8c9b58c91a712c6bd1fe081b6b64f064ed196fec8ee96ef23aecacb82854ac46

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jave/1stinstall.exe
Size 45KB
Sample261002-g4xe8ssapc
SHA256 8c9b58c91a712c6bd1fe081b6b64f064ed196fec8ee96ef23aecacb82854ac46
MD5 d86f72ea396de2ef24fadf8a4c8870ff
SHA1 3f372bf319c476ebd075720ca974bd0302662e20
SHA512 e0b9464bbb89245dd1e979c1a6ca54441648b457f62e8dfa6765b5ce9980592e42466e62942d1e122bc2cb29268b0ae8912f8b1e327395ee7c06515a3830c5d3
SSDEEP 768:Vpm7BcEKNvBcvL6VeRNL1a6ZO4PTPz+o+CKr3zQ4NuVVWgP4+z5CzpgnbcuyD7Uv:VpfEKNCj6VoJl9Go5K7s4Nu3tnouy8
TLSH
T15723E147928DADABEA2460799C5F1C699F9CD71C72808373DDD137BA5CA0B060F1D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery execution ransomware spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	1stinstall.exe

Executes dropped EXE 10 IoCs

pid	Process
3508	MSI5C90.tmp
3268	unpack200.exe
3660	unpack200.exe
5116	unpack200.exe
4572	unpack200.exe
2860	unpack200.exe
1444	unpack200.exe
2552	unpack200.exe
3264	javaw.exe
2392	javaw.exe

Loads dropped DLL 31 IoCs

pid	Process
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
4332	MsiExec.exe
3268	unpack200.exe
3660	unpack200.exe
5116	unpack200.exe
4572	unpack200.exe
2860	unpack200.exe
1444	unpack200.exe
2552	unpack200.exe
3264	javaw.exe
3264	javaw.exe
3264	javaw.exe
3264	javaw.exe
3264	javaw.exe
2392	javaw.exe
2392	javaw.exe
2392	javaw.exe
2392	javaw.exe
2392	javaw.exe
2392	javaw.exe
2392	javaw.exe
4332	MsiExec.exe
4332	MsiExec.exe
4332	MsiExec.exe
4332	MsiExec.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
35	2320	msiexec.exe
37	2320	msiexec.exe
50	4224	msiexec.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	MsiExec.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\deployJava1.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\java.exe	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\java.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\javaw.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\javaws.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\npDeployJava1.dll	MsiExec.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2360-3-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Bahia	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Bogota	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\St_Lucia	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Manila	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Darwin	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+9	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Prague	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\fontmanager.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Nome	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\javaws.pack	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Juneau	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Santiago	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\EST5	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\JAWTAccessBridge-32.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\orbd.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\servertool.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\security\java.security	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Bujumbura	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\CST6CDT	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\client\classes.jsa	javaw.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\ssvagent.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jabswitch.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Anguilla	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Jamaica	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Perth	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jpeg.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\classlist	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\deploy\messages_ja.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Singapore	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT-3	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Indian\Mahe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Barbados	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Tijuana	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Indian\Mayotte	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Honolulu	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\plugin.jar	unpack200.exe
File created	C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+5	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Dublin	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Port_Moresby	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\ext\localedata.jar	unpack200.exe
File created	C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Gaborone	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Indian\Christmas	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\HST10	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Vincennes	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Vancouver	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+2	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Luxembourg	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\core.zip	msiexec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\security\local_policy.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Yakutsk	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Lord_Howe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jpishare.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\security\trusted.libraries	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Efate	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\awt.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jpioji.dll	MsiExec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e599d50.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F83217013FF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4D1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA80F.tmp	msiexec.exe
File created	C:\Windows\Installer\e599d53.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e599d53.msi	msiexec.exe
File created	C:\Windows\Installer\e599d50.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e599d52.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1764	cmd.exe
1212	cmd.exe
3660	cmd.exe
3052	cmd.exe
3432	cmd.exe
2072	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI5C90.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1stinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unpack200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jre-1.7.0_13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001302849f6a5860da0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001302849f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809001302849f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a1302849f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1302849f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "3"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024"	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_26"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_12"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_18"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0038-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0039-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_04"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_05"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0039-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_12"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0035-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_35"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0037-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_23"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0033-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_33"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\wsdetect.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\ = "Java Plug-in 1.3.0_02"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0031-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0033-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_33"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_16"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF238120731FF\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0032-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\.JNLP	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_01"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_28"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_05"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\TreatAs	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_07"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_26"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}\DefaultIcon\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\javacpl.exe"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0037-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_11"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_23"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_06"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_05"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1324	MsiExec.exe
1324	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2320	msiexec.exe
Token: SeSecurityPrivilege	4224	msiexec.exe
Token: SeCreateTokenPrivilege	2320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2320	msiexec.exe
Token: SeLockMemoryPrivilege	2320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2320	msiexec.exe
Token: SeMachineAccountPrivilege	2320	msiexec.exe
Token: SeTcbPrivilege	2320	msiexec.exe
Token: SeSecurityPrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeLoadDriverPrivilege	2320	msiexec.exe
Token: SeSystemProfilePrivilege	2320	msiexec.exe
Token: SeSystemtimePrivilege	2320	msiexec.exe
Token: SeProfSingleProcessPrivilege	2320	msiexec.exe
Token: SeIncBasePriorityPrivilege	2320	msiexec.exe
Token: SeCreatePagefilePrivilege	2320	msiexec.exe
Token: SeCreatePermanentPrivilege	2320	msiexec.exe
Token: SeBackupPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeShutdownPrivilege	2320	msiexec.exe
Token: SeDebugPrivilege	2320	msiexec.exe
Token: SeAuditPrivilege	2320	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2320	msiexec.exe
Token: SeChangeNotifyPrivilege	2320	msiexec.exe
Token: SeRemoteShutdownPrivilege	2320	msiexec.exe
Token: SeUndockPrivilege	2320	msiexec.exe
Token: SeSyncAgentPrivilege	2320	msiexec.exe
Token: SeEnableDelegationPrivilege	2320	msiexec.exe
Token: SeManageVolumePrivilege	2320	msiexec.exe
Token: SeImpersonatePrivilege	2320	msiexec.exe
Token: SeCreateGlobalPrivilege	2320	msiexec.exe
Token: SeCreateTokenPrivilege	2320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2320	msiexec.exe
Token: SeLockMemoryPrivilege	2320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2320	msiexec.exe
Token: SeMachineAccountPrivilege	2320	msiexec.exe
Token: SeTcbPrivilege	2320	msiexec.exe
Token: SeSecurityPrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeLoadDriverPrivilege	2320	msiexec.exe
Token: SeSystemProfilePrivilege	2320	msiexec.exe
Token: SeSystemtimePrivilege	2320	msiexec.exe
Token: SeProfSingleProcessPrivilege	2320	msiexec.exe
Token: SeIncBasePriorityPrivilege	2320	msiexec.exe
Token: SeCreatePagefilePrivilege	2320	msiexec.exe
Token: SeCreatePermanentPrivilege	2320	msiexec.exe
Token: SeBackupPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeShutdownPrivilege	2320	msiexec.exe
Token: SeDebugPrivilege	2320	msiexec.exe
Token: SeAuditPrivilege	2320	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2320	msiexec.exe
Token: SeChangeNotifyPrivilege	2320	msiexec.exe
Token: SeRemoteShutdownPrivilege	2320	msiexec.exe
Token: SeUndockPrivilege	2320	msiexec.exe
Token: SeSyncAgentPrivilege	2320	msiexec.exe
Token: SeEnableDelegationPrivilege	2320	msiexec.exe
Token: SeManageVolumePrivilege	2320	msiexec.exe
Token: SeImpersonatePrivilege	2320	msiexec.exe
Token: SeCreateGlobalPrivilege	2320	msiexec.exe
Token: SeCreateTokenPrivilege	2320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2320	msiexec.exe
Token: SeLockMemoryPrivilege	2320	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2320	msiexec.exe
2320	msiexec.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1764	2360	1stinstall.exe	88
PID 1764 wrote to memory of 4612	1764	cmd.exe	91
PID 4612 wrote to memory of 2320	4612	jre-1.7.0_13.exe	99
PID 4224 wrote to memory of 1324	4224	msiexec.exe	101
PID 2320 wrote to memory of 3508	2320	msiexec.exe	102
PID 4224 wrote to memory of 3196	4224	msiexec.exe	106
PID 4224 wrote to memory of 4332	4224	msiexec.exe	109
PID 4332 wrote to memory of 3268	4332	MsiExec.exe	110
PID 4332 wrote to memory of 3660	4332	MsiExec.exe	123
PID 4332 wrote to memory of 5116	4332	MsiExec.exe	113
PID 4332 wrote to memory of 4572	4332	MsiExec.exe	114
PID 4332 wrote to memory of 2860	4332	MsiExec.exe	115
PID 4332 wrote to memory of 1444	4332	MsiExec.exe	116
PID 4332 wrote to memory of 2552	4332	MsiExec.exe	117
PID 4332 wrote to memory of 3264	4332	MsiExec.exe	118
PID 4332 wrote to memory of 2392	4332	MsiExec.exe	119
PID 2392 wrote to memory of 1212	2392	javaw.exe	120
PID 1212 wrote to memory of 5096	1212	cmd.exe	122
PID 2392 wrote to memory of 3660	2392	javaw.exe	123
PID 3660 wrote to memory of 948	3660	cmd.exe	125
PID 2392 wrote to memory of 3052	2392	javaw.exe	126
PID 3052 wrote to memory of 2992	3052	cmd.exe	128
PID 2392 wrote to memory of 3432	2392	javaw.exe	129
PID 3432 wrote to memory of 1724	3432	cmd.exe	131
PID 2392 wrote to memory of 2072	2392	javaw.exe	132
PID 2072 wrote to memory of 732	2072	cmd.exe	134
PID 4612 wrote to memory of 3452	4612	jre-1.7.0_13.exe	136
PID 4612 wrote to memory of 2080	4612	jre-1.7.0_13.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jave\1stinstall.exe
"C:\Users\Admin\AppData\Local\Temp\jave\1stinstall.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3493.tmp\3494.tmp\3495.bat C:\Users\Admin\AppData\Local\Temp\jave\1stinstall.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Users\Admin\AppData\Local\Temp\jave\jre\jre-1.7.0_13.exe
    jre\jre-1.7.0_13.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_13\jre1.7.0_13.msi" METHOD=joff SKIPLICENSE=1 PROG=0 ENDDIALOG=0
      4⤵
      Badlisted process makes network request
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\MSI5C90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\MSI5C90.tmp" C:\Program Files (x86)\Java\jre7\;C
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3508
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\AU\au.msi" ALLUSERS=1 /qn
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
  - - C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
      "C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.7.0_13-b20
      4⤵
      System Location Discovery: System Language Discovery
      PID:2080

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9E1CD69740749539AB2AAECDA749A9C8 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1324
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3196
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 954DE9DA404BA79A15C63C47B5DF06FD E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\rt.pack" "C:\Program Files (x86)\Java\jre7\lib\rt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3268
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\charsets.pack" "C:\Program Files (x86)\Java\jre7\lib\charsets.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3660
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\deploy.pack" "C:\Program Files (x86)\Java\jre7\lib\deploy.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5116
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\javaws.pack" "C:\Program Files (x86)\Java\jre7\lib\javaws.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4572
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\plugin.pack" "C:\Program Files (x86)\Java\jre7\lib\plugin.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:2860
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jsse.pack" "C:\Program Files (x86)\Java\jre7\lib\jsse.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1444
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:2552
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -Xshare:dump
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:3264
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" com.sun.servicetag.Installer -source "Windows JRE installer"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C WMIC computersystem get model
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC computersystem get model
        5⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5096
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C WMIC computersystem get model
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC computersystem get model
        5⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:948
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C WMIC computersystem get manufacturer
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC computersystem get manufacturer
        5⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:2992
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C WMIC bios get serialnumber
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3432
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC bios get serialnumber
        5⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1724
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C WMIC cpu get manufacturer
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2072
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC cpu get manufacturer
        5⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599d51.rbs

Path C:\Config.Msi\e599d51.rbs
Size 10KB
SHA256 b77d9b7df551102115d48900f09c9fb3f14436fa2cacb070cc4a841ba485217f
MD5 a858d90901ebe7118fe35100bd583db5
SHA1 cb1eb01cd8055803aea0af0adefab36ee25fb833
SHA512 dbb6280a46b658bb730797fee165c04be3b9fc7bc894fb9a8c6426f6a6577637df5398e24a02d12cffdee9f320e8fc0b110c00a108b0c95ff402b2c9b653490a
SSDEEP 192:4BC1CiGRAef2S0SPG0Gx2S0SP80eqrb5pHixwba:4B+pOKS/GKSVRHW
TLSH
T13F224142AA1182D2F8C22B38CB171B203FB3D7D58704175B19CEC9645F67B582F9968B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\Program Files (x86)\Java\jre7\bin\MSVCR100.dll
Size 752KB
SHA256 1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
MD5 67ec459e42d3081dd8fd34356f7cafc1
SHA1 1738050616169d5b17b5adac3ff0370b8c642734
SHA512 9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
SSDEEP 12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
TLSH
T16DF49D11B692C073C57220300629D7B24D7BB9711434986BBBD99F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsAccessBridge-32.dll

Path C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge-32.dll
Size 93KB
SHA256 16e3a368dd3a3db8cdd786a2a5b54e5e779c28d6c3b2e10baee00432182af11d
MD5 f78a65aadc6590943371dc606d1746a6
SHA1 d7f019a65556e237ae99ab47320f4812da092547
SHA512 a75a9a9bb362a5ea0b05cc9f861db688daee811bf49d1c39fa64b82482e9472af6c8a4246bda504a5d64d0bc95c22e3f7634cf63b1c618576beecfcc078592b3
SSDEEP 1536:7XuoxGytjofvbsFdtvSHcicjlLTmvZkAB0k2OXERr8YKcT3lAdCd:VxrFofvUiZcpfwkAtE9J3lA0
TLSH
T16E936D637780D573C5730174883DC625B77E3B3D8272D283ABA6219BAF52582D23A736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll
Size 3.2MB
SHA256 ed7c0c190779609496d70cf2c8d389b3c08b0ac7a91dd4656d44a34bf4586cc7
MD5 6c0e14ba5f9d9e3bc5380dbb5fd55b00
SHA1 5960b7dca444a39d05530dd7e14bd7d5a467745e
SHA512 efd1512d792a6490458afd0f70bc888d20579b5c8c605a83a0331d721d8b00b61a205476c11d5fdf625cccb97df44d1a0be1449e1736c6d4c89c73553d02387d
SSDEEP 49152:Z7r9MvuL6h+yixXfYk02+nirwzhB+XdbtW4Iu4+sgsyWW2SghYkEeZGa4EII1LOR:OHhU02uiXdBn4hg1WW2bYuVcv/GT4
TLSH
T165F56C22E651C131E8C202F396BE7B7CD5689235433E6AEB36E425845F305F33A356A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deploy.dll

Path C:\Program Files (x86)\Java\jre7\bin\deploy.dll
Size 349KB
SHA256 61a7373bf1453511d59902950407a28a0cca94bf2d27824fa27fc1a2b13e3055
MD5 6bf0f15dad78470e8601ee1d22a8f1a6
SHA1 5506bfa54302f00e58b524827e49dd36fadae77c
SHA512 22b185fc2fe8080b9d12945aa64021cf9a213e8211ec712e78f7bab639b8bd76638a181310617e6298cd64503eec9db0fce8e37ec83abbb846432a296a277966
SSDEEP 6144:sWTpX4KkOZF1W+8KxjdOBkuZvJvvxIW1aZdas:sWTpoqZF1W+8KWvq+a6s
TLSH
T1F5743A42A3D8D561F1BB2E711D3A5624487ABC168B31C9CFB29C3D4D9F336D18A7831A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deployJava1.dll

Path C:\Program Files (x86)\Java\jre7\bin\dtplugin\deployJava1.dll
Size 763KB
SHA256 fd52acaa54bf3df0ff6bf856640ba4e216da1a439c098768a3d745f776c75db7
MD5 bb8996fe972847b5879fde24f24f034e
SHA1 9c496566a932d9d3835e4d9fed4d905f5ad9c87b
SHA512 322c201c7f0c3ca0094f420a38d3cd578c3d1a79c15f4b3e681c5f8fba85b1cc2ad87ca953c892b68c3477600559052e6188d44510b45e8ded5fa597d1ba84b6
SSDEEP 12288:5fcAi+MX64+1TnipQQOPUDowwQ7ZnWN81vn3VvEQUeWCQXTjz1bL1sP:50AlMXl+1GQQOKowwQ7ZK8x3GsP
TLSH
T13EF4051333E9C137F1B3E7309D7592719ABABCAD9830C54E639026AD4E71B81C964B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npdeployJava1.dll

Path C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
Size 840KB
SHA256 97f559280a172b55a2708d7e7bed6aa7b1b4673718bcdd3833f47d23cd7acda9
MD5 2616b4d6d04f18c579b7861f02b0b592
SHA1 e5c174c49b77d5ab94072ab5c3af15c3ef77ee35
SHA512 e858c0c6b947cbd3a60ad27ef6ed2ddfad132c6ae450843f6e657bf2ba6a9983e9c731916d643a9e04b6609f44ac20fe791e76cf0b655f52f8f8cf73366c84f4
SSDEEP 24576:a21+aNQG9XiD9hCLNVjIBoIU0tgR4xWIh8Za:a62D9wLNVjhl4U3Za
TLSH
T1F6052A1373E8D13BF1B3EB30993492754ABABC6D5C35C54F6391666E5E30A80CA24B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Java\jre7\bin\javaw.exe
Size 170KB
SHA256 1ab604867d19f20687811a47a5d0c5e1d63c2f9984b73116928310ca8362dc11
MD5 abc4230e67c8e68e070a22c1e4a8f673
SHA1 058475602675d2645e970c0dda86f9b61c723621
SHA512 730d8aa5d9819954bbf8a7dc2c9e8288a5014f0f18daaa39fe5d3fae8c793fe826c0fa4a9bd64a30a01e271ee743c18ec63c860aca11fde5da3745f41da7fb4b
SSDEEP 3072:40I0sgwhxCofzB7iG5Hg2JPmXpf2TBfhQgjZqMNwYZzT:40mXxhBHHg2JmXt2TBjvnRT
TLSH
T1DE049D61B180C072E567107289A9CEB05A77BC7E58B0844F7BED36790EB33D1826979F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Java\jre7\bin\javaws.exe
Size 256KB
SHA256 c6d0e2905a4312bbf610fe06bdb7c76ac1a78b2f9ec50eafef94586e10d7cd61
MD5 fbe59f564dfeebbfcdbbdfab54c64501
SHA1 d88e33642106029254a7bfcf766c5e57134eb45d
SHA512 6845700db80097fc7268ff780fa1e0c5aa2bc1dcda828300756d3ab67151eacef4ddc60e10e913570bf72229285bf1d51ef97638273b886f9ce2c08734d06cbb
SSDEEP 6144:2hwRaTrnmaZs31lhTW2cHhAPpIMkXDRvyiZz:Fcnmaa3A2cCPpezRvyip
TLSH
T11B446B6173E09032E0B3593099BA9B314D7FBC766A70C54E63983A2D1E71BC0D9B5B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
Size 142KB
SHA256 286b09386a29b4accb3775dd3d118e5748cef34e3b4ee0f8246b6c73f07f446d
MD5 eeb1a6cbde41c1c0b5fb03606cf20792
SHA1 faa10050be527605ace0a268e078e9a07bf3088e
SHA512 34f8c00f1dddb157e84c0a082997e7b0b7f72cf21e91cc502d6ea2cb6102bc858afd23e1cc614af76e41f50d9f873838202ba01d115d560c613c10e51a0dfb81
SSDEEP 3072:WWAAbbhiQ3glCG18HMfaTBf3sRD0WAzOg:P/PEVAGWHTTBvsRwVig
TLSH
T1DBE39EA167D0C17FD4BB16BA80EEAB7C6E78BB0157641CC712CC2B5526007F45A362EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsdetect.dll

Path C:\Program Files (x86)\Java\jre7\bin\wsdetect.dll
Size 134KB
SHA256 f081f7d67c1d7d4d01cb42f25d70d71b30032beb6fb84f664a14118cb9950b53
MD5 663224414878ade4bd2ad51d9be663d5
SHA1 f2f71ea90b313ad7f427d21e170f9ba0c8099a51
SHA512 3ba3d49ee6620de2ff2101e148592a38b4ce858ab58e924ca51128c14a1462c1306cda4b6689446cde925c22fd55f92b4ae8320c8f1b1e58be1c481897d749a1
SSDEEP 3072:xEuQLaMZe27BBvQL1d9Kkbz9BzXtuxf2LJ5X3l8HuDfm1iwspj/:xEDLaItfv+Yk3vkxLODfm1Cpj/
TLSH
T1DFD37C117753C0B6D08322385A26D7769A6AFF21DB7A81C737E6376E9E303C16938346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.pack

Path C:\Program Files (x86)\Java\jre7\lib\charsets.pack
Size 1.3MB
SHA256 eace6bcf8a0b9c68b00bfe5e0a9ab4bd41163ca7a067d7b43d2afe3cfc97b50d
MD5 ba1a3b762fe37d50bee0166c873180d0
SHA1 2aa2ea8da823e6751bdcd2698c583459cb89af9c
SHA512 2cd082c44b9438ee2820f7cd54962b67b92ad195f70a10fa83d56289cb14057111b58ec510762be234facc68ceca4c12e1b75bd85ab4d8088fbe2c05b25a691a
SSDEEP 12288:4KvuzHfxrXJwmb5yyWMxXpyDy64BqYHqohfn2WY/n3OEDgsa1diCjp4t:4KWTd5wmbJXse/Hrn2Jn3ht
TLSH
T10655E6037E6D3A55D61E6F3146BDCF169337A1197A570EEB9A08AB08DEE20F31111BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deploy.pack

Path C:\Program Files (x86)\Java\jre7\lib\deploy.pack
Size 1.5MB
SHA256 88e2cdeb1f014400363a5546df9fe00aef66fb0ed18d9a8a3ee5110faeab1e5b
MD5 47f45733fa15786c566536260f422347
SHA1 e084d9fdc674dea21a9de5db101ef2be50abf144
SHA512 4c4b1053840728a97d3a2cb7bca42703e1858dbf9ec1d3540aef48583d9a4adaa59077ca302c2b3b20daaa1474327b9be2cae2727209600626d861d644563da5
SSDEEP 24576:eb72aDP/gFAmKV/qGxrd7jF+pV0o8vU+iJpj1Za4uzQ19zMbrjm81hSgSf8UmoPi:eTxesbdcu
TLSH
T1F77505A329C7346BE3A10F3917765B25043BF15822637B0AF524E3FCEA351A2EF18556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

localedata.pack

Path C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack
Size 735KB
SHA256 a8ce2cb69080f7949f0533e3d7c65526aac4385f352eae1b3afbec77e3c172df
MD5 5b69fe5711596e6546202833d7be1f2f
SHA1 2a7b75c511d07b0786f911bd8867872b483a2e17
SHA512 3a29691e97ef78d6cccbf62cb5e454312894a1e187db44c3cf21cbb11f7a9f14b18cd4f9059d2392f51bb76adae96474a5bd842b55b16d3101f0dd5f2f9c2f5b
SSDEEP 12288:u4syQjAgM4fIuskcXrh0uGTwj0ehh/k9SoBUaBYu:UAgXzcXr2uUw4eh5iUAv
TLSH
T14EF4FB93608BB59BFF900B3807720F2415BFE96D15536B49B5A4B3BCDB721A3EE504A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Program Files (x86)\Java\jre7\lib\i386\jvm.cfg
Size 686B
SHA256 c471d622198461715f245d478484fc7c8de533313c56e922931a875460a5aa88
MD5 5147cce789cd18ad6b2996eb89e5d866
SHA1 756f1fffe96ef581f0d4d47253523544c89a2622
SHA512 55f53adb70b1cf741cdf0dee74d92d2bf4c96954a760afae289972a0ea9bb27bc5eb4df1bd41829c7c484211fcb294fe296a4d560d8a1cdbb8c707b3bf2a79a6
TLSH
T1C801FE6B81466776638210A77940289CAB62D03CE217BCA61088EE983D03C7CA517C56
MD5 SHA1 SHA512 TLSH

Submit Download

win32_MoveNoDrop32x32.gif

Path C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
TLSH
T100C08C88F34888828A4AD2384874138C68A4C4BB8A224B88144A2A94A2935A2C1D0302
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.pack

Path C:\Program Files (x86)\Java\jre7\lib\javaws.pack
Size 201KB
SHA256 4f914a851b712ba6e4a3a769098d80be3d30e4c39965da6dc0a1bd415b30d438
MD5 98282e4e02d2855278237ac9cc1d0e0e
SHA1 62e2eee5eac07e78eb741d3dba3cc9ebe0d88da2
SHA512 38f421c2748087e8eae100db0fca8b824187ce0a17ff5b5a40956cf144e0dd40e083cc95495a0fa0fc488c4a73330ad24e883e741945b151c1a836bd1225eb28
SSDEEP 3072:cMalUgKmH3aVv39026Sg0nzrORSsNtLvHoGKF07tCUWnKfnTwXsti5IFY:cF5Py0+mRpbhCUoInsLeFY
TLSH
T166149E077F065062E7E26A758175A7522367C2066A3237B36D48111DCEC9AC78F3FACE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.pack

Path C:\Program Files (x86)\Java\jre7\lib\jsse.pack
Size 139KB
SHA256 3e2aa2d1d16f21dc5d861322858a4b2e3273b42ce45c527d6837aafc95f5ce56
MD5 17b4b98361f888c8e5a2a3d3678f3ff1
SHA1 a6ebbb7478f7eeb0606021848e77424adc618305
SHA512 86135ea5aaf0dc0f12b1b512560e8e5ce677d7e58e0ff78706e1c7646e714a67c9a03fa2ae0f7d92ead521fcb9755bf9dc05ac1b6f3d4885a7324315c5144a8f
SSDEEP 3072:NHCrI5+JFhShYlBQlX/4lUKgGCCCCMcJDrzACll7:NirI5+JFhS6l1UpciCj
TLSH
T185D38C177F0B4107D6D23A7660F4B396537AD201367A27936F4A0A98CDCA8E2DB1DED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin.pack

Path C:\Program Files (x86)\Java\jre7\lib\plugin.pack
Size 476KB
SHA256 c8e2d89864d1947380cacfd25bcdb305a5377a86d6b92d74609a9129f7afa8ef
MD5 0ba5822bc86b10f3dd37518c41097f87
SHA1 ccc1721dfa6da3276d171387473de988d28215b7
SHA512 4a5c691fe12b8c4b8bd04ba9f58e5d913412ef9b78c0597c3b5dbb51db13b4d82aa7085fc60acc8c00be4abb5ae2eeb37cb1d59fd9fd1cfc2c16404d3598a60f
SSDEEP 6144:d5FMCaGp3N9Cr5NGYNIMIQ/roVD9RnVPp6zs68Z/sf3qGLedWpeNi+:BMSRMNGwMVDOu/qaG4WcNV
TLSH
T1E1A4C007BB07505AE6BA197210F5A7022324C3542B33AB67EE585464CDC6DCBDE3FAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.pack

Path C:\Program Files (x86)\Java\jre7\lib\rt.pack
Size 13.0MB
SHA256 e64b29c5de893b701a6e63246bbe80cb2de19dac752ec41723afcb920c322587
MD5 854bc313aaf980362025b194c1a36c5c
SHA1 ab3ed280d263234e349b99ed39d5f73302ff469f
SHA512 9cf9b75727e96ceb59aa2e1177877015153067a4aaa5c2b909919d688b7d2693e9352fb63e0f6721d44f1b94f83b6e0bd7b4b77e8f428b5d941e838ab421df12
SSDEEP 196608:V6ejuEmVgggLYJ4NCpGAnkB/GjnR6AZYiXs:V6ejpSgggLYJ4NCp+KRHZvs
TLSH
T123D64A037A8F790AE3911F3046B163A6027AE20422773B57BE143BB8DE961D3FD15DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UTC

Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\UTC
Size 27B
SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
MD5 7da9aa0de33b521b3399a4ffd4078bdb
SHA1 f188a712f77103d544d4acf91d13dbc664c67034
SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
MD5 SHA1 SHA512

Submit Download

HST10

Path C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\HST10
Size 27B
SHA256 3144bc5353ebbd941cdccbbd9f5fb5a06f38abf5cc7b672111705c9778412d08
MD5 715dc3fcec7a4b845347b628caf46c84
SHA1 1b194cdd0a0dc5560680c33f19fc2e7c09523cd1
SHA512 72ab4b4ad0990cce0723a882652bf4f37aac09b32a8dd33b56b1fbf25ac56ae054328909efd68c8243e54e449d845fb9d53dd95f47eaaf5873762fcd55a39662
MD5 SHA1 SHA512

Submit Download

4DD39726D4B55AC3B4119B35A893323C_109D983612043F6131CC62F7E16F02E2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_109D983612043F6131CC62F7E16F02E2
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

60E31627FDA0A46932B0E5948949F2A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
Size 1KB
SHA256 64e94ea72dffb576571358d070cfe7ff5cbd6edb11d86492f818ca73bbaffd5d
MD5 f8d3904655f1dfd5082a1e9c68b3e526
SHA1 d1df59f63a480c5615dc9e98659398b8406fb049
SHA512 60bcfab16e91c4ac09fa3dbc710da31cb039678e979a70d0a11c1634c9c7f00f23e910e10990aa1ebec9846730dc4a85bb0a693caf1cfbe5d54962794c16330e
TLSH
T1243157690851377354A13775C99B8DD79EF293911BA2D84AC2644A460822FCA1FC80F7
MD5 SHA1 SHA512 TLSH

Submit Download

4DD39726D4B55AC3B4119B35A893323C_109D983612043F6131CC62F7E16F02E2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4DD39726D4B55AC3B4119B35A893323C_109D983612043F6131CC62F7E16F02E2
Size 400B
SHA256 34a4090601041789dba8ed4b3566b555023bc4830ad29ffbed9cc228b04a220b
MD5 68de646d3fe059e030e2701902665850
SHA1 b080d135fae780c0254a6b4d516de02c6f6e6764
SHA512 d8d98fc9dcb490ed2c8eb8791ad5e5f73a600b6012f933b2cfc73d0d10ebfbf193d49ab6802abc175e0261be051511fa0b36e4969c9274462746a28ecc7b9dd0
TLSH
T12EE07D143ABEC11DF0B3CD7D8CE1A031765DF502085109F918118699A716D10CCB3536
MD5 SHA1 SHA512 TLSH

Submit Download

4DD39726D4B55AC3B4119B35A893323C_109D983612043F6131CC62F7E16F02E2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4DD39726D4B55AC3B4119B35A893323C_109D983612043F6131CC62F7E16F02E2
Size 400B
SHA256 5965725c25b87d5651f113d9a5a50579f2d05f83f6297317cd5a6149cd20964e
MD5 6fa03a10c74e4c5408ff36c06c99878b
SHA1 26a5501d8262b226287c0d214752fc9f429fd960
SHA512 62cbf51c90ab271b61fe8eb05093b60e447640437d70499bf9238f2d17b148a7e6639b424ec9e71179a9369f5c4c1e6a9b09244c5e7a9cd83be0197ebfdf08f9
TLSH
T17DE07D1435FEC12DF0B3CD798CE56031765DF512045109FA1800D655A712C10CCF3536
MD5 SHA1 SHA512 TLSH

Submit Download

60E31627FDA0A46932B0E5948949F2A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
Size 182B
SHA256 23074e77da59b7ea12313c794a1626ecd27880cfb2de539837140a0ce1024312
MD5 cb80b8ead30f9eddb2907753f27eb7f0
SHA1 5723d7396b727dc4b7e6925ae16f00896737742d
SHA512 56e7eb45ce4d19b000a8fc4c928991e3d3882e1ae9cc83ec0d6a733a4401ba1bad45c90bd42a82a8ecf1442f77bc352f9a03f2923ddc364272c01be033b3abb5
TLSH
T1D3C08C0827188206F2910F7E086105209B3279008A03C32A4B3C12584838B600C7B801
MD5 SHA1 SHA512 TLSH

Submit Download

D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC
Size 404B
SHA256 cda6f9123ecb2fec969799554834643eff81d23abaea99fc48da8a30d2ef8fe9
MD5 b76c80553cb92dd9198c23bc010206ee
SHA1 2f122ad11c412ff9f1e27f56dc35295d5094cd6c
SHA512 6e961683b5503fe277cf1dbc34b7dd00da0f6fdf5751993aa5e860380471edca84a5375aa38be7db2d8771422ad0950436a6ec08b6610ac28d4556e16e57ccb0
TLSH
T10FE07D1422F7C27DF1A1D638C9E9B127495BF721080521FF00A4630ABB52B014C51E31
MD5 SHA1 SHA512 TLSH

Submit Download

Data1.cab

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_13\Data1.cab
Size 26.6MB
SHA256 b1a7884b52d277a932cbbd9975827a020c03e0d275bf772a117a7b69633878e8
MD5 7db98758a12119b37b5f157017666bc4
SHA1 18d3bdd73f76977386cb93e3214e3eeddc15b35e
SHA512 cd8f581ca41008e085948adae6520f16cd5a506d42c701005c20e8de2bca10f82d990b3ea88709de6ab01523654413432ea70ffd1d10a90c8efe4668db1be87e
SSDEEP 786432:LQkmgz8nvXpknzam56v8wN7/tNgkech+pFSUU94:LQkmgzKRknnITtNvec4F5k4
TLSH
T12B5733EDEDC08D78B0486B48491AAFDCEBEC3CA5608A857C479446F1543E6C8F6748F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jre1.7.0_13.msi

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_13\jre1.7.0_13.msi
Size 863KB
SHA256 5ea5b3ebdfa98fac1e9e15f3fd206d5271dcda5bb1f0fc072bc721062c1b748b
MD5 0513648e8214241fb22dc7df80747f77
SHA1 808e605768c1783324e268ff90203133f75054c7
SHA512 f7fefe13a7a358c829c863727612bf8e83fcd33d71e519803ab818826008ab19742a723e3df5351535442a09768d922d534440b1c84fae790017af781b893bed
SSDEEP 12288:esre9oV3m+R0sZvrURsfxokk3QflWrlhcBX:esC9oV3vxelkUQOhcBX
TLSH
T103153B12F681B236E59607310DBB8B59067EBEB52B3561C733C8729A9FF13D30925782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3495.bat

Path C:\Users\Admin\AppData\Local\Temp\3493.tmp\3494.tmp\3495.bat
Size 49B
SHA256 cac3aa9d48fd03d6d296bef01a3fa1212b6944a83161ad84c206d197aa9adf43
MD5 ee514618f9b18c613b828c690991bf3b
SHA1 aade7e13da0f19740e03cbc9e85c14d10c91f53f
SHA512 34ad557f3ae34c6e03f50cc791e1a815970915cea353e44529fc467d4171e23e4e2779be230da16795b8b9561f8b06ba9d1002170708148e8ef732755024d69d
MD5 SHA1 SHA512

Submit Download

MSI5C30.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5C30.tmp
Size 181KB
SHA256 0bef42348b9a4eb6b70df13c763c30497a1b9dc01707970a8afb9a2ac4c7e5f7
MD5 3b5e843d0e7be0a92a6e11607d84d30a
SHA1 525b8df85359748a27143952a1e0c3f398030fed
SHA512 e354f08b39af9de6bca91505eb15e9d442f6ff07a9e3f5d3d3624ba17dc6085229f18111f230e601967e4f69e89bd8714914afad505e1ec15e51ff22ba41c7b0
SSDEEP 3072:UKUBHYyMj+5yjPOxHi1q0Y8P4ok9dDLWt4f:UK3ye+5mPaiA0YxoYXG4
TLSH
T11B045C12F241D03BF5A701345A7E8EB35A7C6931676EB0C3B3950AAAAFB03D15939317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5C90.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5C90.tmp
Size 265KB
SHA256 c2b74111399f06ebe8de5ec0659ab6e78d2fe5315d8fedf473f5ab9947ad5d81
MD5 bd2a821cb5dd0e4b17386407d3be2503
SHA1 07aa634279c6b4c62f81a558ace4ca4461037170
SHA512 bb972308a539b3a9b69c016dda1f68e9c903803914455f664ced0a9fff3fba249b677e2d4657e9820a83442e4149665c59a58f963fbd2f6a1c790fa24b2d28ca
SSDEEP 3072:uTteeYjzL448rbu2wDlWrqAhHNyoSCJQH0XbUELdjPwjRDK:A+j2riTDlWrlhnHCWRq
TLSH
T13344281026D092B6F5F7123245F99B59193EFA715B3622CB7364238E9AF0BD24C79B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 24KB
SHA256 938b4be0bc977da20e925f465973d0c7710702754889e7a96796315867bd1ccf
MD5 be76f18391fdeeec179f2a25e4dc4382
SHA1 393ac4b4290562586aa37641290db35d8c18fcf6
SHA512 cc2f3b92ff6a604f5b01b682f396c0ed171160f50fac56d494bda98eaefe09abf17db1a3cd7fea68dbd0670990da5e87dc4259c26abddb7f3a459aebe0adf644
SSDEEP 192:c8PT2InLBktLsDTjBNRu5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mv:c8L2IWt4V3sTigiTbKM51G0v
TLSH
T1C3B2AA6570FFF67923E3784962A4EBED92425C3C258F8A373F840AC0971D9D136EA512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 25KB
SHA256 f8da24aeeefb22ce24a1bdb4bc9f6242ecf5098c6951ac18dda886fbc7b37bbc
MD5 998ae0870b318ee574c931bb7fe422cb
SHA1 7f5b2fe21be0a9b55e4dba51ea87cfa4b056cc8d
SHA512 f61c9e4d01c50b13d5d355bd973c0fef82bca98eb7c399cdfdcd4431a521a1d1c1be4e017ed515f7d788e3b44c7085ea4cfea1f9ef73a2f11890af4b6ff9e7bb
SSDEEP 192:c8PT2InLBktLsDTjBNRu5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mEtAM:c8L2IWt4V3sTigiTbKM51G0Ex
TLSH
T13AC2BB6570FFF67923E3784962A4EBED92425C3C258F8A373F850AC0971C9D136EA512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 26KB
SHA256 295c739945e19a5b581c9e070175bd62ee7defcdaba755207f7bcc8e7270d684
MD5 1b27651212bfbc79a838b959d904976e
SHA1 3f820598d4e71c658b768bada92d8da2bd5ab3fd
SHA512 db4da0209bbaa1820df5e5486ce5aedd58b07b0071aa13ac3ad8f9a3d792d9d3f1bf6ad6d68a2cfe68ddf658befe98d9f5c93d37c695d87dfe875d92ebcc15e1
SSDEEP 192:c8PT2InLBktLsDTjBNRu5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mEtAbQnI:c8L2IWt4V3sTigiTbKM51G0Ey7
TLSH
T1EBC2CC6570FFE67923E3784962A4EBED92425C3C258F8A373FC50AC0971C9D036EA512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 26KB
SHA256 3032a6cbd46cb1957a00db8555beab619dc4836ad91be50011de3289ac1fc50e
MD5 390549435c139b5dd9a8e070be0f10d0
SHA1 1e274fc978e81b2c888def1ab85dbb061e779cef
SHA512 c04145c820ba02fdee2e554350f2c2f4e0b49b0624fc463922e58cc73a888a499d7605fc27bd25dcc23784ba8266c3a0cdf104c40d5314aebffa71a058076d9f
SSDEEP 192:c8PT2InLBktLsDTjBNRu5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mEtAbQnjUnb:c8L2IWt4V3sTigiTbKM51G0Eyoe
TLSH
T1C0C2DD6570FFF27923E3784962A4EBED92465C3C258F8A363FC50AC0971C9D076EA512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 27KB
SHA256 9f74858c746db5b1b29e82d7027e1824ecc16e33588faecf407a0f23979ea6fa
MD5 e9c89e7b5ce1aa2fa5be707fc506e384
SHA1 80b72416f7bbf7e0eae6a5aeed37b2affb92280c
SHA512 7316d10dee6a7bcbd50cedf7df93243e9b67f40dbfbc77bb6afb0a299b5befd3354db31359f9f16f68979e6adb09df521fe107089b7e762394fc77a51aada813
SSDEEP 192:c8PT2InLBktLsDTjBNRu5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mEtAbQnjUn0fc:c8L2IWt4V3sTigiTbKM51G0Eyod0
TLSH
T1CDC2DF6570FFE27923E3784962A4EBED92465C3C258F8A363FC50AC0971C9D076EB512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 27KB
SHA256 3559cdce37108662d8302fd8f884803ad04ba9ce3f6ded85f19e9e8ae7c440bc
MD5 4029c40ecab4d2b62de7e8d6785f77a4
SHA1 498277745f82fb017cf53d43f02a5f453026b4df
SHA512 c8c6f7cf9486dfb8e57c44317ce2bc3b5d264a76cf8b155e6749208106a91f730a59550ba698f1e5b5db4c5951df609948b54e10c6bc2b02bf434108041b7754
SSDEEP 192:c8PT2InLBktLsDTjBNRu5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mEtAbQnjUn0fR:c8L2IWt4V3sTigiTbKM51G0Eyody8aix
TLSH
T197D2E06570FFE27923E3784962A4EBED92465C3C264F8A363FC50AC0971C9D076EB512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 28KB
SHA256 7ce5b393f71a98ad4710ca751907ff730080feaf306e3ef273d2c91eafd71dc7
MD5 b41f6cae577390c2aaf02ee07d21ae8c
SHA1 c1c06ab7924d3bb376d53e7aeccb231d7c7bc81c
SHA512 1930be991c9906b4f8ce6d5dec5ce9b3b607904c65d53cf88e858dd59b211ed5ce23f7e6c7d7ab0f303c8230dd0aa58e418086e7b4020209b41cec4a6bd525f3
SSDEEP 384:c8L2IWt4V3sTigiTbKM51G0Eyody8ai547:BL2I649WIKM51Yyod8i67
TLSH
T12ED2F02570FFE27923E3784962A4EBED92465C3C264F8A363FC50AC1971C9D076EB512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java_install_reg.log

Path C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
Size 2KB
SHA256 9df3d131e8693091f90521550617b61700b9329fcad0d86a0cb4ffe5c64d5208
MD5 3fab956996770719a7b3d81967582a74
SHA1 c97784e4547563c84570235c18c1b12c38901097
SHA512 390837566f486ecd8479a03a069b05205fd321de62dfe1bca5cdf82d8c13153b59eca56ddea8fc5b19e45c2a6ce9bea0e17639424be2dc1ec9d013340410adc6
TLSH
T164513B138492C3F5B112ADC27386AC9B82498DBC378C017962D6DA0FD3D5E0962A77B5
MD5 SHA1 SHA512 TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 163KB
SHA256 78ba2274fb15cdbf4b46690cd118a91eee921901cf5ee0eac26a3a3ad994b735
MD5 ecdf736a9f91f5b234c01dd12adf0ff0
SHA1 583bc19d4475c9e15b442e58dc46def5b9879cd9
SHA512 2286653f8322cef818bcf68de39e284394420b3b03b6119f9e6e6fff50ccc8c5740d68ec337cee2494821f2c804069fe0d697e5177dac0d173efd96dcd0654f4
SSDEEP 3072:8oB5+7tzxIN8YhUtiwRTiLacdlvkkegiwvSGhCo47n69N:bNtmW
TLSH
T1F1F366C7D9AD44FF24234BA3C7695C6406521A2A436E4A2D31EF92CEE151E03C95ECFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 163KB
SHA256 b4e46a9d224215a7b5cc076a4d8fccf952eef1f5d5e97c2879e57c7e6d249087
MD5 3473f143441d6f66387e939dfb587cba
SHA1 7a2746869b7fa74144e8d5f8ab0fd2aea9891818
SHA512 4d71a29039645dd5abc4b0bdd4a69602f93d6f90b23e17cbbd58210b788a2b6b7c766d428c76e84434b23245111a1ce6afe401592dd577e3d00ef86cab9ee294
SSDEEP 3072:8oB5+7tzxIN8YhUtiwRTiLacdlvkkegiwvSGhCo47n69f:bNtmw
TLSH
T13CF366C7D9AD44FF24234BA3C7695C6406521A2A436E4A2D31EF92CEE151E03C95ECFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Windows\SysWOW64\java.exe
Size 170KB
SHA256 3ad90e2b7952281eea2385d51e0519f28fe2d441072cbc56177da39f9ee867d9
MD5 4951d2d49b400a1a722bc48fadebd6f4
SHA1 941f04a047ab271036e381c219fc20855ef7333e
SHA512 5fa3abdc71330b2c6f127dd02f1fca6053492d0e6d9b2b6de2f3bfdf63223173d0185cbcf6d229424c8092b4ff9ecd17bbd5df20654e5c3e5a9708bd5526a294
SSDEEP 3072:2YQzdu7ZS9jCuntg3V/vuTehx+z9XSQ12TBfxcMjZqMN9kWRriR:LQJOhgt4/Thx+zFSc2TBTvGWd0
TLSH
T16704AE61B1C0C032E567147289A9CEB05A76BC7E58B0844F77ED367A0EB33D1826979F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2360-0-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2360-3-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2392-848-0x0000000039F00000-0x0000000039F10000-memory.dmp

Download

memory/2392-875-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/3264-841-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/4612-61-0x0000000005550000-0x0000000005551000-memory.dmp

Download

memory/4612-10-0x0000000005550000-0x0000000005551000-memory.dmp

Download