dcrat | 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020

user interaction
yes
max time kernel
2s
max time network
35s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TsarBomba.exe
Size 25.2MB
Sample260823-tcbexahn2w
SHA256 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020
MD5 91025d6f02e542f2e37ffce7d0ce8b51
SHA1 e2d80ef6075556cd23ce0445473c061f200b5dd4
SHA512 09c6d7f8b64c75e963d63ad1478a81f567182a948d652346f1c68d233efead615703aadb4ce9cd5e5fd7235089f2439e9153231ea3e1a2c677ae84aec29afc89
SSDEEP 393216:NVn+SLSF5pdHn2AXUCITkkkkkrkkkkkkkkkkkk6lX0wfGtbYTZb08MQUCITkkkkS:PduvnNG0shAQ31qnMb5OM9Tt
TLSH
T13547C0863B60C192CDF278719473DAC016387E6DCF3255A6DBCB4A0ABC518B7051BE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

redline

Botnet

cheat

154.91.34.165:64951

Extracted

Path

C:\Users\Admin\Data breach warning.txt

Ransom Note

# RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org

URLs

https://qtox.github.io
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
http://161.35.200.18
https://gofile.io/d/ufuFye

Extracted

Family

vidar

Version

13.6

Botnet

158fdd2a4f5abb978509580715e5353f

https://t.me/m00f3r
https://steamcommunity.com/profiles/76561199851454339

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

discordrat

Attributes

discord_token
MTM0OTU1Nzg2MTk3NzY4NjExOA.GZnBJ8.ModoCKrx8GueOq0zGHlbO14l4wHwAZe9839-DA
server_id
1350894549899411528

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat
Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

DCRat payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2520-310-0x000000001B4E0000-0x000000001B5B8000-memory.dmp	family_dcrat_v2

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/4376-306-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4376-308-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Detects ValleyRAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001700000001c5df-459.dat	family_valleyrat_stage_2_v2

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4240	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6116	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5260	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5316	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6140	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5260	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6096	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	2540	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5144	2540	schtasks.exe	107

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0004000000016b4e-4.dat	family_redline
behavioral2/memory/5672-33-0x0000000000360000-0x000000000037E000-memory.dmp	family_redline

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0004000000016b4e-4.dat	family_sectoprat
behavioral2/memory/5672-33-0x0000000000360000-0x000000000037E000-memory.dmp	family_sectoprat

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3944	powershell.exe
596	powershell.exe
3116	powershell.exe
4780	powershell.exe
4664	powershell.exe
4732	powershell.exe
5312	powershell.exe
3524	powershell.exe
5796	powershell.exe
3092	powershell.exe
2964	powershell.exe
3984	powershell.exe
2940	powershell.exe
800	powershell.exe
4848	powershell.exe
1896	powershell.exe
5308	powershell.exe
5056	powershell.exe
4144	powershell.exe
4996	powershell.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001300000001c5f3-492.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
5672	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
2732	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
2380	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2424	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2128	cmd.exe
5640	cmd.exe
3964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TsarBomba.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3512	PING.EXE

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1420	vssadmin.exe
596	vssadmin.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4624	NOTEPAD.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3512	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 19 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2568	schtasks.exe
5260	schtasks.exe
4500	schtasks.exe
6096	schtasks.exe
800	schtasks.exe
6116	schtasks.exe
5316	schtasks.exe
2340	schtasks.exe
1360	schtasks.exe
5260	schtasks.exe
4980	schtasks.exe
3852	schtasks.exe
3928	schtasks.exe
2844	schtasks.exe
5144	schtasks.exe
1924	schtasks.exe
4240	schtasks.exe
6140	schtasks.exe
1092	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 5672	6044	TsarBomba.exe	89
PID 6044 wrote to memory of 2732	6044	TsarBomba.exe	91
PID 6044 wrote to memory of 2380	6044	TsarBomba.exe	92

C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe
"C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
  "C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5672
- C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
  "C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"
  2⤵
  - Executes dropped EXE
  PID:2732
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4376
- C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
  "C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2380
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5312
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9B4C.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4796
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5128
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2424
- C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
  "C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"
  2⤵
  PID:4088
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4996
- - C:\Windows\SysWOW64\net.exe
    net stop "Acronis VSS Provider" /y
    3⤵
    PID:2364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
      4⤵
      PID:4540
- - C:\Windows\SysWOW64\net.exe
    net stop "Enterprise Client Service" /y
    3⤵
    PID:2716
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Enterprise Client Service" /y
      4⤵
      PID:1632
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Agent" /y
    3⤵
    PID:3212
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Agent" /y
      4⤵
      PID:1500
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos AutoUpdate Service" /y
    3⤵
    PID:6112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
      4⤵
      PID:2332
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Clean Service" /y
    3⤵
    PID:3392
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Clean Service" /y
      4⤵
      PID:6128
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Device Control Service" /y
    3⤵
    PID:3060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
      4⤵
      PID:332
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos File Scanner Service" /y
    3⤵
    PID:1232
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
      4⤵
      PID:2112
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Health Service" /y
    3⤵
    PID:4704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Health Service" /y
      4⤵
      PID:2996
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos MCS Agent" /y
    3⤵
    PID:4400
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
      4⤵
      PID:1928
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos MCS Client" /y
    3⤵
    PID:4644
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Client" /y
      4⤵
      PID:3228
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Message Router" /y
    3⤵
    PID:5024
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Message Router" /y
      4⤵
      PID:5316
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Safestore Service" /y
    3⤵
    PID:2024
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
      4⤵
      PID:236
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos System Protection Service" /y
    3⤵
    PID:6244
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
      4⤵
      PID:7152
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Web Control Service" /y
    3⤵
    PID:7352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
      4⤵
      PID:7456
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Backup Service" /y
    3⤵
    PID:7660
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
      4⤵
      PID:7952
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Filter Service" /y
    3⤵
    PID:8092
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
      4⤵
      PID:7156
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec System Recovery" /y
    3⤵
    PID:3160
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec System Recovery" /y
      4⤵
      PID:2304
- - C:\Windows\SysWOW64\net.exe
    net stop "Veeam Backup Catalog Data Service" /y
    3⤵
    PID:7492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
      4⤵
      PID:8056
- C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
  "C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"
  2⤵
  PID:300
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:2128
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1420
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:5640
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:596
- C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
  "C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"
  2⤵
  PID:1956
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMNOTE.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4624
- C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
  "C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"
  2⤵
  PID:2520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows.old/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\ctfmon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\fr-FR\conhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TsarBomba.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2964
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mQm6VxNiNk.bat"
    3⤵
    - Executes a command shell one-liner
    PID:3964
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:7680
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3512
- C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
  "C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"
  2⤵
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
  "C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"
  2⤵
  PID:7176
- C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
  "C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"
  2⤵
  PID:5988
- C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
  "C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"
  2⤵
  PID:7496
- C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
  "C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"
  2⤵
  PID:8064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e10" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e10" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\ctfmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\apppatch\fr-FR\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\apppatch\fr-FR\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\apppatch\fr-FR\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TsarBombaT" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\TsarBomba.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TsarBomba" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TsarBomba.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TsarBombaT" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\TsarBomba.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\Offline Web Pages\ctfmon.exe
"C:\Windows\Offline Web Pages\ctfmon.exe"
1⤵
PID:3724

C:\Windows\vkl.exe
"C:\Windows\vkl.exe"
1⤵
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe
C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe
1⤵
PID:3868

C:\Windows\apppatch\fr-FR\conhost.exe
"C:\Windows\apppatch\fr-FR\conhost.exe"
1⤵
PID:1032

C:\Recovery\WindowsRE\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
"C:\Recovery\WindowsRE\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"
1⤵
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5260

C:\Recovery\WindowsRE\TsarBomba.exe
"C:\Recovery\WindowsRE\TsarBomba.exe"
1⤵
PID:336

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5144

C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"
1⤵
PID:7596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 99f2b7b6acb06aa34f45c79989b6771cdc111ba4daafd6d40a51c4b8241762cb
MD5 70a53850aaa345ca635140c4b9e8df1f
SHA1 284bfa95ffb6ae64bd9ee16920888371df50dde3
SHA512 2fc5764ff5143c022cb6480a89507f11f79069ed5535b8aec7c57936b8a97294d82fb756d6f0ccd704d07acebfcd972af119bebef45eeb018832f8027a146da1
SSDEEP 192:fSEFGqGpYQ4b5Pz+wcuEsJ5yRrVeYHHRPpIeat1buk+8m2jvg+VOIA8Qk4CVIA16:fSEFGqGWQ4b5yvuFyRgeBqK2P0jIAXkm
TLSH
T1E0328598617FBDCBD8E21374249A4297FBA4E0CC53751199EE3BCE3B18A0FBA5B40510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe

Path C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
Size 673KB
SHA256 01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52
MD5 9c7b97eb3958d4309e6ba38bb1a99471
SHA1 76c5317147306c477d793dc6aea9814d8111f82e
SHA512 3f9a36b3aa453400002156f0952de2ec4e9b4c28472cf37ccdd4483f63ea069ccf605f35a1abdffe400b9cedbc1711bacb9744c27aa3f00bf61963380b4ad461
SSDEEP 12288:OCtB5nF8ME6jD/gyU4gvpMvUTlzfAbzbm4rbH/x0XKqRoBWOrXlzofm:zPtD/gFNHlzYbzbR3H/cV2rXNofm
TLSH
T1C4E4126D31AD7C9BD86E02FD1931E008A3B2FE794495E3C96CC275DB45E9FE04622293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe

Path C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Size 95KB
SHA256 0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1
MD5 a85ded286361bd125cdfceb0b6c93108
SHA1 dcbcead80fbd7aab46ca5669a89c6233cf480550
SHA512 d4d7ab4e5af4e82f43f6e43fe9caa429d1fa2961b7636495d46158d8c96ebaa16c610efce147cde0fe2cb1198bb20731eda44299a29387ef6863906d02fa8e42
SSDEEP 1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2A3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzduY
TLSH
T1A6A35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe

Path C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
Size 342KB
SHA256 0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1
MD5 3167685ffbdae55b00485896310fe2f4
SHA1 a1b706b3aa0aee0d3f534a2823af03afc44c975c
SHA512 63f7875a69b330f7fa4b39248a346810c94364f8289e41dcbe82ee696ad58afc6d8ccfcba1b56fb8dae6a5a32478b3866d434a464843b38a5e895b5c209e8088
SSDEEP 6144:wN7o39E/EXHwLtnZXHOIfPnJbSruNsLYkKtYsZENiG:wN839QKHwL9ZXHOw/Ba2tYsZwiG
TLSH
T17474D009729140F9E87B81B98E916651F573782A4734BBDF03A08372AF237D49E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe

Path C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
Size 624KB
SHA256 1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e
MD5 bd29231bc4f2c6d2f22fa026e2eaca40
SHA1 f037584c363d566aa69b7307471012247707bb4c
SHA512 e1a2cb6a41c1ee8e5dcfb6c7144fdef29304009ebd2ac96fc6f274fb5c82f322121e20b393fdb1166dd5ad1bac735ef3211d0478d6c13994832ed0f85fd85832
SSDEEP 12288:V4eCA30wfnlxvaUwZNf6qYID7ZJuIQOsknZh20QyCkje0ZM7qgbGKTO7muYpralU:3C8valgsDyfSBKXyMUkW2LILGBm3IzPB
TLSH
T116D49E257482C076D67302314D5CEBB6617FFC314B730EEBA7805A6E5A381E16E3297A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe

Path C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
Size 270KB
SHA256 3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044
MD5 5887e7ed9dcec96ac39cbda2b19d8cc0
SHA1 3ffd87928b7b4ad200597e6cdd9b1baa85da2a1d
SHA512 167a348f9bddbcfcef4fa287d08a8810ddac360dbace4d667795f55f77e15b21a0e7e15620069f10c3dcb4c031afbb7058105e318201f3d9191f3d1b7c8f6649
SSDEEP 6144:XFohGQel4VQg/U+Dgx3bMAVVzddi6jWGPxF:XFoIlK53DgZMSVFjW0x
TLSH
T1CE447D46B6E50CF8E577C179C8669A05E772F81607319BAF036046572F33AE08D3BB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe

Path C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
Size 501KB
SHA256 4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb
MD5 8b157ad42fa665d263904052f56a009b
SHA1 6b59b196c4222de0d8f53465f2cc1a12e6419eae
SHA512 fa62c74da5249c4daab1c14c894428871ff020e63358201b6dc009b7ff5a0545259912c3e4739417b64c391d290ceff5bf2ecc7c1aded6e66963492df8e270d8
SSDEEP 6144:X3eECiMcH70IH3USdoJnUGBgpoTvc/486ydfamhwr4ZS0KBGD4l2w8t+0SjbG8Xo:k+Pd2UGBvrc/7dSYSQDksMS8ZeCHMS
TLSH
T1B6B46E1AFFBACCDAD1A654B6B96688434DF63F591B33CE464B019B612B317809E1F340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe

Path C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
Size 518KB
SHA256 59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad
MD5 1395d639e30f4ddc816ccf11b2ad0f28
SHA1 2a4858caf50a91e6d25040c1f33848285d654f2b
SHA512 31114e6dce5f5827cf009a089afd152bcf8bf658135c23e8a04bb183f7570f6eee0fcc24e60a621833f0f499eb863a5f2349273f56b6b5be4e1510034aa89e70
SSDEEP 6144:UDnqq8irF2aCTY395PvTkR9OYkqOX//H+scdQ4vcbkDfNRUXyY8pAZjfDAM6YaXY:ind8iYjTY4rkD3esAQCDfUkpABfD4Y
TLSH
T153B4290BBA169FD0C2899736C5DB800457B4D6C17397EA4F7CCA23D51A433BBAC8A647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Path C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
Size 446KB
SHA256 5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35
MD5 0c14b5bb56a334cf17ef9b247ea1134e
SHA1 3c84652aca0d37010779fa0798a2e3781bca30cb
SHA512 31a8f0b5e5165d4493eeb481c8ad00eb93eb5b1c5e9c5ba83f88856feb2112791d1218c89c05c9e0e8691504a7ae7304f3401df7d575e3773753fbd5adee2a82
SSDEEP 12288:lSdYztRylczUsOuLES/jRGe7/Lvxi8I047F:CKtV93YSYe7/LvE8I9F
TLSH
T1F2A41276C369B870E3ED55F0AFE2D8A08801B1AC66FD15DF8BAB42C491F0958C5897F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe

Path C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
Size 699KB
SHA256 60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f
MD5 81dd862410af80c9d2717af912778332
SHA1 8f1df476f58441db5973ccfdc211c8680808ffe1
SHA512 8dd014b91fb1e2122d2e4da444db78dd551513c500d447bb1e94ceb7f2f8d45223a8a706e2156102f8c8850d2bb02ae6b8ea0c9282abd7baaa2c84130112af15
SSDEEP 12288:0L/xX5KVeOnuH/u1Wig295xsmVXf6AaQLmEc+pdmWSwIHUOS6Vp:0bxpUz13g27raQmEcomWSHHUD
TLSH
T1F3E42305FEC8C51AD508503558EBC0BD36A3BD6B282A810FB49DFF5F6F74D026A5EA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe

Path C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
Size 78KB
SHA256 6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722
MD5 692726995ad5cf7d9dabaf873fef7106
SHA1 aa1bbb40517647240214680c1d0b58aaacb3c939
SHA512 bfd69facf646ee2f8163ea18252dd4c46cef38cac5ca86de9ec2ee8ec46eba068286f04d7ec81a999b08ceaf3d837a168c1804e410db4ff3f685c31ff1e3eb43
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+yPIC:5Zv5PDwbjNrmAE++IC
TLSH
T1AA73B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe

Path C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
Size 253KB
SHA256 7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5
MD5 0c03d5237e53facd034b810687726e41
SHA1 a21f82c57cfad54fd4c6fb651ce5aa053f7e1ca0
SHA512 ce8838020046f80d82020b785922e8c557b670e003fe7b0493c82d426dcc1a7a91e2c7bbd4e711d056f7c1e0f0dc25ccc76c56ba531cdee4c939124070c55009
SSDEEP 3072:ljghhdUmfP3EqsAPs0a2sPGtEPBeQvKlIrRuw+mqv9j1MWLQlmsolWM+v8Y:lN+3Ls06CluDA1+vz
TLSH
T1D644A4E177808511C85749B8C0BB9A7765A3B64F6D78C54C3D81BF4B3E22386885BACF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe

Path C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
Size 383KB
SHA256 9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b
MD5 eaf71e0105c5c4380d1b50a31ab8cd55
SHA1 37f559d3834cda1a3004b1c7261eba2f012b0be7
SHA512 63c021bd331cda29822326f250566c6cbba8fdb851b25655d6a0c2e8d653ccd5ea3383294fbf2ae0b5e2f786fd9b74f09a0ad3cf8eddcb63474338463f1e62c7
SSDEEP 6144:SslCzyh9cgktO75wnnYtu7SmDy4P5BvqjBk:Flthjkg1wnJSm++
TLSH
T1B2848D09FB9405F8D5678238C9A24A16EB727C5D07A09BCF33E4466A2F23BD49D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3sszx24e.5ha.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3sszx24e.5ha.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 508B
SHA256 d74c8da38d3266adda30203ca2001b2c7f491b7cccbdabcd2f3073dbd3b9ca3e
MD5 93856f30f6a71495cd38f0db54570d20
SHA1 28f63b3ef3c1b44d0d7525d17a37c6bd42b7d4b0
SHA512 bf41ede658aa4256d771fda7f6442093d25412a18f08807bca1fe9bc81742b6297b25e419738848f3360e3af0c267015d4221d84e5f5c4477884f951ef46bc15
TLSH
T1EFF0A02042F5032CF3F2AA567CF5554A0C26B634E827E7AD45800F8D5830E18CC62F2B
MD5 SHA1 SHA512 TLSH

Submit Download

mQm6VxNiNk.bat

Path C:\Users\Admin\AppData\Local\Temp\mQm6VxNiNk.bat
Size 167B
SHA256 8ae621696a577a419f5a4b5967fdebb13b6b49a608fb3fb39c17554e1835cc41
MD5 801a1930fb87141c6d165f648d710f43
SHA1 88eea54bf302c42b7a79f1efccecb75799ec41bc
SHA512 767062b14da2c8d8684d58584c9863d86172cf4b8da65705f1bff206fec4aebbcc9351b03ac029fa22fd125effbb7ddcfa7ceb7d9b9e3a7532cf343fc3e9ec46
TLSH
T166C08C059901C62D47164806399B3B89F06B28E62A8AEA6145488C2E56CAA5D7AA71E2
MD5 SHA1 SHA512 TLSH

Submit Download

tmp9B4C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9B4C.tmp
Size 1KB
SHA256 7a1644e2488990066b746e6b8ff720c30fd8d9f2b5153acb89aadf0547d66af2
MD5 d8ffa9630a1fe5cca38ae6961ad46840
SHA1 8b910a52bd7ff886ccc7b157ebe92f3e348ba8cb
SHA512 aeb3e1372699ac0102b44004e279b9e3b49f4c6c3daec648771063c96e68b89516fdbd035ecd15c147dd2ebee01d20059cd8a313109dbdd8a580738f28c414d3
TLSH
T1F6311064D8F0F71BB5420639835166836FB58BB759920038F8CC0AB87F8A6C22053A7B
MD5 SHA1 SHA512 TLSH

Submit Download

Data breach warning.txt

Path C:\Users\Admin\Data breach warning.txt
Size 2KB
SHA256 07ab218d5c865cb4fe78353340ab923e24a1f2881ec7206520651c5246b1a492
MD5 e7264a4c331eac851fa75438919e0531
SHA1 38f6dc2b0c5e86d38c2a9bd7f5aaf4447be97a61
SHA512 f8aca867b199f5494dbc6919423788533b4b55f249ac1ab2707c38788212b585eb39234be74d1f2b039d00ee096b5d2036c1066e19e4fa304b048ffb61ca1edb
TLSH
T15041839F630A108A945335C2319DA9D1F716945C56CED74231FA911423AA637F93E218
MD5 SHA1 SHA512 TLSH

Submit Download

RANSOMNOTE.txt

Path C:\Users\Admin\Desktop\RANSOMNOTE.txt
Size 3KB
SHA256 21b3fa1cd0b801336d6a9996a2816382165ed1d97c85034ee0483cc2035f0e68
MD5 7ac5b85e78c38919a7bf0e566c136a9e
SHA1 90807319997e91dbbdc028c5da0f3e16601bfc03
SHA512 665db3588a243f88773eb1828feee2bac135ed95f7fe211955166d7b63656f53ad10d5b15d706129027d01eb417c442f7e119cbdae4507ac39393970cba6ba34
TLSH
T14071AE05385B3A41459BA1A1C0BF8B61DF8017A99EDB2013B0224B7658462FF9F366BD
MD5 SHA1 SHA512 TLSH

Submit Download

vkl.exe

Path C:\Windows\vkl.exe
Size 249KB
SHA256 151d0125c20cdde578d02de3f2a56eb904870a887bb7f1c59bf61471da231916
MD5 f8e68d6abe411ce0c71d6b8c1c1b9048
SHA1 77360aa532c299f636f424a2866016ee6bd5c09b
SHA512 3e6c59395c8c5f07d39db829aa335420ffe426fb9a4ab831cfe1273e803afd5f91912ee341e01b4e108b298349bdeea9e7e52874b05fa1723ebc408be896b650
SSDEEP 3072:6DEKKwBWmSEoRooC7GvORoQYiY35e8w2XpFU4rwOe+ZbZEFf02RFivFuv4GuhK:UHK2W0u1tvORstRXfM102bicw4
TLSH
T103446A01A7EC4615F6FF1A78B8B015158B76F867E866E35E388C61AC1F73740EA60363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-339-0x000001D3007F0000-0x000001D300D18000-memory.dmp

Download

memory/1148-320-0x000001D37FDE0000-0x000001D37FFA2000-memory.dmp

Download

memory/1148-319-0x000001D3656B0000-0x000001D3656C8000-memory.dmp

Download

memory/1956-87-0x0000023095DA0000-0x0000023095DD9000-memory.dmp

Download

memory/1956-84-0x0000023095D60000-0x0000023095D93000-memory.dmp

Download

memory/2380-40-0x0000000005800000-0x0000000005892000-memory.dmp

Download

memory/2380-340-0x0000000005A60000-0x0000000005A68000-memory.dmp

Download

memory/2380-38-0x0000000073500000-0x0000000073CBC000-memory.dmp

Download

memory/2380-341-0x0000000005C90000-0x0000000005C9A000-memory.dmp

Download

memory/2380-344-0x0000000007530000-0x00000000075A0000-memory.dmp

Download

memory/2380-72-0x0000000005A40000-0x0000000005A58000-memory.dmp

Download

memory/2380-345-0x0000000007380000-0x000000000741C000-memory.dmp

Download

memory/2380-36-0x0000000005D20000-0x00000000062DA000-memory.dmp

Download

memory/2380-323-0x0000000073500000-0x0000000073CBC000-memory.dmp

Download

memory/2380-44-0x0000000005760000-0x000000000576A000-memory.dmp

Download

memory/2380-42-0x0000000073500000-0x0000000073CBC000-memory.dmp

Download

memory/2380-360-0x0000000073500000-0x0000000073CBC000-memory.dmp

Download

memory/2380-34-0x0000000000CA0000-0x0000000000D4E000-memory.dmp

Download

memory/2520-324-0x0000000002970000-0x000000000297E000-memory.dmp

Download

memory/2520-329-0x0000000002990000-0x000000000299E000-memory.dmp

Download

memory/2520-309-0x0000000000850000-0x0000000000858000-memory.dmp

Download

memory/2520-310-0x000000001B4E0000-0x000000001B5B8000-memory.dmp

Download

memory/2520-330-0x00000000029C0000-0x00000000029CC000-memory.dmp

Download

memory/2520-327-0x00000000029E0000-0x00000000029F8000-memory.dmp

Download

memory/2520-326-0x0000000002A30000-0x0000000002A80000-memory.dmp

Download

memory/2520-328-0x0000000002980000-0x000000000298C000-memory.dmp

Download

memory/2520-325-0x00000000029A0000-0x00000000029BC000-memory.dmp

Download

memory/3092-429-0x00000214A4560000-0x00000214A4612000-memory.dmp

Download

memory/3092-428-0x00000214A42B0000-0x00000214A42CE000-memory.dmp

Download

memory/3092-439-0x00000214A4290000-0x00000214A429A000-memory.dmp

Download

memory/3524-387-0x000001D0A22A0000-0x000001D0A22C2000-memory.dmp

Download

memory/3600-367-0x0000000004BD0000-0x0000000004BEA000-memory.dmp

Download

memory/3600-366-0x00000000003B0000-0x00000000003F0000-memory.dmp

Download

memory/3600-368-0x0000000004D80000-0x0000000004EDA000-memory.dmp

Download

memory/4376-306-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4376-308-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4996-60-0x0000000004FE0000-0x000000000562A000-memory.dmp

Download

memory/4996-71-0x00000000056A0000-0x0000000005706000-memory.dmp

Download

memory/4996-58-0x0000000002710000-0x0000000002746000-memory.dmp

Download

memory/4996-70-0x0000000005630000-0x0000000005696000-memory.dmp

Download

memory/4996-66-0x0000000004E40000-0x0000000004E62000-memory.dmp

Download

memory/4996-73-0x00000000058F0000-0x0000000005C4B000-memory.dmp

Download

memory/4996-82-0x0000000005890000-0x00000000058AE000-memory.dmp

Download

memory/5128-351-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5128-352-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5312-380-0x0000000008110000-0x000000000878C000-memory.dmp

Download

memory/5312-423-0x0000000007B30000-0x0000000007B3A000-memory.dmp

Download

memory/5312-370-0x0000000006CA0000-0x0000000006CD6000-memory.dmp

Download

memory/5312-371-0x0000000070030000-0x000000007007C000-memory.dmp

Download

memory/5312-375-0x0000000006C80000-0x0000000006CA0000-memory.dmp

Download

memory/5312-377-0x00000000079E0000-0x0000000007A83000-memory.dmp

Download

memory/5312-432-0x0000000007DA0000-0x0000000007E36000-memory.dmp

Download

memory/5312-348-0x0000000006240000-0x000000000659B000-memory.dmp

Download

memory/5312-381-0x0000000007AB0000-0x0000000007ACA000-memory.dmp

Download

memory/5672-41-0x0000000004DA0000-0x0000000004DDC000-memory.dmp

Download

memory/5672-54-0x0000000005020000-0x000000000512A000-memory.dmp

Download

memory/5672-39-0x0000000004D40000-0x0000000004D52000-memory.dmp

Download

memory/5672-43-0x0000000004DE0000-0x0000000004E2C000-memory.dmp

Download

memory/5672-331-0x0000000073500000-0x0000000073CBC000-memory.dmp

Download

memory/5672-52-0x0000000073500000-0x0000000073CBC000-memory.dmp

Download

memory/5672-322-0x0000000073512000-0x0000000073513000-memory.dmp

Download

memory/5672-37-0x0000000005360000-0x0000000005978000-memory.dmp

Download

memory/5672-33-0x0000000000360000-0x000000000037E000-memory.dmp

Download

memory/5672-24-0x0000000073512000-0x0000000073513000-memory.dmp

Download

memory/7176-462-0x00000000000D0000-0x0000000000112000-memory.dmp

Download

memory/7496-494-0x0000020032C30000-0x0000020032CB8000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads