7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af

Analysis

user interaction
yes
max time kernel
45s
max time network
71s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac_3.0.9_x64_en-US.msi
Size 14.4MB
Sample260828-sethtsbk9t
SHA256 7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af
MD5 2b940d52c3090f57c5cb6065884792f8
SHA1 d33dacf38d0ef6de6af065e73e91806ee384da72
SHA512 dcb767833910252fe75546d370215dd15da9d0066be728db14592ab431612a42ae129b861529831fb1ea244aa3dc54e0c3e8ec049d6395b86436b6cb20ee24e7
SSDEEP 393216:hc6EI0Zn4/BgpsCIPRKeow3ujYOqXgTzkRNcIqP:+K0ZsqpEPweoTjYmkRKI
TLSH
T152E6330B7C859F20C8261D3786B7DB28076DBD206616F6633299B469FFF17C099328D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3312	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3380	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3380	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3380	msiexec.exe
Token: SeSecurityPrivilege	5984	msiexec.exe
Token: SeCreateTokenPrivilege	3380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3380	msiexec.exe
Token: SeLockMemoryPrivilege	3380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3380	msiexec.exe
Token: SeMachineAccountPrivilege	3380	msiexec.exe
Token: SeTcbPrivilege	3380	msiexec.exe
Token: SeSecurityPrivilege	3380	msiexec.exe
Token: SeTakeOwnershipPrivilege	3380	msiexec.exe
Token: SeLoadDriverPrivilege	3380	msiexec.exe
Token: SeSystemProfilePrivilege	3380	msiexec.exe
Token: SeSystemtimePrivilege	3380	msiexec.exe
Token: SeProfSingleProcessPrivilege	3380	msiexec.exe
Token: SeIncBasePriorityPrivilege	3380	msiexec.exe
Token: SeCreatePagefilePrivilege	3380	msiexec.exe
Token: SeCreatePermanentPrivilege	3380	msiexec.exe
Token: SeBackupPrivilege	3380	msiexec.exe
Token: SeRestorePrivilege	3380	msiexec.exe
Token: SeShutdownPrivilege	3380	msiexec.exe
Token: SeDebugPrivilege	3380	msiexec.exe
Token: SeAuditPrivilege	3380	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3380	msiexec.exe
Token: SeChangeNotifyPrivilege	3380	msiexec.exe
Token: SeRemoteShutdownPrivilege	3380	msiexec.exe
Token: SeUndockPrivilege	3380	msiexec.exe
Token: SeSyncAgentPrivilege	3380	msiexec.exe
Token: SeEnableDelegationPrivilege	3380	msiexec.exe
Token: SeManageVolumePrivilege	3380	msiexec.exe
Token: SeImpersonatePrivilege	3380	msiexec.exe
Token: SeCreateGlobalPrivilege	3380	msiexec.exe
Token: SeCreateTokenPrivilege	3380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3380	msiexec.exe
Token: SeLockMemoryPrivilege	3380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3380	msiexec.exe
Token: SeMachineAccountPrivilege	3380	msiexec.exe
Token: SeTcbPrivilege	3380	msiexec.exe
Token: SeSecurityPrivilege	3380	msiexec.exe
Token: SeTakeOwnershipPrivilege	3380	msiexec.exe
Token: SeLoadDriverPrivilege	3380	msiexec.exe
Token: SeSystemProfilePrivilege	3380	msiexec.exe
Token: SeSystemtimePrivilege	3380	msiexec.exe
Token: SeProfSingleProcessPrivilege	3380	msiexec.exe
Token: SeIncBasePriorityPrivilege	3380	msiexec.exe
Token: SeCreatePagefilePrivilege	3380	msiexec.exe
Token: SeCreatePermanentPrivilege	3380	msiexec.exe
Token: SeBackupPrivilege	3380	msiexec.exe
Token: SeRestorePrivilege	3380	msiexec.exe
Token: SeShutdownPrivilege	3380	msiexec.exe
Token: SeDebugPrivilege	3380	msiexec.exe
Token: SeAuditPrivilege	3380	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3380	msiexec.exe
Token: SeChangeNotifyPrivilege	3380	msiexec.exe
Token: SeRemoteShutdownPrivilege	3380	msiexec.exe
Token: SeUndockPrivilege	3380	msiexec.exe
Token: SeSyncAgentPrivilege	3380	msiexec.exe
Token: SeEnableDelegationPrivilege	3380	msiexec.exe
Token: SeManageVolumePrivilege	3380	msiexec.exe
Token: SeImpersonatePrivilege	3380	msiexec.exe
Token: SeCreateGlobalPrivilege	3380	msiexec.exe
Token: SeCreateTokenPrivilege	3380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3380	msiexec.exe
Token: SeLockMemoryPrivilege	3380	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3380	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3380	msiexec.exe
5984	msiexec.exe
3312	MsiExec.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5984 wrote to memory of 3312	5984	msiexec.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.9_x64_en-US.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3380
- C:\Program Files\Retrac\retrac.exe
  "C:\Program Files\Retrac\retrac.exe"
  2⤵
  PID:2876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2876.2732.10473004791044018909 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
    3⤵
    PID:4612
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffc29085fd8,0x7ffc29085fe4,0x7ffc29085ff0
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1812 --field-trial-handle=1816,i,9634598028055435456,9064635471481840849,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2156 --field-trial-handle=1816,i,9634598028055435456,9064635471481840849,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:1736
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1816,i,9634598028055435456,9064635471481840849,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3340 --field-trial-handle=1816,i,9634598028055435456,9064635471481840849,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:1
      4⤵
      PID:2964

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DA3668E96B26475F22ADD7500CAEE85C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3312
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a162a.rbs

Path C:\Config.Msi\e5a162a.rbs
Size 10KB
SHA256 10f8a632698c7b92709cac2fdd5933ecfa441e496eb9531d6804e1d07906a54d
MD5 850e6fb313e619f9a3e187adef0ccf73
SHA1 ae059b7300a3d9d99143d1ecbee2af55a9a8c034
SHA512 b0b8864bc4761f915fa263f3bb2c65af7c5a4cf69662dfbe5614fae23a77666116a92260457b15b947b6b9fa19d6aad3a4e636a74f0774e784a765ce4e7fa5c0
SSDEEP 96:tmTTxf79CR9R9hxm9N9A7px4BhC7MqQUm64r4COTl2TUm64r4CgjjW7vhjTl2sjK:whZ47DMHZCjvKPG7KPuuzoX3WOiigpBY
TLSH
T1D622EE42F70185D2E8835B38C7072B213F67D6848358634B07CDE838EE57BC66BA959A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

retrac.exe

Path C:\Program Files\Retrac\retrac.exe
Size 26.0MB
SHA256 8e659b326afa58276d95ae143af18786f3c47f9e45fa9f4bc9afdfcd10f99aef
MD5 274a0ba53a9c1bf4af8843978c680dd5
SHA1 b3006ef8c220ffa04308b4d58a8415c2b41e2d08
SHA512 3fccdcc36f31e161e19dcec092d2a8b9962e0cdbc94131d72548f396e4256043739574434ac0a4eb81743a926562d1e068e755d164c8bf0b905b197fdf9d31bf
SSDEEP 393216:+9hw3R8Vay7mii8lYMXKOsPAdaB+ld9qOwcB2U5:+9hr8y7NlIpPetxrp
TLSH
T17C575A207B9AA96CD19AC474834B4A725A7130DB1F35B9FF448492393F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrac.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
Size 1KB
SHA256 866bb9951977151cbf5501e2eb305d9aa432a00e76af8c57095775deecbcf458
MD5 65c06d17dc972aa2ab5f87a3eaec8b10
SHA1 47d9f7a4a273ee7e850898c1ca875429bc6347cd
SHA512 e3a20b28e0517468db0389198cad74427fb2338be002c1ddb08574c22317784190579baaa0ab57ea6dd5a001ff8be22268c5e6a0696aa87b1a27b99251b549b7
TLSH
T1F841E0449BD5131EF373463A2EB90A328B36FC13E525CF2F41D9008A0978900A96CF3A
MD5 SHA1 SHA512 TLSH

Submit Download

Retrac.lnk~RFe5a1f03.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe5a1f03.TMP
Size 1KB
SHA256 fbb2c35cf94beb260df4de6c16953a19a9a6d20b721a9ed653e458745960ae82
MD5 362273e8925d4b3b6350cc690b93440b
SHA1 1f951affdae2bdae668b2544c4f222403922a94b
SHA512 aead9b1a5e2328e9f012f016ba0534c87ee9307ee2c5d7020b1e98aaf9fed11737a7c2ca944e643cd4f9f8096be8a71f6d67e590d77d6c92bdad0fff9585468c
TLSH
T1B441C1445BE5071FE373863A2EBA4A31CB36FC02D5258F2F41DA008A0978940A96CF3B
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5D0A.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5D0A.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3b5a179d153196b6d25a8e9ad5b1258b1673afa4540f05ddb3d16b0532e8261b
MD5 3ff1ec3ff001731e79519f5b602e5531
SHA1 dbd396f88f8b0f094ecdec8dc63bb9b40c7ad1cc
SHA512 b3d505c5c3cb6969a6a4c3244cf53110222db694bc9a180453f3d6c093f2d4547aaa58d12c131b8f328fa19e6c7f9b1715feb1b107d81de6ad9941094f80a335
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1484b30df58802f2bda7aad279ad2c222a7dfcc774eaa683ce1d49dd5e0259d5
MD5 227489078734d403c26547479d439f53
SHA1 799b16891e7d56bf617bec88b577216250eb97fe
SHA512 309ea085771a0b5431e6f4ab9886042ba7a27a841bea90cffe3d8f41aa1a4ba2fc4aa74ce145403823c0be3444ad32cf3566666c5b794f257b14e29277600c0d
TLSH
T184D024777341413CC41030731007710D0411C70FC005C000F43CC53D1F140700D43C41
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 2KB
SHA256 98923de7212b73dd315d2bbcaedb4cfa17551d5450dc89ca347c057145e0fcd5
MD5 8a05cdb581fbcdf65fe550055eaec0e0
SHA1 5b5fbbe55e21cd6cbd5e45363d3f5a826bc43cad
SHA512 cc996e7b627bfbddeaba8882210b3844fdb90c1617fc25004507a032c4a32aef35f50ffaecfb5038e13528c04ed3178fb2dea1aa947d6b64f17988437cb1f56d
TLSH
T1CF51A533AD64AA3BC9F35608B90A3E13DE76516295132F1087DC4B1C01E765C2742C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
Size 3KB
SHA256 3759cda079244783493a2d7ac7cec025ec78c7f7b786cafd51dbb0bd6bb136d0
MD5 d8782999929ecefbe533768e068ded2b
SHA1 6bc977444a3749d5dbe03bc8a62a36dea3268f95
SHA512 9676afa8063543cb804ae697c68b3ebfa167977b9b878b5bbff86cb11e8d64db4b32e0ebbbe83518917b6ad43e02354e3864ca868720ebd351c7b9fa8b961725
TLSH
T11E617537A974A92B8DF39A05B94A2B16F7A65123E5923F58C6EC0F0D01D739C1382C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a3f3d.TMP

Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe5a3f3d.TMP
Size 1KB
SHA256 2538528b5aac2a17995f0311b979dcbd93d4a26b261ed06ec9f5d1a59818df94
MD5 3578e656385684618bdb96c80a62f797
SHA1 21c256aa91ef01c41398e10c15c95dfa1f66ed07
SHA512 dcccb68898a37f97d4aff8fa7a30e788dd8a632db55331fb79e08280c80c4566279da16597bb24da6c9267000eb6f273b8a6b3d29cd6e0c2399c66dca12ff9d5
TLSH
T1D821B773E9E0A736EDB22256220A7E17EF72202781024F0097CDCB1D16E759C955BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

e5a1629.msi

Path C:\Windows\Installer\e5a1629.msi
Size 14.4MB
SHA256 7ef021039fcc397f9cf378e995c448c4312f1f0ea13d05020d6f55a7749d12af
MD5 2b940d52c3090f57c5cb6065884792f8
SHA1 d33dacf38d0ef6de6af065e73e91806ee384da72
SHA512 dcb767833910252fe75546d370215dd15da9d0066be728db14592ab431612a42ae129b861529831fb1ea244aa3dc54e0c3e8ec049d6395b86436b6cb20ee24e7
SSDEEP 393216:hc6EI0Zn4/BgpsCIPRKeow3ujYOqXgTzkRNcIqP:+K0ZsqpEPweoTjYmkRKI
TLSH
T152E6330B7C859F20C8261D3786B7DB28076DBD206616F6633299B469FFF17C099328D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 861b95cee0873fbe68574a5e5ee1055b14ef3ad93d428128e6364635f9f29d20
MD5 2a95ffb695d89342f470f2f4fff1d812
SHA1 93a7ffcff0151502d1cb7f1c1152c53f6b452148
SHA512 873f6a4c0e4fb53b1f8cadd8546f0b4cf2f8ecd59fe1ab1c73e2b62e469b7089596a8e744d5b72d81256e3c5258f9f38a0057b76de5f11c5c5dbcffd0ae2dc9c
SSDEEP 24576:WFo3DMPTdoO/vvTL/yQAQiFAvLeqrLXzU9WCtNuYm1ua5nxg8IhWwpKx0ue:cHM
TLSH
T1BC57A52476F92200E7B79E3CA8F06A238D397D579C15DE8D45421B4E0922F71E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7424cb0a-cfbc-4698-bb20-94ab2dcb7007}_OnDiskSnapshotProp

Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7424cb0a-cfbc-4698-bb20-94ab2dcb7007}_OnDiskSnapshotProp
Size 6KB
SHA256 c5be7a2717346b7c65ad3e0b1322be7f318aa5812e3a2b728fc2c966d0cda652
MD5 fd75a7d41460f08a4c8befbccc71c834
SHA1 20613800a0c95215ebf76f3dd931357edee70d43
SHA512 21e731087fb0e6a95839e401d6712b47c40a286b8f001d9c8eaf8a1b039b4d106c9e69cf269fe6b749f6dca6459f4e942964b28c5af15b8223915193c34f0ce0
SSDEEP 96:FX+07vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:dvb++uVm
TLSH
T153D187085AE54711E2B3AB3128F14557A877B911EF33CB8E0198238F6671A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2964-109-0x00007FFC4BD30000-0x00007FFC4BD31000-memory.dmp

Download

memory/6140-73-0x00007FFC4BD30000-0x00007FFC4BD31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads