Analysis
- max time kernel
150s - max time network
7s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 13:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 2.1MB
- Sample260930-q4q3wsshle
- SHA256 bf89857adcb7843779a6af340294dccf940fc23ea5a288a71929155544d8c81a
- MD5 126846506832cddc1a229c883e4ee583
- SHA1 48b3221275246c1f5d291c9f772b2a38b660ecd0
- SHA512 14f8ba13b7294f2e4952cd5570ec431a702145d61dd4692db203276a56f85bbb08dd76afcc8bae392120f9f1489c2aaf0d5fac82790f1e6bb8663897380c9814
- SSDEEP 49152:GZpB+kbTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYm2:GZpEk6ZxvWbrtUTrUHO22
- TLSH T1B1A5F0122380DC32F39FC27243D51E7236B369702B37DA969B4416751AF0E9FE7A5286
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs
resource yara_rule behavioral2/memory/1864-27-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1864-31-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1864-32-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1864-39-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1864-44-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1864-48-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1864-47-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1864-49-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1864-53-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1864-83-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-102-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-103-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-100-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-104-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-105-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-106-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-107-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-108-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-120-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-109-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1864-54-0x0000000002450000-0x000000000350A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-133-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-134-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-195-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5688-210-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/1864-27-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-29-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-31-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-32-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-39-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-44-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-48-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-47-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-49-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-53-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-83-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/1864-95-0x0000000000400000-0x000000000044B000-memory.dmp UPX behavioral2/memory/5688-102-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-103-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-100-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-104-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-105-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-106-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-107-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-108-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-120-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-109-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1864-54-0x0000000002450000-0x000000000350A000-memory.dmp UPX behavioral2/memory/5688-133-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-134-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-195-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-210-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/5688-234-0x0000000000400000-0x000000000044B000-memory.dmp UPX - Executes dropped EXE 7 IoCs
pid Process 1864 @AED567.tmp.exe 4400 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe 5688 WdExt.exe 1568 launch.exe 3868 launch.exe 1960 wtmps.exe 4284 mscaps.exe - Loads dropped DLL 2 IoCs
pid Process 1864 @AED567.tmp.exe 5688 WdExt.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" @AED567.tmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" @AED567.tmp.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AED567.tmp.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe -
resource yara_rule behavioral2/memory/1864-27-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/1864-29-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/1864-31-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/1864-32-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/1864-39-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/1864-44-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/1864-48-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/1864-47-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/1864-49-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/1864-53-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/1864-83-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/5688-102-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-103-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-100-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-104-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-105-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-106-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-107-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-108-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-120-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-109-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1864-54-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral2/memory/5688-133-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-134-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-195-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/5688-210-0x0000000002350000-0x000000000340A000-memory.dmp upx - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e59daf5 @AED567.tmp.exe File opened for modification C:\Windows\SYSTEM.INI @AED567.tmp.exe File created C:\Windows\e59e594 WdExt.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3012 cmd.exe 1712 cmd.exe 4660 cmd.exe 1624 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname @AED567.tmp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain @AED567.tmp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WdExt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WdExt.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @AED567.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtmps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 1864 @AED567.tmp.exe 1864 @AED567.tmp.exe 1864 @AED567.tmp.exe 1864 @AED567.tmp.exe 5688 WdExt.exe 5688 WdExt.exe 5688 WdExt.exe 5688 WdExt.exe 5688 WdExt.exe 5688 WdExt.exe 1568 launch.exe 1568 launch.exe 1568 launch.exe 1568 launch.exe 1568 launch.exe 1568 launch.exe 1568 launch.exe 1568 launch.exe 1568 launch.exe 1568 launch.exe 3868 launch.exe 3868 launch.exe 3868 launch.exe 3868 launch.exe 3868 launch.exe 3868 launch.exe 3868 launch.exe 3868 launch.exe 3868 launch.exe 3868 launch.exe 3868 launch.exe 3868 launch.exe 1568 launch.exe 1568 launch.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe Token: SeDebugPrivilege 1864 @AED567.tmp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4112 wrote to memory of 5488 4112 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe 88 PID 4112 wrote to memory of 5488 4112 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe 88 PID 4112 wrote to memory of 5488 4112 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe 88 PID 5488 wrote to memory of 1864 5488 explorer.exe 89 PID 5488 wrote to memory of 4400 5488 explorer.exe 90 PID 1864 wrote to memory of 1288 1864 @AED567.tmp.exe 16 PID 1864 wrote to memory of 3212 1864 @AED567.tmp.exe 46 PID 1864 wrote to memory of 3268 1864 @AED567.tmp.exe 47 PID 1864 wrote to memory of 3764 1864 @AED567.tmp.exe 55 PID 1864 wrote to memory of 1144 1864 @AED567.tmp.exe 56 PID 1864 wrote to memory of 4408 1864 @AED567.tmp.exe 58 PID 1864 wrote to memory of 4476 1864 @AED567.tmp.exe 59 PID 1864 wrote to memory of 4540 1864 @AED567.tmp.exe 60 PID 1864 wrote to memory of 4896 1864 @AED567.tmp.exe 62 PID 1864 wrote to memory of 4364 1864 @AED567.tmp.exe 63 PID 1864 wrote to memory of 5212 1864 @AED567.tmp.exe 64 PID 1864 wrote to memory of 5316 1864 @AED567.tmp.exe 65 PID 1864 wrote to memory of 4672 1864 @AED567.tmp.exe 78 PID 1864 wrote to memory of 5668 1864 @AED567.tmp.exe 79 PID 1864 wrote to memory of 5060 1864 @AED567.tmp.exe 80 PID 1864 wrote to memory of 4208 1864 @AED567.tmp.exe 81 PID 1864 wrote to memory of 4992 1864 @AED567.tmp.exe 82 PID 1864 wrote to memory of 4400 1864 @AED567.tmp.exe 90 PID 1864 wrote to memory of 4400 1864 @AED567.tmp.exe 90 PID 1864 wrote to memory of 3012 1864 @AED567.tmp.exe 91 PID 1864 wrote to memory of 1624 1864 @AED567.tmp.exe 93 PID 3012 wrote to memory of 5688 3012 cmd.exe 95 PID 5688 wrote to memory of 1288 5688 WdExt.exe 16 PID 5688 wrote to memory of 3212 5688 WdExt.exe 46 PID 5688 wrote to memory of 3268 5688 WdExt.exe 47 PID 5688 wrote to memory of 3764 5688 WdExt.exe 55 PID 5688 wrote to memory of 1144 5688 WdExt.exe 56 PID 5688 wrote to memory of 4408 5688 WdExt.exe 58 PID 5688 wrote to memory of 4476 5688 WdExt.exe 59 PID 5688 wrote to memory of 4540 5688 WdExt.exe 60 PID 5688 wrote to memory of 4896 5688 WdExt.exe 62 PID 5688 wrote to memory of 4364 5688 WdExt.exe 63 PID 5688 wrote to memory of 5212 5688 WdExt.exe 64 PID 5688 wrote to memory of 5316 5688 WdExt.exe 65 PID 5688 wrote to memory of 4672 5688 WdExt.exe 78 PID 5688 wrote to memory of 5668 5688 WdExt.exe 79 PID 5688 wrote to memory of 5060 5688 WdExt.exe 80 PID 5688 wrote to memory of 4208 5688 WdExt.exe 81 PID 5688 wrote to memory of 4992 5688 WdExt.exe 82 PID 5688 wrote to memory of 4400 5688 WdExt.exe 90 PID 5688 wrote to memory of 4400 5688 WdExt.exe 90 PID 5688 wrote to memory of 3012 5688 WdExt.exe 91 PID 5688 wrote to memory of 3012 5688 WdExt.exe 91 PID 5688 wrote to memory of 1028 5688 WdExt.exe 92 PID 5688 wrote to memory of 1624 5688 WdExt.exe 93 PID 5688 wrote to memory of 1624 5688 WdExt.exe 93 PID 5688 wrote to memory of 3080 5688 WdExt.exe 94 PID 5688 wrote to memory of 1288 5688 WdExt.exe 16 PID 5688 wrote to memory of 3212 5688 WdExt.exe 46 PID 5688 wrote to memory of 3268 5688 WdExt.exe 47 PID 5688 wrote to memory of 3764 5688 WdExt.exe 55 PID 5688 wrote to memory of 1144 5688 WdExt.exe 56 PID 5688 wrote to memory of 4408 5688 WdExt.exe 58 PID 5688 wrote to memory of 4476 5688 WdExt.exe 59 PID 5688 wrote to memory of 4540 5688 WdExt.exe 60 PID 5688 wrote to memory of 4896 5688 WdExt.exe 62 PID 5688 wrote to memory of 4364 5688 WdExt.exe 63 PID 5688 wrote to memory of 5212 5688 WdExt.exe 64 PID 5688 wrote to memory of 5316 5688 WdExt.exe 65 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AED567.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3212
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3268
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:1144
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4408
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4540
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4896
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:4364
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5212
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5316
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:4672
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:5668
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\@AED567.tmp.exe"C:\Users\Admin\AppData\Local\Temp\@AED567.tmp.exe"5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:1028
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"7⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 56889⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe12⤵
- Executes dropped EXE
PID:4284
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:3080
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4400
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:4208
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4992
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4864
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3868
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 287KB
- SHA256 88453471e2625e39524cb006afe3571e422558dd078e1451fc18ad82ab7f4074
- MD5 d02f2d820c2225373084fbc34f43c834
- SHA1 69f8b8627caa5e69ee409aed5ed1e9648afdf6e5
- SHA512 4fb7a3e06a928831f731817be2ae154095a9617066d911d48d0606ed1b7fb6f834449f85f59f25bfc6c3d7c1f5d6a0370861194008b452f16742f14055f20ce8
- SSDEEP 6144:H/26kJC3oghja3DpYGaYxKrNV0eSGHeMQT2/:uC4gNobaYoN2eSGWC/
- TLSH T121544B1353D4343AD8A313B052EA23732BB46DB40B2D53E7C3865B9958A47E5B93D38B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\4BCF.tmp
- Size 406B
- SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
- MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
- SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
- SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
- TLSH T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\@AED567.tmp.exe
- Size 1.8MB
- SHA256 5464a9ba9b20e0f322fab398b7508b192dfa243632553a2388f37119680dc313
- MD5 4f72c4ad306998d35ec494f5b04e1205
- SHA1 e88ff9f9c72f915fe102ee94bff074fe64cb35c1
- SHA512 b629756f9a08bde63d4832804461519de29f08adb708ff3350d603dcbc04b64dcf3faaccaff13e7b55fe2eae079c79bafe690250939ac066525009c073137477
- SSDEEP 49152:7bTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYmE:76ZxvWbrtUTrUHO2E
- TLSH T1EC95EF152790CD61F36FC07683E16E79B6B329213B33D986AE8855312BF2E1FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp378D.tmp
- Size 229KB
- SHA256 70a392389aecd0f58251e72c3fd7e9159f481061d14209ff8708a0fd9ff584dc
- MD5 6f90e1169d19dfde14d6f753f06c862b
- SHA1 e9bca93c68d7df73d000f4a6e6eb73a343682ac5
- SHA512 f0c898222e9578c01ebe1befac27a3fb68d8fb6e76c7d1dec7a8572c1aa3201bacf1e69aa63859e95606790cf09962bcf7dc33b770a6846bed5bd7ded957b0b3
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp37BD.tmp
- Size 120KB
- SHA256 01631353726dc51bcea311dbc012572cf96775e516b1c79a2de572ef15954b7a
- MD5 f558c76b0376af9273717fa24d99ebbf
- SHA1 f84bcece5c6138b62ef94e9d668cf26178ee14cc
- SHA512 2092d1e126d0420fec5fc0311d6b99762506563f4890e4049e48e2d87dde5ac3e2e2ecc986ab305de2c6ceb619f18879a69a815d3241ccf8140bc5ea00c6768d
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp37DD.tmp
- Size 126KB
- SHA256 ae5697f849fa48db6d3d13455c224fcf6ceb0602a1e8ac443e211dd0f32d50f4
- MD5 02ae22335713a8f6d6adf80bf418202b
- SHA1 4c40c11f43df761b92a5745f85a799db7b389215
- SHA512 727d16102bfc768535b52a37e4e7b5d894f5daa268d220df108382c36dcce063afdbc31fd495a7a61305263ec4cd7e92713d894faa35b585c0b379217a1d929c
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp37FD.tmp
- Size 89KB
- SHA256 63149ad45db380f5dd15f65d9ceb2611d53a0a66e022483bee4ce2ff7d2610e2
- MD5 09203a9741b91f3a9ed01c82dcb8778d
- SHA1 13e6f3fb169cd6aa5e4d450417a7e15665a2e140
- SHA512 9e9e6fe0dd713417d0e28ba787cf862d55ecda9ee9f3df1eada144657f6a3b6ada1984fd05a3fffcd597a9715383225a8e40b6e5d0d8d39ec0d3a64b8dea9846
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyS:O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp381E.tmp
- Size 99KB
- SHA256 5ec8093ef5939d1abce1c576097b584fb600b94ad767c1da897f7cb7f0063d26
- MD5 9a27bfb55dd768ae81ca8716db2da343
- SHA1 55da0f4282bd838f72f435a5d4d24ac15b04482b
- SHA512 d9bb49d2f282ed09c351a1d8eb2540781e6a7fb39265473fd59d146bfc162f27a4ab1405301ed7395c12929a80551a399437d7d794d7ac48650e9037b60eb69c
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp383E.tmp
- Size 172KB
- SHA256 27c945ccb84aa024f1f063701327e829a7ef3a7ede4a43b2febbb1dddbdf8740
- MD5 2634fa3a332c297711cb59d43f54ffce
- SHA1 8e2b68d0ee4e792efb1945ba86eceb87f07087d2
- SHA512 84e4799b9b18a7cc7be685c793a9b4fb135ea331d1d235fe823e1d7091130f131ab2fbad1da4dea795e82547aa16b00f4e2a9faaa96cb522d795f9abfda2fc53
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp38AC.tmp
- Size 276KB
- SHA256 d2fa6f9686386a92253a9c5ea25ace702a111483540b60c1300789235cea7fdc
- MD5 e07c6a9e595f045fadc463dfda44ab16
- SHA1 e6b199272ade02613f2003c365a4cb1487431e23
- SHA512 f3c630ae8381b99519aeeadbc2918810e7fb09a909f73ee6c46f4e9d3cf8c5051a5cf763db6a775d6cd8713ccf95a63b18df9ed756fa28276e8d7ab6a47f2cbf
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyX:T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
- Size 276KB
- SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
- MD5 75c1467042b38332d1ea0298f29fb592
- SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
- SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
- SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
- TLSH T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
- Size 172KB
- SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
- MD5 daac1781c9d22f5743ade0cb41feaebf
- SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
- SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
- SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
- TLSH T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
- Size 1.8MB
- SHA256 97de6f93767564027258881def817f072c7fee0aa834fbee691160cf015563ac
- MD5 7537c5a8e1360d0a0e15f2449f677b75
- SHA1 bbea5246b82a283390ef346cb3db54f6d5ea74c6
- SHA512 f6b1761b341a4b69a84170f99d6549b0a3cbbab359283d773db14deb2fbac225093364477480339697a2f9d19f292eb37ec7580fad328861245185df3c13a43b
- SSDEEP 49152:7bTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYmE:76ZxvWbrtUTrUHO2E
- TLSH T1F695EF152790CD61F36FC07683E16E79B6B329213B33D986AE8855312BF2E1FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
- Size 129B
- SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
- MD5 d1073c9b34d1bbd570928734aacff6a5
- SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
- SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
- TLSH T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 126B
- SHA256 f3adb6dc8d216401d7addb98e76024f37474d3239ee791ae0da5106afc55071a
- MD5 664d08ce0c19dcb351174af47bc36a93
- SHA1 bafc318c751c435922083338700f1bf426c8b15a
- SHA512 6b87582446728c8ac4d280c857ddf7adab1845dcc69031094c8163861cdadad8252d990b86c95e6020ecbfc93f3f21ddef2295fd3736fa40aa9287ded993fee4
- TLSH T122B09B1703C9DB0E745260970775549D50784EC13F947745C6118488314590CFC5E545
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 196B
- SHA256 1086fa0b8dee39219f962b34c78bf769f466f3f0a47d7e04ca4db4b199548f60
- MD5 0981b33c9950840dfc733afa420cc250
- SHA1 ad891dcfb1e0027e76bf00fb0b429def5db154c9
- SHA512 adf3079d2ef5c56c27d213e3f3199f2f79c03f22a42d5aa5cb85b837cbb2b178474d1caeea43a1d5e3b679f069bf1dd8625e7d67c3594cfb43a0b62d26df244b
- TLSH T1B9D0120A42C6C79D644460570B7691DDE1B85EE93FC93716D613C45C21C150DB9A3A11
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
- Size 102B
- SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
- MD5 3ca08f080a7a28416774d80552d4aa08
- SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
- SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
- TLSH T114B0121243CBCF0D148060D70775A1CCC0740C983F947714DF11C84C314080DFDC6A41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 382KB
- SHA256 f0a24c3d4e5f5948dd84a9db1206e07b904c6c12ff9e20de2a2ad7d6b04c6946
- MD5 311930917a26dd0cc3754133b6ffc342
- SHA1 3c6baf292592dc733d71c2b984a7b75070b43aff
- SHA512 b8401339f12ebf39f9ec6ffad3d6db7188387d9fe997d74f11a0d324389758b777b14f4f4a732879259955c428db6d01644f541c9f21db90e2c7eb94b15ca2f0
- SSDEEP 6144:ED1coZXbdacDWZyehpRHy9H4dIBXCN2x/DMVP1tF+jBSVJ6:EDhZLdN9eNXdIlCNuorJ6
- TLSH T106842942AAE95420D2F357306A7DBB39212E78785BA0ECDFB24057FDA420AC19F75353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 c70a9a4a38556583d9b5ab92acbb25f1ed2445e4dc616ec442028e5f461e6f55
- MD5 1b7096f89b9f5b4850694f92337a5073
- SHA1 0cbbbd4f589ebce945be36762301454bec80a8f5
- SHA512 d16438dcad5c90b9831b18e38ab3134d9c6b5d4720c484899743bfc7d270b2373c9de800ab116d65b6fdd6573a06c2c21d0d3fe325bfd2505e5526dd4a7b6d89
- TLSH T1F6D05B0D4BDD117D9042003E3178D0C172399F11DC320F4C5039674164186D5BFBE29D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mscaps.exe
- Size 200KB
- SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
- MD5 78d3c8705f8baf7d34e6a6737d1cfa18
- SHA1 9f09e248a29311dbeefae9d85937b13da042a010
- SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
- SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
- TLSH T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
- MD5 SHA1 SHA512 SSDEEP TLSH