop.SHDocVw.dll

Path C:\Program Files (x86)\Tenfore\Spider Client\AxInterop.SHDocVw.dll
Size 62KB
SHA256 a96b1c19b35df1d677590ab65a24b8f244bbf53fb9d8c450a111792d1567a92a
MD5 65beba812ab50514a9fe11e612c47cf5
SHA1 ffbe12e553a5c65b85b473f4edcced2c0992e693
SHA512 e5edf81229e9471fdeabaa33e185e2574b79b1fada8ff09c061d63761abf3de98f4d6335a8a3eedcf0c71c660294dec9e93f4347f97fbc2ad681c329b0981c56
SSDEEP 768:N1wLdfQ12vUD81JqdVz1jvllNpb7kjMmYDV7yJyHXT2Ip4fpbxf1ml0qiNnL:SFQ12bc5lv7kjMmc1YAa9fjfILiNL
TLSH
T1CC53E84A4F9C5872CBFF89F8BD9642954670E2C7B043EF531095E4E0A9433F25B1A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Interop.SHDocVw.dll

Path C:\Program Files (x86)\Tenfore\Spider Client\Interop.SHDocVw.dll
Size 160KB
SHA256 a3ec7da82b9ead15337fbdd5557631c82552b676ce191f1eb0a8fb9a29d78082
MD5 af2c1ec32e38cf751fdacfa9f876c242
SHA1 493dc3177080e1f40478de4bc259c41050554106
SHA512 360f8157a5b344fe2271cdb1b54ffed1baf1b0cc4f43e6abc2bfc30c5b38698be3747063d83fac90b1200c037edb94ec8c0c2334dc9b25f61a2415cc4ff66c77
SSDEEP 3072:wxWfilaEfKFIzOpsnitQbGRmdyT0lOPQBq78Nm3YJCjE1efgR6LMd2HoZSzUFuvw:wxWfilaEfKFIzOpsnitQbGR2yT0lOPQy
TLSH
T123F3C65272396034DA2CC5BBCBE7076423319A156E55CF03368E6772DF5228A4B8B37B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporter.dll

Path C:\Program Files (x86)\Tenfore\Spider Client\Reporter.dll
Size 24KB
SHA256 919912e4cef0b87bfb57f4533c83e7a93ab209cfc7bcd2289b8aba8d89d03352
MD5 c718a79727bf4e042ce4f15164bf1992
SHA1 c18c2cdeca6a3e53c56c5429ce548c0fac19b44d
SHA512 56f2c71857126888c4e8f656a0c110096475bfa4fc7d75328a39803f505af9a91a4b23e5c1e4c806691de3edbad530148abbc1295c7194c3a5744d1df81da6ad
SSDEEP 192:W098CWssrWKX5EOTbDmR1d3dN63bEyt8Vs5vg1ZWrB:x987ssK6uOTbirVdYF+Vsxg1ZoB
TLSH
T1B1B2F70477E4C712C8AD877DD9618B108736D3678022DB1F0EDCE1D72E6A3044AE7EAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RxTxObjects.dll

Path C:\Program Files (x86)\Tenfore\Spider Client\RxTxObjects.dll
Size 130KB
SHA256 92728570060e557a3271a7ac3c6e5c4c3a174a8380ad1f070efe1764fe80d612
MD5 b66adc173721ceb03dcbc2a17debcee9
SHA1 4ddfc0782a99c291c005189e5d519d95d6323b4d
SHA512 4ea34c5ec7d6c566e4dede4de4d161eb4c31dbd63de5817b9ff2fba80d74ee829eb7749d3711460ba03f5067ce10c951c90bc08b2310b6c59c1f99473dfdc9b3
SSDEEP 1536:I1XnJtxP7NhbvORp4EqX8G+MtINb+RCjfeZ3YjpBCeYZJUt210hpBOyYAa9EfIHE:I9ZORp49+6R+fywvYLQ3OZxa
TLSH
T1F0D31A4E7BD80A8AC6EE86BCF1588800937DD05A6167F75F1FC950F8B4B3323D58166A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

capicom.dll

Path C:\Program Files (x86)\Tenfore\Spider Client\capicom.dll
Size 512KB
SHA256 1c28a15b8832615dad08ff5e9a15dba722b089632f3f097569708271cbc52215
MD5 d0856eea2ea805cd343b0c98ad861f0e
SHA1 fb7c728135df5d71e6d19706de022a907e821ce3
SHA512 2b56e9302caf4e305f7df7992ee321c336bb44bb7355a027a7858b8c338a7e3222429a3de20b55fa95565b6b6c735ffb6676d53d77425a75d02e946b22fe20e9
SSDEEP 6144:FMUhc4UpcykBFf1h8fjjDToGcFD+Ze/gCJ+0OuqKg:FMUh/Lykb1hijPZcIUgWCKg
TLSH
T175B43A21B788C533C8E23970896E67E177BFD1941F6252C3219417EDBD76BC26A3438A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbbhTreasuryDemagedMoneyOrderGet.rtf

Path C:\Program Files (x86)\Tenfore\Spider Client\templates\cbbhTreasuryDemagedMoneyOrderGet.rtf
Size 83KB
SHA256 f405d9439c71723891bf1d5782d9781407c2ef4eeda998e7e1e8ec2f47bced34
MD5 d147fcec591d1cba790a4c51bb950dfc
SHA1 7b62ad86ba222ae9e2f93cf2468abe8c38c3496e
SHA512 38bdebd646fac6f651ee49678b6c02ec1775593631e2b7164d7b890c0f3f9112b3244df689737bfe4b5b14b19f704a0144629d412deaee7e2b5ad23549a37de7
SSDEEP 768:qa3V6kMI58tza/nuGQZs8i5n2sGL2t2sr17QNXvtnltTLdttoSto1touBqWWjUt2:qs6BS1i1Iv5kbykj
TLSH
T1258362F80407DB68DB22539D9A11F48C281BF56408F724D9F1EFEABD907BDA4E827905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbbhTreasuryNonEuroCashOrder.rtf

Path C:\Program Files (x86)\Tenfore\Spider Client\templates\cbbhTreasuryNonEuroCashOrder.rtf
Size 99KB
SHA256 02546c297ec038b8219b870fe896a265b1d75fbc5efc1f683e034a65769860e2
MD5 acac717a29cef87dc3219d887eaab4c7
SHA1 4ff7df1e62b83a37d727974163e885f519083c43
SHA512 187aa17c66c7bd261d40f3f837eccb3f35c5104286067375a3e67541877634a884512ecb467beba275682ac2eac674c810f777e7f54e958fc4bddfdbb04ffbcd
SSDEEP 768:ua3jxkMI58tza/wuGQZs8i5n2sGL2t2s2fP01MN5NATTwbgKm6Gqt8bj8CPmdxSr:ucx0RD+JUt9bykO
TLSH
T1E9A340B40417DB68DB22536E9A15F48C2427F1680CF724D9F1EFFABE903BD64E826509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pattern_treasury.doc

Path C:\Program Files (x86)\Tenfore\Spider Client\templates\pattern_treasury.doc
Size 75KB
SHA256 d06deab97917f33c492791c432be68f8934dd4f0ae90a13183684e5b99986879
MD5 2d698e22c142cb8c8864213aa6b3afb4
SHA1 c61e4a39a4966093bd29b1f0b99d8d1949372f58
SHA512 28229d44516aefa06c4d7dd9d22d65bd7cd0a3f59812dd22fe3048a76aa1350d9eb73d58a2fb83bb9f422bfb5ff91e2d0b83b8d2cf2aab1aa4dc05e2692128e8
SSDEEP 768:O+/lmFKs+QGCS+Q/J+EyWDNMo+EyWfVRDtScXy0PhtiuK5PPhtiuV5PPhtiukamP:kYRn
TLSH
T15C7354764963CF90DF18936E58A1E89ED25286950DBB34C6C67B3CFD4833D31A81EA4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pattern_treasury.rtf

Path C:\Program Files (x86)\Tenfore\Spider Client\templates\pattern_treasury.rtf
Size 75KB
SHA256 5f8f0a1f861d2f8c66217f20d4a9a7aef8d7a6a2a3dc76adfd4eade829ba9735
MD5 016174f49c263d31c5ee7f0590ad5eec
SHA1 667b4fc084ee506108def055ee3b68f1d0daf20c
SHA512 8a2553327608c4eee2c50f92491f81d8b3f885b4e35415e7c4543d1dd75028cdb4368a01ecac3ffe845d24318f5db5fc57bc13e245a78d7add79353e68dc6618
SSDEEP 768:O+/l+uFes+QGCe+QhJ+EyWDNwK+EyWBl9DtScXmuRDtSlG+uRDtSlF+uRDtSl0To:myxQt
TLSH
T1327354764967CF90DF18936E5890E89ED25286D50DBB34C6C67A3CFE4833D31A81EA4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 1KB
SHA256 2000d6d26845aa4c4ba6cdbfbc50f714f7f9a1b3e8fb4c6f41435d9c92e73a54
MD5 31e7d4897b91c8df70782936e17b27af
SHA1 42a0376b0ec175c7a3f2d5e302b843496e41be8f
SHA512 32d3318dd436c14d4b64282b8ca047e199e94dfb23b39b371cc97da9627db873d95aa42e87ec9a8ccf40542a6447d429b10588e891f833ece725b2d77c176767
TLSH
T11331E9075DA53441BFC398324EC04AEAF8B44B7779605A0F124AF7D81848FD6AF1419E
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 10KB
SHA256 25efb1c5a86a30095e1906cb178c437161a219903c6724d7039b5f94bc95e08e
MD5 3f3d825741d923d01e6c895fdfbd8b4f
SHA1 a37a3f60879e7e6b307c35894d7d3b3ae75311bc
SHA512 69c3415883831f0be5a45def3098cfaf93243d7442cf04a5d062915076455c40f190eae8efb9c2306f5f312a393188e8701580648ee2c3969a29101ded055409
SSDEEP 192:Ld67Ubf2MJ52HB5RYslUM4fQyJJCQhFuo2s/UQ+dV:c6/29eMYfCQDqhV
TLSH
T18A320DBC6A48A99790C56971CAC79FD3CCF251A13BD1E21F41751E880468FC3CE97392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 345fe296fe947276fc22f3a6e971fc4dd6c54869e2b898e7d5311077976c6691
MD5 a199ec033f0a1077b0f84f20bff9e427
SHA1 b5b860f87cb16bf2b747ce1c9a24c2558c249468
SHA512 ef3436c0ec9ad536f39dff5b34634a95095c73c7655bbeef006523c2ec52564e8061ea891afa795df861e184b845b32dc76c67714c20e91e4e7c88a1d7e2fc7a
TLSH
T1A2014162A53CB24945410949AA38EDCA7AB4EFD40B10382F207B61181665F016A36144
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 422B
SHA256 f834f2ea76d9d59caa0da16972debbe695be90b6eff50120636bb9e507193545
MD5 f7b173f124337d2d9806ddb98908619d
SHA1 d582e488cfb652020a24b2c4c5bab5a563174146
SHA512 edc55acd2071c666282857df67b51af379d861279b39c027c127a4c702dfcce3e5abb20591767d57b1a23b4dabadf2ac39f0db55c74c0c51b20c77abd68ecb98
TLSH
T15CE0D81419FEC51DE3366D3947DA756F0A7BF353440C96A2A6504155685AD01CD31723
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 290B
SHA256 a43dfbadd21e3480b78512769a5bd916109d556871e827c428671e328f00f6cf
MD5 e1180f71a33cb096544c9c6de86fc3c5
SHA1 10c61d843ca6cd5d72013679cad45920207466c8
SHA512 ec472cff2eeef794c1acf0d1754dc2a559f76efd5cb45bc46f6021851bc64752f28d23f6e19bb294ae3b9f5d804c58b67e94bfc3157296ca35d5160964b777cd
TLSH
T1F6D05E18E3F54611F181853EDAD02957EA79B915D10093980BB083287869D01F932B13
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 7dad0b3f11b60fd6ce5c16725e15265925a74f8b5edb9baeb92e6a20efed7943
MD5 0f032f12481317d93ef5767c7d3c2c7c
SHA1 49ff3a3d603a4c56129543bfdffcb00db46c5877
SHA512 f396df744a71e4241e48abe9f58c31c51e0c7633ef7820cc586789f404f5585b749d759171a9a43bf84cf9c5f9992cb4d1f820ad21b144adcc2c0812e5558559
TLSH
T168E0170CA7F50E23F191CA3E59E02A23BA39AD618610834817F583087538E92A930317
MD5 SHA1 SHA512 TLSH

Submit Download

MSIA004.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA004.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_535AA29CA141463B7B3CA3.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{C8846C76-605E-478D-A975-12243C7B5D70}\_535AA29CA141463B7B3CA3.exe
Size 2KB
SHA256 20e4262917b36f614fa768f85021a922bbf1f010f73bd94c0138a959d2ec7fec
MD5 03bc2913937d82b6b980e2611c52e2f1
SHA1 1b4fbe72243957a488357fae401f15c9d3793c5b
SHA512 580f1dab4c4a682951eda1b015cbab37067ca73c15cb94ca7248e4c380900a18c1990070d51cdcb8e4b492c9f9bb3767da6689a4589364f56e0eaa4983d98078
TLSH
T15F4195F6B383E06DC930B634F8A7995189C5D04DE1163C042C968EFE54A3E594E03D64
MD5 SHA1 SHA512 TLSH

Submit Download

e5925dd.msi

Path C:\Windows\Installer\e5925dd.msi
Size 8.6MB
SHA256 ed060d367539a4ad022a7fb9e3a8c6d4ce3d1192a059b68387a7fe7fb3306369
MD5 7c337d3aa8a3fbde56b87fb9c822673d
SHA1 75e36182b97ed8a2c733207f23a71b96ee65af0a
SHA512 ae3ea93f806a98aa51341f0986758ea339ee5d0067d591c8c39b502437fd1d72f2ef7905296d0f5899d0873d1471094a1ece91880dc78a994fe79f7aded25a96
SSDEEP 196608:UiqMqiKkaQvMqi+5mHaYDV1fvPMGSU0oToEdmfF+r6rp/5Yn1aB07u:eMqLkaQvTlNGPkfU0QNdG+r6rl5Y77u
TLSH
T1529633127741D133E26A06B46A7D2B7159BB6C7012E0154FE324BBDE5C323D293F8EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 bda0468cb984dfd62e3f00138309d61c8a90c9400bae1106e82734562dc88fca
MD5 905381a05201e6b7b1bd8183da9183e8
SHA1 ea10daeaceea072b8944e3fe76ef39016908113c
SHA512 0dcc352040b25b7e0241b8bf8db14bc9143d0cff7ff62fc9a0fa30973b0e1c1da54d6f538ee78e2ea57601b5b0f32fe410c4d0198e1af13cfe1fc2cd9a662817
SSDEEP 24576:du8m+1ztdoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:X
TLSH
T15147D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{78a9ce9b-0752-4d4b-ae54-32e93b3bf857}_OnDiskSnapshotProp

Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{78a9ce9b-0752-4d4b-ae54-32e93b3bf857}_OnDiskSnapshotProp
Size 6KB
SHA256 97d1ed802970370c1f682397f8e7a1f3dc290324b9fe0808760e64a69b33b87f
MD5 b446018b57eacf0cbb3406868ffa9f4f
SHA1 2deeb5fcd6d3015c046b3a60d60322c912bc1c78
SHA512 3270cb34cbcd8afa2abe416033f0eb8a7b3523972dc98610d8c8de2a1de60a6bcd8ce33807fd5863a9002e4f989883f66e15f4d948783a5bb75e66a86c1826e8
SSDEEP 96:F49VJyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:W+b++ZVmN
TLSH
T15ED18B185AE54711E2F3AB7228F14557A477B911EF33CB8E0198238E6670A10F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/656-341-0x00000000009C0000-0x0000000000A41000-memory.dmp

Download