3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Size 4.4MB
Sample260910-p2djcatekf
SHA256 3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f
MD5 d7abcfb0f2bfa298cf1c192788c0351f
SHA1 f00a2b8cde1623c4f1dcbbad5dd9030291770534
SHA512 769d44dbe21d7f352376f76b33faacdd95d36ad966a48042226599aa2e1d01a8d2b6c354cd36a26b435a63c4aa0dc4c08bbc543976f9b7ffbe12b7e4a8a144e9
SSDEEP 98304:8cakcibiqh9zEdfTbl9PRcakcibiqhMbMgOn7n0bcakcibiqh7Y2vj38yuvBfuvC:8dlirnzE9TPPRdlirybMgOnkdlirpvjY
TLSH
T19526CF53F210D7A3C0CD36359CEBFA1186B9BD2A4B35172236893B1D3AB3268475B197
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware trojan upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1860	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe

Executes dropped EXE 3 IoCs

pid	Process
1860	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
2272	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
648	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	pastebin.com

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000400000-0x000000000065C000-memory.dmp	upx
behavioral1/files/0x000500000001690d-14.dat	upx
behavioral1/memory/1860-15-0x0000000000400000-0x000000000065C000-memory.dmp	upx
behavioral1/files/0x000b00000002441c-50.dat	upx
behavioral1/memory/648-52-0x0000000000400000-0x000000000065C000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
936	cmd.exe
2660	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 4 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da65c00000001000000040000000010000020000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe

Program crash 32 IoCs

pid	pid_target	Process	procid_target
1740	1860	WerFault.exe	86
3628	1860	WerFault.exe	86
4568	1860	WerFault.exe	86
2240	1860	WerFault.exe	86
116	1860	WerFault.exe	86
3276	1860	WerFault.exe	86
1520	1860	WerFault.exe	86
1748	1860	WerFault.exe	86
2764	1860	WerFault.exe	86
4276	1860	WerFault.exe	86
3716	1860	WerFault.exe	86
3996	1860	WerFault.exe	86
2556	1860	WerFault.exe	86
3828	1860	WerFault.exe	86
2588	1860	WerFault.exe	86
3748	1860	WerFault.exe	86
4268	1860	WerFault.exe	86
1672	1860	WerFault.exe	86
1908	1860	WerFault.exe	86
1528	1860	WerFault.exe	86
2800	1860	WerFault.exe	86
116	1860	WerFault.exe	86
3024	1860	WerFault.exe	86
1516	1860	WerFault.exe	86
1748	1860	WerFault.exe	86
4708	1860	WerFault.exe	86
2864	1860	WerFault.exe	86
1760	1860	WerFault.exe	86
2076	1860	WerFault.exe	86
2804	1860	WerFault.exe	86
4024	1860	WerFault.exe	86
5096	1860	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies system certificate store 2 TTPs 10 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\F37620FC4B1CDDD2A3D74B1D5E8DB42E244CA006	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\F37620FC4B1CDDD2A3D74B1D5E8DB42E244CA006\Blob = 030000000100000014000000f37620fc4b1cddd2a3d74b1d5e8db42e244ca006140000000100000014000000a3c8265a8ea14cd03563fc9b23c83aae56f34f56040000000100000010000000cddedecf5a284a1b68b3b6bd500526590f000000010000003000000022e147cf9e4b2d707e4aef8ebedb73cc1dee0568c85323cf39e428e950c5c127c377032a66b82d5a15dea766bd553f7c190000000100000010000000e0314edf57bfac4fe679c0c34e46b3675c00000001000000040000008001000018000000010000001000000070d4f0bec2078234214bd651643b02402000000001000000aa020000308202a63082022ba003020102021100872165fc34b6e5fba8add5b3705fb53a300a06082a8648ce3d040303304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205832301e170d3236303531333030303030305a170d3332303930323233353935395a302e310b3009060355040613025553310d300b060355040a1304495352473110300e06035504031307526f6f742059453076301006072a8648ce3d020106052b81040022036200043c12ffabe1adc56a71b068fb081d2377f09fdc7b0cd249398fe54ceb62d2f930b9137ced18448531f5ec4ed7c858d6b0f62120fb7fc333aac537766fee1924dcbd203d38632c05f54e736ac0d5c8648d12b54db73f2e4868798b35bcee3efb19a381eb3081e8300e0603551d0f0101ff04040302010630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff301d0603551d0e04160414a3c8265a8ea14cd03563fc9b23c83aae56f34f56301f0603551d230418301680147c4296aede4b483bfa92f89e8ccf6d8ba9723795303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78322e692e6c656e63722e6f72672f30130603551d20040c300a3008060667810c01020130270603551d1f0420301e301ca01aa0188616687474703a2f2f78322e632e6c656e63722e6f72672f300a06082a8648ce3d0403030369003066023100c535f560ad9b154d0fc50705946899ae3d67b8cfb3ae0399ad1e4eed4e0a155b07fd89ec65779ef60a031e78ba4d46f5023100ed2688b549bbc3cb3625d75e4884fe0b0adc24d14c5fda7a8e1b317e36670e3472c454e800b6ea1496d7f21669ab3a76	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\3C34E356C7FC17F5ACF04824BC587C6C623951A2	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\3C34E356C7FC17F5ACF04824BC587C6C623951A2\Blob = 0300000001000000140000003c34e356c7fc17f5acf04824bc587c6c623951a21400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba97237950400000001000000100000005292fa0079c5afae289c2d2141236e040f00000001000000200000008c5033973ffe4ff1ef0aa92984fc93281ba7a9278ef8bf641226b898d10d4e7419000000010000001000000070d4f0bec2078234214bd651643b02405c0000000100000004000000800100001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000740400003082047030820258a00302010202106c8f1dc727c7117f7baf853ac980f9cd300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3236303531333030303030305a170d3332303930323233353935395a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381f53081f2300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30130603551d20040c300a3008060667810c01020130270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f300d06092a864886f70d01010b050003820201003dbf7bd7eb98cc4da42574dea5077a083e315db0cfdeb8e18a1776ab47f11c9661c04eef17e38c6117754d5efe8d0e904162ca7502392224fef2cba3bb6dcfa08f01e36559f0b45cd92819e5a02ba8e35efa3305a1ae187e67d147e8b2131e593b9446a34de46d34b125c34c1ae9a76fa682f7594236fc2b5d5360c036e5003e60735f6c810bd019e2021292da0b272634b3add64b23e119ed2132a9d476ae48ddd4abad2c353e9f74c5cb18e7899546babe1896130fde663f755f7922bb809248ce6627abea11817448195d7bda0b3f6ef6254469db0813be690062fca07579bf17404438a8b51a6e97520dfd4670cc06eb7d415cc351e401c603fe69597e743689e085d8c4bb8f7561bfb24f0caa78e5f9b2926cd8352aee9915b4ba914528304ea05ee1b0e6fba0bc874be51fb7a8ce51f3aba208fc614c77f2129bd8adb4af8d8e82c49d0ddc5d79859c312dd26fa9b025e499118c49da06979c348f68a861acd918c258f2550cabe0dabe304272b573539c7a9a01cacdc19955a5c24bd4a06732b3233fb79a9ef5302f71588f7705d7b8ed6e82edee02e88b8fb6ad6645be7fb0e788e677f148ba1859704694ff0bd4e8150d32d715aae5461e9ee2b50783b61e63f972f78f8589d92001c33525e8e798760a48b7f21365afa94d3d2643faf95f203830402269b9fb5c98ef08446517675c9f6c2a270f82ade4e4910d91	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\3C34E356C7FC17F5ACF04824BC587C6C623951A2\Blob = 0300000001000000140000003c34e356c7fc17f5acf04824bc587c6c623951a21400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba97237950400000001000000100000005292fa0079c5afae289c2d2141236e040f00000001000000200000008c5033973ffe4ff1ef0aa92984fc93281ba7a9278ef8bf641226b898d10d4e7419000000010000001000000070d4f0bec2078234214bd651643b02405c0000000100000004000000800100001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000740400003082047030820258a00302010202106c8f1dc727c7117f7baf853ac980f9cd300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3236303531333030303030305a170d3332303930323233353935395a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381f53081f2300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30130603551d20040c300a3008060667810c01020130270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f300d06092a864886f70d01010b050003820201003dbf7bd7eb98cc4da42574dea5077a083e315db0cfdeb8e18a1776ab47f11c9661c04eef17e38c6117754d5efe8d0e904162ca7502392224fef2cba3bb6dcfa08f01e36559f0b45cd92819e5a02ba8e35efa3305a1ae187e67d147e8b2131e593b9446a34de46d34b125c34c1ae9a76fa682f7594236fc2b5d5360c036e5003e60735f6c810bd019e2021292da0b272634b3add64b23e119ed2132a9d476ae48ddd4abad2c353e9f74c5cb18e7899546babe1896130fde663f755f7922bb809248ce6627abea11817448195d7bda0b3f6ef6254469db0813be690062fca07579bf17404438a8b51a6e97520dfd4670cc06eb7d415cc351e401c603fe69597e743689e085d8c4bb8f7561bfb24f0caa78e5f9b2926cd8352aee9915b4ba914528304ea05ee1b0e6fba0bc874be51fb7a8ce51f3aba208fc614c77f2129bd8adb4af8d8e82c49d0ddc5d79859c312dd26fa9b025e499118c49da06979c348f68a861acd918c258f2550cabe0dabe304272b573539c7a9a01cacdc19955a5c24bd4a06732b3233fb79a9ef5302f71588f7705d7b8ed6e82edee02e88b8fb6ad6645be7fb0e788e677f148ba1859704694ff0bd4e8150d32d715aae5461e9ee2b50783b61e63f972f78f8589d92001c33525e8e798760a48b7f21365afa94d3d2643faf95f203830402269b9fb5c98ef08446517675c9f6c2a270f82ade4e4910d91	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\F37620FC4B1CDDD2A3D74B1D5E8DB42E244CA006	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\F37620FC4B1CDDD2A3D74B1D5E8DB42E244CA006\Blob = 030000000100000014000000f37620fc4b1cddd2a3d74b1d5e8db42e244ca006140000000100000014000000a3c8265a8ea14cd03563fc9b23c83aae56f34f56040000000100000010000000cddedecf5a284a1b68b3b6bd500526590f000000010000003000000022e147cf9e4b2d707e4aef8ebedb73cc1dee0568c85323cf39e428e950c5c127c377032a66b82d5a15dea766bd553f7c190000000100000010000000e0314edf57bfac4fe679c0c34e46b3675c00000001000000040000008001000018000000010000001000000070d4f0bec2078234214bd651643b02402000000001000000aa020000308202a63082022ba003020102021100872165fc34b6e5fba8add5b3705fb53a300a06082a8648ce3d040303304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205832301e170d3236303531333030303030305a170d3332303930323233353935395a302e310b3009060355040613025553310d300b060355040a1304495352473110300e06035504031307526f6f742059453076301006072a8648ce3d020106052b81040022036200043c12ffabe1adc56a71b068fb081d2377f09fdc7b0cd249398fe54ceb62d2f930b9137ced18448531f5ec4ed7c858d6b0f62120fb7fc333aac537766fee1924dcbd203d38632c05f54e736ac0d5c8648d12b54db73f2e4868798b35bcee3efb19a381eb3081e8300e0603551d0f0101ff04040302010630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff301d0603551d0e04160414a3c8265a8ea14cd03563fc9b23c83aae56f34f56301f0603551d230418301680147c4296aede4b483bfa92f89e8ccf6d8ba9723795303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78322e692e6c656e63722e6f72672f30130603551d20040c300a3008060667810c01020130270603551d1f0420301e301ca01aa0188616687474703a2f2f78322e632e6c656e63722e6f72672f300a06082a8648ce3d0403030369003066023100c535f560ad9b154d0fc50705946899ae3d67b8cfb3ae0399ad1e4eed4e0a155b07fd89ec65779ef60a031e78ba4d46f5023100ed2688b549bbc3cb3625d75e4884fe0b0adc24d14c5fda7a8e1b317e36670e3472c454e800b6ea1496d7f21669ab3a76	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\3C34E356C7FC17F5ACF04824BC587C6C623951A2	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2932	schtasks.exe
3204	schtasks.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1976	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
1976	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
1860	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
2272	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
648	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1860	1976	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe	86
PID 1860 wrote to memory of 2932	1860	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe	87
PID 1860 wrote to memory of 936	1860	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe	89
PID 936 wrote to memory of 2176	936	cmd.exe	91
PID 2272 wrote to memory of 648	2272	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe	99
PID 648 wrote to memory of 3204	648	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe	104
PID 648 wrote to memory of 2660	648	3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe	107
PID 2660 wrote to memory of 2388	2660	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
"C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
  C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe" /TN udDryKr2caf8 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c schtasks.exe /Query /XML /TN udDryKr2caf8 > C:\Users\Admin\AppData\Local\Temp\1mTF1BJQ.xml
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Query /XML /TN udDryKr2caf8
      4⤵
      System Location Discovery: System Language Discovery
      PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 604
    3⤵
    - Program crash
    PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 628
    3⤵
    - Program crash
    PID:3628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 716
    3⤵
    - Program crash
    PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 720
    3⤵
    - Program crash
    PID:2240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 780
    3⤵
    - Program crash
    PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 824
    3⤵
    - Program crash
    PID:3276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1916
    3⤵
    - Program crash
    PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1272
    3⤵
    - Program crash
    PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2128
    3⤵
    - Program crash
    PID:2764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1952
    3⤵
    - Program crash
    PID:4276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2100
    3⤵
    - Program crash
    PID:3716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2184
    3⤵
    - Program crash
    PID:3996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2228
    3⤵
    - Program crash
    PID:2556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2244
    3⤵
    - Program crash
    PID:3828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2208
    3⤵
    - Program crash
    PID:2588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2236
    3⤵
    - Program crash
    PID:3748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2208
    3⤵
    - Program crash
    PID:4268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2232
    3⤵
    - Program crash
    PID:1672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2128
    3⤵
    - Program crash
    PID:1908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1940
    3⤵
    - Program crash
    PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2236
    3⤵
    - Program crash
    PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1964
    3⤵
    - Program crash
    PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1940
    3⤵
    - Program crash
    PID:3024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1876
    3⤵
    - Program crash
    PID:1516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1968
    3⤵
    - Program crash
    PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1964
    3⤵
    - Program crash
    PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1976
    3⤵
    - Program crash
    PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 896
    3⤵
    - Program crash
    PID:1760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 900
    3⤵
    - Program crash
    PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1936
    3⤵
    - Program crash
    PID:2804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2176
    3⤵
    - Program crash
    PID:4024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 712
    3⤵
    - Program crash
    PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1860 -ip 1860
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1860 -ip 1860
1⤵
PID:3980

C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
  C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe" /TN udDryKr2caf8 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3204
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c schtasks.exe /Query /XML /TN udDryKr2caf8 > C:\Users\Admin\AppData\Local\Temp\K92mnkJ6.xml
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Query /XML /TN udDryKr2caf8
      4⤵
      System Location Discovery: System Language Discovery
      PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1860 -ip 1860
1⤵
PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1860 -ip 1860
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1860 -ip 1860
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1860 -ip 1860
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1860 -ip 1860
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1860 -ip 1860
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1860 -ip 1860
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1860 -ip 1860
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1860 -ip 1860
1⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1860 -ip 1860
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1860 -ip 1860
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1860 -ip 1860
1⤵
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1860 -ip 1860
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1860 -ip 1860
1⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1860 -ip 1860
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1860 -ip 1860
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1860 -ip 1860
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1860 -ip 1860
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1860 -ip 1860
1⤵
PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1860 -ip 1860
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1860 -ip 1860
1⤵
PID:660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1860 -ip 1860
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1860 -ip 1860
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1860 -ip 1860
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1860 -ip 1860
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1860 -ip 1860
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1860 -ip 1860
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1860 -ip 1860
1⤵
PID:704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1860 -ip 1860
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1860 -ip 1860
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

4E3E4B05E877647EF3D7B912F256A94C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E3E4B05E877647EF3D7B912F256A94C
Size 1KB
SHA256 ee5f7abd6981bb0255632cd8f49283451b4b18844d12040b44ee00f07b8fe2c6
MD5 5292fa0079c5afae289c2d2141236e04
SHA1 3c34e356c7fc17f5acf04824bc587c6c623951a2
SHA512 12f1ff5586a6ca2cbc3a72dae998e4c7ed6483996c98121951ae64021d0228cbc230c4ab44916ede83fec3155b8e6b9a73019f86190082070b56496790dbd73a
TLSH
T1AC21B9D295249406EDC14C6754C9F4347EB1A64437C3625F006AC390BD503D9AD4E9BC
MD5 SHA1 SHA512 TLSH

Submit Download

7D588C464E3D4F9F1F5D043A1B7C9A7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D588C464E3D4F9F1F5D043A1B7C9A7E
Size 346B
SHA256 10a2124be16aac97db3cfe49b29c61a34b641a03af99197b663a1525bf943648
MD5 ed63fa93aeef643e4ad61814193a7108
SHA1 7972234900a03012691a839a17d6db0dd4b0a85f
SHA512 dd62b136ae5df12dbef0b24476860ca5f746d2d97e5e611c4fafc56fe113bc6af6e978c328d0f85f27bf0dd1edf6ea78992ebe49d2c27a8904763fa0a8e01596
TLSH
T11DE0C0D1E7382B6E17A0D550A5E5C4873CF509D9070FF0002610C2631596B84FD041CD
MD5 SHA1 SHA512 TLSH

Submit Download

83A04A389279F5B4D4D1B73336FA25B6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\83A04A389279F5B4D4D1B73336FA25B6
Size 309B
SHA256 669d7373359c1c3826c6ecab95876a943a00df66c20d7a2e1bf7c873dc2504c4
MD5 46f67f1743b2655192aaa2f706b85315
SHA1 fab86fe1b9b3a38f710c7eadd9b6309ea633dadf
SHA512 9699dafb3cd979e6979b8b364491a32560e8d844828240423bf27d466b0b03c6ab7c1ca57400d935af398813766c67b8ba947110eaf05b397b7c946b175361d8
TLSH
T149E07D8052AC7A8623F1F694B890E8831DB884CA591F70411F14C7360283BD0DA003C8
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

9840D2EA9A291B957CCF8D40A94DDAA4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9840D2EA9A291B957CCF8D40A94DDAA4
Size 58KB
SHA256 a3caaab26d7616a307b14c5a738d87b675f711617c3ca6f0ad436bffe6ce4fa2
MD5 eea14792290aab7ec395d2bd5137405b
SHA1 16b3e408618eaf19e76352b536af355055498da7
SHA512 3412afb69d591eae7f37873dac0adf1d606a7686decbf1ac7406840a8897d95adf3430455be658f29f9beecde680536f9cfda976cf9e30f76b343c835c2bf2e5
SSDEEP 768:ICDk725rUSdEYM7RRajZEosWqXyVbU80ZHLeuyiwFrDe+oCuSqXItXiGb5BEMF3K:IcoAncRawLeko4CPqXIxiGbXEMF3lM
TLSH
T1E0431BE45C7FF6A29D07CE2D8C9E899356F495C93952A22A4F306E405C1BA9FCF53083
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A5CA644CF96D23D2C006F5C03EC9EADD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A5CA644CF96D23D2C006F5C03EC9EADD
Size 308B
SHA256 ae14506e0a449685271ffcbb19ebf15e86839b2bacbd15e17f3a86b24a132bea
MD5 8740ba550f5dd75bcf8395c05f907766
SHA1 dca52d808f2334e733371df4d1076ed49d383bab
SHA512 e036422f4e3ec856a7cac3da3577db153cbaae23bfc5dc5ac05fe93a9465288de9a134cf78ceb2ee3f4c66484aac15ce1025140aa97f0a02ada6872ba22e28b4
TLSH
T1A2E07DD11178228607B0E580E8D4D4EB2C788487490DB1555B40C77201D2A99D6864CD
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

BDE28772A83DB7274166C9CC07B6A827

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BDE28772A83DB7274166C9CC07B6A827
Size 682B
SHA256 0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0
MD5 cddedecf5a284a1b68b3b6bd50052659
SHA1 f37620fc4b1cddd2a3d74b1d5e8db42e244ca006
SHA512 909875588e0b1928926a5fa0b7d51bb58d89a9bb33974aab7fece40baeef5edf3f41d3b323f2177dce6e1cd923f75981dd13e9e23eb3f69c2d5bf74c5f77c7a9
TLSH
T1B40188CB5C74100749B67EE271D0D0137CB488853BC332850087479F7481F40AE8113E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 833673e5afb44b61e14d3ae74ba6bab7f3afd8a1bbe264adfb438ef4ad4f0742
MD5 5f4f5891ca4b4fd541c283295e99da4d
SHA1 4224b8857177ff18d2fcbd555118f6e71646f8a2
SHA512 9ebf6fa77d105eb5b3e3b56c185b3c7ee1f09d8c2f622948722b9dc38086e178917c2e626e75c15da607d7b2bbd2785fedcea1972eb5e80c426ed241fbd536df
TLSH
T17BC08C1C9A620606F2E4437D12C12E039B20C420F2458F2217B92A18DD55F502D75C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 a82f88e60232b2a7042ee2418074ff2b61f9f7bf7b9b8199584115ae7f62d737
MD5 f64a5166beddbaef0f20db3581e9ba23
SHA1 a39b9d55fe9b11c8fd47306ceb169bb02cb6442d
SHA512 cd3df8eac4c92056063f34346b4e6bedf2e285f9227eefb1c87bf3be5aa00736bdd81c1bd2fe2be23342e5ddaa99843a12a66b90fc6ea252f872f0c7f2f9f732
TLSH
T1E5C08C1C7BA20A06E2F80BBE22D03A839A18D002F2828F1A163A2A4CDD14B541C34C1C
MD5 SHA1 SHA512 TLSH

Submit Download

4E3E4B05E877647EF3D7B912F256A94C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E3E4B05E877647EF3D7B912F256A94C
Size 192B
SHA256 00f8ee56bc8ced280313a3f3de96c9770c4311ac85a4ba13e63085f3046c080c
MD5 55184c47755e5593b0b530e4315a014b
SHA1 81f4178bc2baebb64179eff3af7cc5ae39ca9bda
SHA512 61a667a10961e69e911071ab657becb6dfd3f61245e04649115683652c4a7e304df409b456c6636319d4da0cf95047b060b110433f32f0f8b98dc9f99043d497
TLSH
T121C09B08DA514725F5D4477D1151B241C7505550E445CB2505F50708F5175046460D3A
MD5 SHA1 SHA512 TLSH

Submit Download

7D588C464E3D4F9F1F5D043A1B7C9A7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D588C464E3D4F9F1F5D043A1B7C9A7E
Size 192B
SHA256 efec4f59dccc6fea5a238bde8d40797e021b863bade9bd4e53a67bbc8106b37a
MD5 7a35ea1118378104616d3edf8aa72f50
SHA1 01711da2ece34d123bb1de6cbe493ed1586685ba
SHA512 88e5bb12484213522799b92e59aad003b937f8e7a979be87c125740fa55bdb348d111d5ba343e7d65e25591b841e98fff13d2ca957f2186f9910366a6f58a337
TLSH
T199C08C0072274104E118037E8EEBA6021BFAA21CA642C32B4B700225665EA00AC31F16
MD5 SHA1 SHA512 TLSH

Submit Download

83A04A389279F5B4D4D1B73336FA25B6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\83A04A389279F5B4D4D1B73336FA25B6
Size 192B
SHA256 487749753982bb9d4581f792f5a0b5363c20ba4954d18350463696874f035a08
MD5 13f2e15b9b0d68ae20072360e887a16b
SHA1 1a7e795799b543c01e506fad92c74ca4cdb3f0e7
SHA512 4af73e379f7104f15ff2ba701e77d4168752443408b039a53c2d4e21d9ed10db76805390a59d30d999169acd5a1d81d77c807748282d117076816efdc9c4107a
TLSH
T1A4C08C2433B1C109F150033D85A2E60286BAFA98C612C3191B785239521C6521C22D25
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 78797a48dc4154589b8fb9eb161e763786f68fb1de280932fa3c206df3f667c4
MD5 fc872d3c2a6f0ee8d07ed1c1059b1ad4
SHA1 34ef5ef3d6c55ec3ec823ca68d9ba0d393c499be
SHA512 fa06b02d46856ce7bd4f89439cbf712bd2519a8eaa1be96e27c2a988ba15f9275bb66e8aec002ae4ea12e91d67f31a795e4ef5be6ec34dbb1f8736c3efa63a5c
TLSH
T18AC02B8877300328F070193F485282804FFFC209D842C3700F301208C61CA020CB0C07
MD5 SHA1 SHA512 TLSH

Submit Download

9840D2EA9A291B957CCF8D40A94DDAA4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9840D2EA9A291B957CCF8D40A94DDAA4
Size 248B
SHA256 6433bef6eddf4f6ebd419400db54c7c4f08ce652b7a6cb9df6575597b7a1ca41
MD5 cb1e4f8f4531d4efbc79f364a6851cfd
SHA1 a0c3314e905017ff4c0b3584fb77f2a4a0e62b20
SHA512 1e849c807fe9466eb6ba277238907f612c7ec483d0b80c7b885253256dc47b74f27b2ed1df5fd5346b7e7b26ce6e9e3f107bfeb90583de50cae70afbaffd1ae5
TLSH
T11CD0C9787BE21236F16686B949E429456AA6680AE09B8A5E1AF613999818A402865C0C
MD5 SHA1 SHA512 TLSH

Submit Download

A5CA644CF96D23D2C006F5C03EC9EADD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A5CA644CF96D23D2C006F5C03EC9EADD
Size 192B
SHA256 01de99e8654f193393109e3488da84185b9c32db45a2f6e3528977b6d24069d7
MD5 b2d36f86e0455558086fe5e46abae0f5
SHA1 70fb2c723daceede54863e136fdbafed73454058
SHA512 6343ffd6710854361988ef8f194017205210b475ebc1d920f5bed0466d735aa4dc65ffda0ff642a042ef17c92d396d425999106f594ac7d615c4cfb536aa5989
TLSH
T187C08C0036674218E208023E2ED65A0307BFB2098701E31A2B782235A50D5C14C20D08
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 d35b84c1096991cc7542f1dd243f4ecd3c9d7380967f1856384c3f2ab7f7f5bf
MD5 1a56ec22db98b50117baa8d1a4281ad8
SHA1 2d688a10e42074220c94bd38a84ee18e32cf042d
SHA512 cc2bc6daaf29a8fca6cfdb535ff9c2d7628738fa9e3314b0ccb910461be1ed2013fdda7b42c13b76fdc8b1b1c948341c67774a8abfa4adb083e357f0796b5e4f
TLSH
T106C09B54B3A54715F24D513D79E5560417B55245F5D6C3144B741239D519A400871D05
MD5 SHA1 SHA512 TLSH

Submit Download

BDE28772A83DB7274166C9CC07B6A827

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BDE28772A83DB7274166C9CC07B6A827
Size 192B
SHA256 186d126e0cc041754bf25a01b18d489da5ae7ddaeecf8d759a6bea6db0cbb1d0
MD5 c88a42908a0f3d62338b9d413f4d3a9b
SHA1 640d08a42d9b3ce62bfa23ab374e3e8b0d936a0f
SHA512 8214c25305edf4e3f4529a4d4f889cebf7f5850ef7f76392aae04e5c87a991c384b14d94c168c4618f66a0ffbdf6490fa956d96f7d9b5de77fa6a3d483a7d4b3
TLSH
T1F2C09B086A514215F2D657F951D16641C754A511F6C48F6515B51708D5166042470D55
MD5 SHA1 SHA512 TLSH

Submit Download

1mTF1BJQ.xml

Path C:\Users\Admin\AppData\Local\Temp\1mTF1BJQ.xml
Size 1KB
SHA256 8aa6c08970e797b479744fcba0c9905ae8e5d95231b66a82f33c275b0ec78d2f
MD5 ef49d2be916e91a9f3cce873d300fa66
SHA1 9b2f47f59dce10dac1ad35fd7137e40ca86225af
SHA512 773c97e885c22fa84efecfc20f11709496d5117d67f7e4c58a86b26819d5388955ec0909ce41387fb4920f864a3a1d55b392e1444598328ae2e163295107f7c1
TLSH
T126211148D883E90F7437163E67514342DE77679785857538F48C863C2FB684F1187026
MD5 SHA1 SHA512 TLSH

Submit Download

3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe

Path C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Size 4.4MB
SHA256 7a6f6015eaf4414e8495b39ee0efdb3eb79602f940cc4462ff07d05f5ed1ec85
MD5 adba7e9297f88664d05cfc59674e74d5
SHA1 f1fa56b53390741f7818fed2ecdfa28970e9e9b8
SHA512 dd5feacb53b87b60a191b3d437a97eb88b5e8d84e46dee5b0cb6633cc36e7a76b9f399ac9971d01a8df9fe537fadfa3f1f3ff3f1e5dcb4dbc224aad924e78b9f
SSDEEP 98304:N+B6NKT89gzEdfTbl9PRcakcibiqhMbMgOn7n0bcakcibiqh7Y2vj38yuvBfuv2l:cB6NtGzE9TPPRdlirybMgOnkdlirpvjY
TLSH
T11D26D053F210D7A3C0CD36399CEBFA0186B9BD2A4B35172236893B1D3AB3264475B597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe

Path C:\Users\Admin\AppData\Local\Temp\3422b4fb9b3e23693eec856b07a3afc4e63fc3916e511963dda650551292756f.exe
Size 4.4MB
SHA256 77028131f299dbc0db487fc22847db68ea9316760edcce912ecb97d31ee73b5a
MD5 a814c8ebc2924bc65af9e90a3cac98fb
SHA1 b138a4d7a4d5e894c95c6759dcf0bb22311fdd94
SHA512 9344c16e81ccf602388a005a422667f4bc9f1c66d929976562ed9f0710ea92999f51c7f1b9a4afd58137fb944a0827f49bb467094474f55140c85ea2415200c2
SSDEEP 98304:9h3P1iOqyzEdfTbl9PRcakcibiqhMbMgOn7n0bcakcibiqh7Y2vj38yuvBfuv21j:9FP1VzE9TPPRdlirybMgOnkdlirpvj3o
TLSH
T12826C053F210DBA3C0CD36359CEBFA1186B9BD2A4B35172236893B1D3AB3264475B197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

K92mnkJ6.xml

Path C:\Users\Admin\AppData\Local\Temp\K92mnkJ6.xml
Size 1KB
SHA256 175277bf84a6af229c9e7a962e12b1b7f2b29c95c7826e2d5c7f64da52c7f632
MD5 812bcf9dd3a4804b7e5b304ec7ffc5ca
SHA1 928177f35bfcd8dd1ca997096e9bbcb03b9792e6
SHA512 621c3949759d80682ae04a9c6bb800358a4773b181f91ef2acf0ebb0aa1178c44e42a34451da357cf5cd492b074aa1af64160842e24fb11a15f80cdd708c3c27
TLSH
T157211148D883E90F7437163E67514342DE77679785857538F48C863C2FB684F1187026
MD5 SHA1 SHA512 TLSH

Submit Download

memory/648-85-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/648-69-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/648-60-0x00000000018F0000-0x000000000196E000-memory.dmp

Download

memory/648-61-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/648-62-0x0000000000470000-0x00000000004DB000-memory.dmp

Download

memory/648-52-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/648-83-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/648-84-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/1860-26-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1860-23-0x00000000018D0000-0x000000000194E000-memory.dmp

Download

memory/1860-68-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1860-59-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/1860-48-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/1860-15-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/1860-31-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1860-24-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/1860-25-0x0000000000470000-0x00000000004DB000-memory.dmp

Download

memory/1976-7-0x0000000001720000-0x000000000179E000-memory.dmp

Download

memory/1976-1-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/1976-0-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/1976-16-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/1976-8-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/2272-51-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/2272-46-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/2272-44-0x0000000000400000-0x000000000046B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads