Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 05:13
Static task
static1
1 signatures
windows10-2004-x64
23 signatures
150 seconds
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target [email protected]
- Size 6.1MB
- Sample260930-fwx65afd92
- SHA256 b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77
- MD5 04155ed507699b4e37532e8371192c0b
- SHA1 a14107131237dbb0df750e74281c462a2ea61016
- SHA512 6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371
- SSDEEP 98304:hvOOFJ+Z8eAgy7SH9s76RSvyqJOBgECfMfYv+85JH0DVczt8A:hvOOFJ+ggr9s76R+wcMAv+IHCczt8
- TLSH T152567C15BA409003E2737A76CDA352CD5819BE661D34542B26A43F4CBF70B83FA36B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest ISf27.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest ISf27.exe - Drops file in Drivers directory 14 IoCs
description ioc Process File opened for modification C:\Windows\System32\Drivers\etc\host_new [email protected] File created C:\Windows\system32\drivers\etc\host_new ISf27.exe File created C:\Windows\System32\Drivers\etc\hosts [email protected] File opened for modification C:\Windows\System32\Drivers\etc\hosts [email protected] File created C:\Windows\System32\Drivers\etc\hosts ISf27.exe File created C:\Windows\System32\Drivers\etc\hosts ISf27.exe File opened for modification C:\Windows\System32\Drivers\etc\hosts ISf27.exe File opened for modification C:\Windows\system32\drivers\etc\hosts ISf27.exe File created C:\Windows\system32\drivers\etc\host_new [email protected] File opened for modification C:\Windows\system32\drivers\etc\hosts [email protected] File created C:\Windows\system32\drivers\etc\host_new ISf27.exe File opened for modification C:\Windows\System32\Drivers\etc\hosts ISf27.exe File opened for modification C:\Windows\system32\drivers\etc\hosts ISf27.exe File opened for modification C:\Windows\system32\drivers\etc\host_new [email protected] - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsSvc.exe\Debugger = "svchost.exe" [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsGui.exe\Debugger = "svchost.exe" [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brastk.exe [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsGui.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secureveteran.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveArmor.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbn976rl.exe\Debugger = "svchost.exe" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe\Debugger = "svchost.exe" [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpdeluxe.exe [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gav.exe\Debugger = "svchost.exe" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\Debugger = "svchost.exe" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsGui.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustWarrior.exe\Debugger = "svchost.exe" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Save.exe ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard\Debugger = "svchost.exe" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP.exe\Debugger = "svchost.exe" [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityFighter.exe\Debugger = "svchost.exe" [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SafetyKeeper.exe\Debugger = "svchost.exe" [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard.exe [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\Debugger = "svchost.exe" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsTray.exe\Debugger = "svchost.exe" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secure Veteran.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qh.exe [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartprotector.exe\Debugger = "svchost.exe" [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg.exe\Debugger = "svchost.exe" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe\Debugger = "svchost.exe" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qh.exe ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ozn695m5.exe\Debugger = "svchost.exe" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PerAvir.exe\Debugger = "svchost.exe" [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csc.exe\Debugger = "svchost.exe" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbn976rl.exe [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winav.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init32.exe ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\homeav2010.exe\Debugger = "svchost.exe" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsSvc.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Save.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av360.exe\Debugger = "svchost.exe" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Save.exe [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard.exe ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brastk.exe\Debugger = "svchost.exe" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PerAvir.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartprotector.exe ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiVirus_Pro.exe\Debugger = "svchost.exe" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pdfndr.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\W3asbas.exe ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsSvc.exe ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywarexpguard.exe\Debugger = "svchost.exe" [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~2.exe\Debugger = "svchost.exe" [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe\Debugger = "svchost.exe" [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\Debugger = "svchost.exe" [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Anti-Virus Professional.exe ISf27.exe - Executes dropped EXE 2 IoCs
pid Process 4392 ISf27.exe 2988 ISf27.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\ProgramData\\a18bb\\ISf27.exe\" /s /d" [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]\" /s " [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\ProgramData\\a18bb\\ISf27.exe\" /s " [email protected] - Checks for any installed AV software in registry 1 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\ [email protected] Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\ [email protected] Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\ ISf27.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\ [email protected] Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\ ISf27.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\ ISf27.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\ [email protected] Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\ ISf27.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: [email protected] File opened (read-only) \??\Q: [email protected] File opened (read-only) \??\Q: ISf27.exe File opened (read-only) \??\T: ISf27.exe File opened (read-only) \??\Z: ISf27.exe File opened (read-only) \??\R: [email protected] File opened (read-only) \??\U: [email protected] File opened (read-only) \??\G: ISf27.exe File opened (read-only) \??\H: ISf27.exe File opened (read-only) \??\R: ISf27.exe File opened (read-only) \??\V: ISf27.exe File opened (read-only) \??\N: [email protected] \??\F:\ ISf27.exe File opened (read-only) \??\I: ISf27.exe File opened (read-only) \??\Y: ISf27.exe File opened (read-only) \??\P: [email protected] File opened (read-only) \??\R: [email protected] File opened (read-only) \??\Z: [email protected] File opened (read-only) \??\P: [email protected] File opened (read-only) \??\N: ISf27.exe File opened (read-only) \??\S: ISf27.exe File opened (read-only) \??\W: [email protected] File opened (read-only) \??\L: ISf27.exe File opened (read-only) \??\M: ISf27.exe File opened (read-only) \??\O: ISf27.exe File opened (read-only) \??\Q: ISf27.exe File opened (read-only) \??\D: [email protected] File opened (read-only) \??\G: ISf27.exe File opened (read-only) \??\L: ISf27.exe File opened (read-only) \??\M: ISf27.exe File opened (read-only) \??\R: ISf27.exe File opened (read-only) \??\U: [email protected] File opened (read-only) \??\O: ISf27.exe File opened (read-only) \??\K: [email protected] File opened (read-only) \??\P: ISf27.exe File opened (read-only) \??\I: [email protected] File opened (read-only) \??\X: [email protected] File opened (read-only) \??\G: [email protected] File opened (read-only) \??\H: [email protected] File opened (read-only) \??\K: [email protected] File opened (read-only) \??\L: [email protected] File opened (read-only) \??\D: ISf27.exe File opened (read-only) \??\Y: ISf27.exe \??\F:\ [email protected] File opened (read-only) \??\G: [email protected] File opened (read-only) \??\U: ISf27.exe File opened (read-only) \??\M: [email protected] File opened (read-only) \??\V: [email protected] File opened (read-only) \??\W: ISf27.exe File opened (read-only) \??\M: [email protected] \??\F:\ ISf27.exe File opened (read-only) \??\J: ISf27.exe File opened (read-only) \??\X: ISf27.exe File opened (read-only) \??\I: [email protected] File opened (read-only) \??\J: [email protected] File opened (read-only) \??\L: [email protected] File opened (read-only) \??\Z: [email protected] File opened (read-only) \??\D: ISf27.exe File opened (read-only) \??\J: ISf27.exe File opened (read-only) \??\U: ISf27.exe File opened (read-only) \??\J: [email protected] File opened (read-only) \??\S: [email protected] File opened (read-only) \??\T: [email protected] File opened (read-only) \??\K: ISf27.exe - Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 [email protected] File opened for modification \??\PhysicalDrive0 ISf27.exe File opened for modification \??\PhysicalDrive0 [email protected] File opened for modification \??\PhysicalDrive0 ISf27.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname [email protected] Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain [email protected] Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ISf27.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ISf27.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ISf27.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ISf27.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mofcomp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISf27.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISf27.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltTST = "18894" ISf27.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\IIL = "0" [email protected] Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltHI = "0" [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" [email protected] Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1" [email protected] Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltHI = "0" [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%" [email protected] Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltTST = "18852" [email protected] Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltHI = "0" ISf27.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltTST = "18867" ISf27.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltTST = "18868" [email protected] Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\IIL = "0" ISf27.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\IIL = "0" ISf27.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\IIL = "0" [email protected] Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\ltHI = "0" ISf27.exe - Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\ = "Implements DocHostUIHandler" [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISf27.DocHostUIHandler ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Classes\[email protected] [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\Clsid [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "[email protected]" [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32 ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISf27.DocHostUIHandler\ = "Implements DocHostUIHandler" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISf27.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\ProgramData\\a18bb\\ISf27.exe" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}" [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISf27.DocHostUIHandler ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\ProgramData\\a18bb\\ISf27.exe" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]" [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32 ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISf27.DocHostUIHandler\ = "Implements DocHostUIHandler" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "ISf27.DocHostUIHandler" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32 [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISf27.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}" ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "ISf27.DocHostUIHandler" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler" [email protected] Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISf27.DocHostUIHandler\Clsid ISf27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler" ISf27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISf27.DocHostUIHandler\Clsid ISf27.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 4668 mofcomp.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2408 [email protected] 2408 [email protected] - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2408 [email protected] 2408 [email protected] - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2408 [email protected] 2408 [email protected] - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2408 wrote to memory of 4668 2408 [email protected] 90 PID 2408 wrote to memory of 5788 2408 [email protected] 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Wbem\mofcomp.exemofcomp "C:\Users\Admin\AppData\Local\Temp\727.mof"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
-
C:\Windows\SysWOW64\netsh.exenetsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\[email protected]" "Internet Security Guard" ENABLE2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5788
-
-
C:\ProgramData\a18bb\ISf27.exe"C:\ProgramData\a18bb\ISf27.exe" /s /d1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:4392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /s1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:5476
-
C:\ProgramData\a18bb\ISf27.exe"C:\ProgramData\a18bb\ISf27.exe" /s1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:2988
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Peripheral Device Discovery
1Query Registry
3Software Discovery
2Security Software Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 cfc745b3ba7094351fb43da6784d16bd33936ab827be6338d45ecf94a000c9b3
- MD5 c2caed528a15fc321355738262228f6b
- SHA1 41698e8739d5af5762f9325f52745ce43e14e2ce
- SHA512 e4f929f9183c1684ceffe001364931ea280bcbb0deb4bc2b9be44c2f039168066a5302218af3389917cdf02f2eadaf1e0ae9a172ccf35191221d078363cc8853
- TLSH T16021515D1247E6C1527DECC283AA4CA383AE12563D163922465C7A437E5E301CFC5CDA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 fbb3cd430292d3348d4966689f6d15c69b0abd53ed7a13675017800461c144e6
- MD5 d29ff00c9df62e8fd516f836aaf95ab1
- SHA1 81aa4785e7e9237baea81bb15e6fd9493b8c987d
- SHA512 6c2c5d29d587176a31a277c645d751cf1b6048ce2f834a72f97a79477c40f5f624225b7942d0cbea00815ae479ba14de024d9efd56b7ba5e915f8c2c09e5c71b
- TLSH T1EC315FAD6147A7D141BDECC6839D8DE7436A23623D0239274A6CB6423E5F701CEC98DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 5a31975aacd869c9f8aae6b94605025456b4585327dd2f3dda51561c5be48499
- MD5 f5dfddad8ede4a25260f64f268acee7e
- SHA1 b63cd6feb31fdec45991255a1f5ea23a619194a6
- SHA512 4f3a897c45b5d093af709c222eff237430ede2d3e910c2b9641dc4416729400a9b2a6bd5b589a751a3b749129927893cbe67dee3866b9a53e152dfc73fb19c85
- TLSH T19A3152AD6147A7D141BDDCC6C39D8DE7436A23623D0239274A6CB6423E5F701CE898DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 030db4db834e47ebb5c654be7968aa58440602f8c0cfba9117259cb2f3557c73
- MD5 18f5fa23c8ccb485df2ffa1d82a81c06
- SHA1 fa26c7653a8563c553d9719ba817b8c3112bebf6
- SHA512 f9f1c725541d14973fecd75bd88af4a958568c4b6a074253a52186e64a5dc329d24948258c148363e53eaeb3c13fdbe7ecb9ef5c89ac6f07a70a6fd044861a8f
- TLSH T1493152AD6147A7D141BDD8C6839D8DA7436A23623D023927466C76423E5E701CE898D6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 d2ed118fd3d73ffaaccce696011d8ddc7f084c929f997e105dbfc22edf0ba682
- MD5 94b73028b02486b1bbfaddf8ee7d0c22
- SHA1 c47cc4d0e74900dd780193cde73af666e659144a
- SHA512 40fd8c87d8aa254541ca12d31529e6101d341504ba93b1d31604a73f4d7ee97fba0c272df5cf16126bc936a9b5089f613aaca40e94dd041e4ff7898137abf6f7
- TLSH T17E3172AD2147A7C1417DD8C6839D8CE3436A23623D023927461C76023E1E301CE898D6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 34f06e06f730c02cc87546030d3bca9b0ed6fcbac8f7029e30925ca386732c55
- MD5 635ce3c4c1afc9090a99481838bf1b0a
- SHA1 83af24220181fb471d5048823a0e9e5ebc31560d
- SHA512 2c5403ab863c68ca77aa39aaa5355e38cbbe16e468514a5d0a5bfb27a68c87b5ed95829f98d6045799e24ee488009a194de325ea1dbbee59aa2f3948e436c98c
- TLSH T1E43172AD2147A7C1817DDCC6C39D8CE3436A23623D0239274A1CB6023E1F301CE898DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 196B
- SHA256 8c39246796530ee7588fc16486335d00d5b7273ebb26efe5833e4cfc2bcfe223
- MD5 6e86650ad96258b23f022605c5f202d5
- SHA1 321290e91871cb653441e3c87ee8b20ab5f008a0
- SHA512 e8a7bdf4bd2fba233a1a6cdf977d57dcb37ae46bc52bf29b4d23c6294e769069e146bcb5f56c4edbc3f93d38a226a9349f604b54156696ccdef41106cc05060c
- TLSH T19BD02259BC23E2B43829BE4894B82E438283B24CE03234904A0CE810B06F341AADCCA9
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 379B
- SHA256 6f76f25646afdeb66c9f664f43b1d5ba210f21ccb56b7e05ca6f7d65065e0b15
- MD5 1409be7c549318ce0d8842f2ef96d83f
- SHA1 ea7725b958dcfdda88df145135371c7ceccbc0f9
- SHA512 80e52536c916aaf54a0863597ff29868a9f4a9949a82aa1d68ef764e967efc73f95b663bca8d87159e87245a8deca8bb439475f40036c5b360c1dc12e24ac07b
- TLSH T1E2E06848A843B2F46538BD478AAC5DA2A396A1CA743731604A1CF516396F104FB99C6A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 185B
- SHA256 c47da9be4fc4d757add73c49654c9179067af547d0cc758d6356e2955bbfcb61
- MD5 b8224e5293d4fad1927c751cc00c80e7
- SHA1 270b8c752c7e93ec5485361fe6ef7b37f0b4513b
- SHA512 8fed9a509e46319529145fa2159251e43040d26080af84e44badaab1dd339c767ff75a2c473bc0abfb448b03beb96718ee34ba6bc150ed3085322878b55a22f2
- TLSH T175C022096C23D2743829BE0894B82E038282B04CE03234900A0CA810B06B24116DCC89
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 b7e4c0ea6d1b39da2ff22402c6fcf912746048313c1b14391f1414133626a818
- MD5 80d7143f97a27c041effa4cd588e3360
- SHA1 3c9f89b448297ea5d967b65f0f60b238fb0cdceb
- SHA512 89ff1d73f2da32936d25be26f0f699076199e7203dccec073fd0ab7a7e2adcce694e1ecc7695b3ac8288eb94377bb81d45d2d62e840e1c2d93bfa32df1e5f6a7
- TLSH T197213F5D5247E6C1527DECC6C3AA8CA343AA23A63D5639134A6C76437E1E301CE88CDA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 b741177cf402a1465636517f01bcbd0b11f5a89367ac3883d67ea6aed35cfe7d
- MD5 bf25a2e43d1cac1625287ef97a53b23a
- SHA1 916f10db035a596461d966eaa5875d50907fd281
- SHA512 563b4545e37764f04e844271ceea10ddea28f435cfdc083111621b3ad5ee7f376acbd10b6afa21c6b367c717dd745273e3de2396f6ec9a490bafc1ec5d6bd3db
- TLSH T1E63152AD6147A7D1417DD8C6839D8CA3436A23623D023927465C76423E5E701CE898D6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 a3cedfb220a8831449881ea6791363929d22c45d63f11809bd703bade5a5cccf
- MD5 e8d29d547faad8147b54f0ad5a4efd47
- SHA1 10716f6b10a52944e36d800a5a772a3fa9727152
- SHA512 15956248442113512f4c133cc9dca3203f731173e3eda2df583cc6ee7a43111fc535a17d5b3283299653b37f840bcd242974392283d59df3055d496d786e31ea
- TLSH T18A31406D2147A7D1527DD886839D9CE3432A13622D423927465CB6027E1E311CE898DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 f9d13039a419a111eebab025b3abec91be52ef9789ab86fd291ca4b69b60dcf5
- MD5 127c509da5f921f0f1feac1c76bcff4b
- SHA1 a71356fcf68df3ebc851ad8acb5bf42ecaf7bc02
- SHA512 81fd13925d7f2dbb72a11a340cce4084b832e09094f277546a0d6109251621ebe20e8695d2cccdd340108b0f36e4a747fff0e183307863a9782c41892d2bbc11
- TLSH T12811421C6687F5D0927DDC96C3A58CA3937F00873916361246547A43BF1E600DF49CE7
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 4f24cba09508fb968b12296d6bcf2035e662730e26c9ea1113e5882fe0ecb2ff
- MD5 c9a8d1e5b6f84772c50328041c36c589
- SHA1 2076ed501e426fe41d8f2c31fdf4f6cda590f3c5
- SHA512 9444b5856c763ef2c8a77b6cf51656d5e0ad9cac8c349df1efb21238bcf9273a5b6a779c054d555f00b62d8a3ea2881b33fd2de7668e9ea8a9ecb9bbe758006d
- TLSH T14A21631C5683E5C1A27DEC96C3E58CA383BE118739163A2346587743BF1E601DF89CDA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 622B
- SHA256 c972a23fa7327631a3cf157e7e4c2ae6cf38296841fb2707ef3b29cb9708a086
- MD5 efb862546fcfacbb888ba8cd292ef724
- SHA1 14ec4fc9ec71b9dd8e3c410b9fe515865830f039
- SHA512 0ab581f98021045be8a621d0c83acf53763a97862575777f30f3b6bb9c875c560eb258912e7a11b9c050cf3bbba2c959a2b874ea51dac7afc400f998ba2d3ca7
- TLSH T15FF0E1AE111B1FC145B8C5D5935D4DF7532633301F828C4B16AC730A1C1E31249C88C3
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 e263bdb01795ea3eb1b96562c8a3f23496add636554778d694d052c71692172d
- MD5 3a46f0afe0a28a3fe9039a3540adaab7
- SHA1 9c1ecc2aa4d2edb733f646f8e3638ea13bb8eda7
- SHA512 a6e91f7be5fd83517972de6af96ca2671549a33b1cf6d3f06ff2b19338569f9dc62bcb60374b0d4b3ae178728deecd9a3508df0c05a4d92718cd36f8d2285afb
- TLSH T17B3152AD6147A7D1417DDCC6C39D8CE3436A23623D0239274A5CB6423E1F701CEC98D6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 0fb3497dfefad1e2c5b28b8fd6aa65a82396bf6cfa93d7e973f4e88286eb8b91
- MD5 61730e4b8df21f007aebcba0a6fbb681
- SHA1 7daf68e854882a9f766cb5ae2b3c75bf031d42ad
- SHA512 3cb1062ad964743faf59741d48d2cc3f67d100548123087a799d7f6d872c52783661cbad857f182e82bcbcddf0b28c860e1f30c3087f96ae76905e89846e40ec
- TLSH T1243152AD6147A7D1417DDCC6839D8CE3436A23623D0239274A5CB6423E5F701CEC98D6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 8bcbaca231237d8eb173ad3ce04082aa71c845a8d946e098321f97c2b1fb4e5d
- MD5 283b20959691177c09ee70ab3a95c720
- SHA1 290a86731328fabe64aaa72c444ae0c635ff2ae9
- SHA512 ed31f54981885e676a6016434a16dcd139815ad81c008f5fdc9ec692604041f1069b35243554a0863e426190094d5953eac08cc9f1730e4e74c36067978e8a7e
- TLSH T19811FCAD54076AD04578E986939C8DF3536623926E42382A4A5CB6462C2E312DEC88DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 807B
- SHA256 f66b2c3e4dbd1ba68574db902dfb9afd1775f538e0a7e280981b791cfb229e98
- MD5 0dcc8dbcc8d9e30215ab1979790cba6d
- SHA1 ba311f2b6b657a9d0fe734628fbd837d81b218cd
- SHA512 1d3c6e8e85c6054242faafffc2e63ed97872686248180b4bf0411ab965b32eef92f4be95186356e75e6dee0ec1f04241557c9108eb8e0aeb80b1183547e20eab
- TLSH T1650120AE21175FE04578E999E3AD5EE3831333346F424C4A0A9C77062C1F3124ACC8C7
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 894B
- SHA256 6fa2a413ba9d8fbfdee2404cf7da28b7ff3d569339aa380c23e3aac6be918900
- MD5 f2f88a0ac89f6b20aedb6d103a9152a8
- SHA1 fb43775cdb53b669c3e1c63f5e78c4cc15b87704
- SHA512 4cc82315f5fb63dbdb30ce361d372691dd75ff43d9f358ef3f8b6bae480f0047b11c7456970a7b5006383f29503c149166cd6be481e406e210721db576051f78
- TLSH T1FF1112AE21176FD04578E995939D5EE3531733646F435C460A9CB6062C1F3118AC8CC3
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 922B
- SHA256 fa6c7be8f110c23d171d441701271bd84d01672357b00fa0c8cc7a14ca7d0085
- MD5 bf3c94a17e9fc19ed9dfd8737262277d
- SHA1 7ce3d07300ebfdc0c41b4e62278bf4d45a69f546
- SHA512 d07ff07205ec733a3532b76a5ba1f7daa65d2eb9ec8b37cb70397a3ab3cba91caea5bb0d2264f9fdc5651dc26f292296f4db655bd5e64a9634d20e25be068f88
- TLSH T123112FAE61076BE04678E996D39D4EE3431733A46E432D460AACB2062C1F3118AC88C3
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 ac129215ccb2fc82545c3d338cff1b213942b06eb5921eb3ade5ab8c86ba1b6c
- MD5 e623016ed6c20e8e2dc00cbe9077e67c
- SHA1 348cc00e895b7c69bde40027098b9bfaeb39aa3a
- SHA512 e183377cab8418f7f302dbaa870bd240d21f4a607a2ad64c73d3922f8ffa2f95df51be2a40ff406086f2032a1db06abf1d3a4dd169364cb34249ce553d8fdee7
- TLSH T10A111FAD54077BD04538ED86939C8DF3532723916E4338260A5CB2472C2F301CAC88D7
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 5417fa53f0a9f245c6c2b2790cf298eedc6cca79ffef57f5c85f034922dad9a3
- MD5 0ac9bd1ca6c7adb08876476a6f3366ec
- SHA1 12a71060712f2eccfc09d71e02145dbc9c145957
- SHA512 c37bfaf3719d9d664fe06b2adb0d41d9e3deafb000a68b60a974ce4afb0e9352449b1afe68901e108d5db6002177488f81bac4998b3d826684f0c0aec3227c15
- TLSH T11B2163AD5247F6D1527DECC6C3999CE3436A12623D0239174A6C76023E1E311CF898D6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 fc1cf7f0b6a50ecee1175c213eb748b0d6a1a58a840baeb4c2f0551b6c4c3e82
- MD5 daa9ee0250b12912f0f54e0dc2f163ad
- SHA1 2ac0d140636b26d86ff6a3dba0c128bdfd0ace25
- SHA512 ec0727e1891ba7fe4ee3687eb90d958cfdabde9540a3a7048ec4b91e04f09835c6b7151de5093f5faf283e9f868bb0b6deec767d8bdefd1ed9f92f212c7509ae
- TLSH T13D215EAEA407E3D151BEEDC6838D5CA6039963A26C0234274B2CB2063D4B715CFCA4DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 a89cf3895be46f5ae9885fc4bbed15153f3469b3db16b3f573f4f9e279d10977
- MD5 fc3baade53a5ce4335b34f74350673dd
- SHA1 99ee17de24fcca8bc496296c9d60be5497237c23
- SHA512 628859441ebeb3904e675bb0e1e44830b0184c1e6e055ea0c3d5e21482d11ac3017985cd4674e24b9205eacc054c2691ad9c1eb3ef77fb656616ff7bb59c5111
- TLSH T1E73152AD6147A7D1417DDCC6C39D8DE7436A23623D0239274A5CB6423E5F701CE898DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 b0d41dda70004667d7b6e0f3bb63f3803af18cb47a7507bd5b15d59a0e42cdd3
- MD5 f25442650b846e244b83e3ca250abf28
- SHA1 f19856046df7db6d3344ddbe6f76db0ba6229e3b
- SHA512 dcb82f6543c470d5090a573b25a6ec49d4c86b581ecb2cb84cfa7f67a089521a13ebeb98c58b7c63d685bb363f3c193745541d4a72cd1cacaaacaa50c67f1f49
- TLSH T1663152AD6147A7D141BDDCC6C39D8DE7436A23623D0239274A6CB6423E5F701CE898DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 89e7414104b564999ae228d27ec0ed63fbfaf99a77bc44a4c210c27214fd3c7d
- MD5 b867f01b5f4a1acccc79b88396de861a
- SHA1 7b6626ecdb083798819e08086d633daf0ae809af
- SHA512 6e0d4cd0a76abb334af5c91588aa6665ad14d544c2b024770a2b61922b9438d7c113b5b3c5573802bed4da26aef56db2c37bd027665c7e45f82436fc289efeba
- TLSH T1813152AD6147A7D141BDDCC6C39D8DE7436A23623D0239274A5CB6423E5F701CE898DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 325b54aead1f91f69053a5122a2ee99d02ae87d5ceaa512d202d0f7da13dc884
- MD5 91e07c86fec26bdbc30cb1845f44706f
- SHA1 3136f9a8f8024d65665ea337c01465c35d415daa
- SHA512 09584fdf8fd6a3dd4ddbdae3fae0b03c7d32e1de9aad824c0c472cdc1724f20a005c2c40cb4373a6a73ab04085f65d55e39bb6ba30565ca352400b956ac91dfc
- TLSH T15A31606D2107A7C142BDD8C6839D8CE7432A13622D423826075CB6027E1E311CE888DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ISNNKCMDG\ISFLKJG.cfg
- Size 1KB
- SHA256 838a135b47c6582577280879ea00d74b052998ea7a4a6ac89c443d3ef9f933ad
- MD5 301866f9a039c2d55e1f2f7305612064
- SHA1 5951d44c5b0674f980a6323bbbce1de668d0e7b6
- SHA512 e15162074265c7a39b29e9f5200e4e44b78106ff0807af407882571622a104eb8794e86e19eec1f2bec299fb6b04f566199abdf825391eff7508cce7c05d8481
- TLSH T1053152AD6147A7D141BDDCC6C39D8DE7436A23623D0239274A5CB6423E1F701CEC98D6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\a18bb\ISf27.exe
- Size 6.1MB
- SHA256 b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77
- MD5 04155ed507699b4e37532e8371192c0b
- SHA1 a14107131237dbb0df750e74281c462a2ea61016
- SHA512 6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371
- SSDEEP 98304:hvOOFJ+Z8eAgy7SH9s76RSvyqJOBgECfMfYv+85JH0DVczt8A:hvOOFJ+ggr9s76R+wcMAv+IHCczt8
- TLSH T152567C15BA409003E2737A76CDA352CD5819BE661D34542B26A43F4CBF70B83FA36B97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\727.mof
- Size 344B
- SHA256 3c77f5f888d417a7a31284cb8c5e3bdb4d926c4a274cecac8a8b2920659d5927
- MD5 3754f8f8abad5bad797085d0717a9766
- SHA1 48d92f36cb721b390e216aa03b27b41f25c563fc
- SHA512 c59f322ece53c757767e52fe9bfbc3526a13afe9ec7503e3d1cae683eeb55cbb808a1bce720fd58f97f286756d314124bcf797c2167275e08ed93ba759bf3985
- TLSH T111E0DF90622B9E591989ABA00022332B3C28119093E61254B918D1A931E7DC6C3F68CD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
- Size 8KB
- SHA256 28b2375b8310f5bfa0cef5b33f8c06843288b7abe2a0b5d21744ad2fd7bdc162
- MD5 7f6c3908ddc318f94e172c150d07fe7c
- SHA1 a64ec3602f8f4c20bdc46e4e708c638ddd3a4105
- SHA512 3a11d53b8f11814a4e3a5d3b3092345294850b9070bb15d6adb2f3d147cc22162b82c9b3821e04cb70ffef8c80752e218bca214eb850a22929191affe41d898a
- SSDEEP 192:uYixm0+4+YSqowrkhbRBOsrFQh6aJ2yF:PemJTYW/wsrFQhFJ2yF
- TLSH T12B02F3022BD8EEB7F0550736496A9E1AB3347C137D426B9BF281730E7D72E440477AA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
- Size 8KB
- SHA256 2b2d47d6667cf40a60e7eee89ca47a79a04e3b56fff88574c9855d1fb1f67d5b
- MD5 2b05d4725074d32ff102225cee47e8f2
- SHA1 f66347b18a4a6667a131dd0f14dffa7d84f080b7
- SHA512 45c38f322b0b2a3cdbf30f07a7423ecf26cad53843b987fbafab88017b7e46ba2d730f8167a7bd22490262c108c5e7a338f5ca73893e81f34139ef109d1f0bbf
- SSDEEP 192:/Yixm0+4+YSqowrkhbRBOsrFQh6DJCyF:AemJTYW/wsrFQhAJCyF
- TLSH T1F902D1022BD8EEB7F0554736496A9E1A73347C13BD427B9BF281730A7D72E440477AA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
- Size 6KB
- SHA256 7bad38bdfcd75597760999a1eee10932893fa6b2bbce03fd47dcdd704e28d63e
- MD5 49656dcb98e8d58fe0f5a2b0303b4d07
- SHA1 e7d39b51dad2aacd79bc14441f3edef4f8ac9edc
- SHA512 b7c8766210cf794b504de1fc637d520e213ec14118a91c5fc1b626b7bf3c458dbd077ae5e2e7f5dd8f93b00e1e7ae6ba5c6cdbf7746407cb2e275c00a1385e77
- SSDEEP 96:xH4UTUbqGq6fUgC1zS7oOSSl4dv9j5nXH/+FFBw88u8L4cnYQOnW:umR6fUgCajSSU/4Bw88AW
- TLSH T1ABE1417890488B7F74B677ACAC6888316AB2017BBBBF68D750B554C4015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\etc\host_new
- Size 1KB
- SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
- MD5 008fba141529811128b8cd5f52300f6e
- SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
- SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
- TLSH T15421AA2A0689915D26B345E5091CB82FA31FD0EF0E3B8D8D3E8E454F7BA2A1C5326746
- MD5 SHA1 SHA512 TLSH