a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
Size 100KB
Sample261110-n23msshx5n
SHA256 a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923
MD5 a90bbb01fdd7847cf0756920b7587205
SHA1 a0a51992318cc61f9d1eff3a350e4d686a12116a
SHA512 ae84e1c765724e816d9e21b7397bde1136f0774684dc9dad742342524801a36b67cb0fbbeda99a76d45afe153c3cfa4ac06854ffc14ea09bba671fa64dca85d5
SSDEEP 1536:VRIBscsl6mAPj0vO9jtV9pdj8yRLANL9QwO3qBluM0kE6:VRIBsf6RPjhZRucqi4f
TLSH
T1FFA331E57AE84CCAFA14923C51DAD231257CB9D1CA538B03563076321F12ED13AEB62F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
468	bcdedit.exe
3676	bcdedit.exe

Renames multiple (114) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5100	wbadmin.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe\" --ifeo"	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SystemGuard	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SystemGuard\(Default) = "Service"	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WcsHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WcsHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4248	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2088	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 4248	2088	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	89
PID 2088 wrote to memory of 5100	2088	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	90
PID 2088 wrote to memory of 3676	2088	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	93
PID 2088 wrote to memory of 468	2088	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	94
PID 3388 wrote to memory of 5860	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	98
PID 3388 wrote to memory of 2100	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	103
PID 3388 wrote to memory of 5296	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	104
PID 3388 wrote to memory of 5980	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	105
PID 3388 wrote to memory of 4164	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	106
PID 3388 wrote to memory of 3868	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	107
PID 3388 wrote to memory of 3940	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	109
PID 3388 wrote to memory of 2344	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	110
PID 3388 wrote to memory of 3528	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	111
PID 3388 wrote to memory of 2552	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	112
PID 3388 wrote to memory of 5624	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	113
PID 3388 wrote to memory of 4944	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	114
PID 3388 wrote to memory of 5844	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	115
PID 3388 wrote to memory of 5996	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	116
PID 3388 wrote to memory of 4228	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	117
PID 3388 wrote to memory of 1760	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	118
PID 3388 wrote to memory of 4532	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	119
PID 3388 wrote to memory of 5196	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	120
PID 3388 wrote to memory of 4956	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	121
PID 3388 wrote to memory of 1664	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	122
PID 3388 wrote to memory of 4636	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	123
PID 3388 wrote to memory of 5044	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	124
PID 3388 wrote to memory of 5316	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	125
PID 3388 wrote to memory of 1544	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	126
PID 3388 wrote to memory of 2996	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	127
PID 3388 wrote to memory of 3300	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	128
PID 3388 wrote to memory of 3468	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	129
PID 3388 wrote to memory of 2620	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	130
PID 3388 wrote to memory of 3872	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	131
PID 3388 wrote to memory of 1180	3388	a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe	132

C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
"C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
1⤵
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet >nul 2>&1
  2⤵
  - Interacts with shadow copies
  PID:4248
- C:\Windows\SYSTEM32\wbadmin.exe
  wbadmin delete catalog -quiet >nul 2>&1
  2⤵
  - Deletes backup catalog
  - Drops file in Windows directory
  PID:5100
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3676
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures >nul 2>&1
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:468

C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
"C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe" --service
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:5860
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:2100
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:5296
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:5980
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:4164
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:3868
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:3940
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:2344
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:3528
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:5624
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:4944
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:5844
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:5996
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:4228
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:4532
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:5196
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:4956
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:4636
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:5044
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:5316
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:1544
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:3300
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:3468
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:2620
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:3872
- C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe"
  2⤵
  PID:1180

C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
C:\Users\Admin\AppData\Local\Temp\a52c3b36d78e232b15537135a0ed752617a39c164d2f00be52a93f8df394d923.bin.exe
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

AssertTrace.rm.locked

Path C:\Users\Admin\Downloads\AssertTrace.rm.locked
Size 688KB
SHA256 c81176b2249f72a59ec3c2d3ca24775aee651cf7867d5c73382b325503e8de87
MD5 d7a3ac95da85e4ce7d8e7753f51b0d13
SHA1 f0f4bd123783f3593449c84c49b82baa41580726
SHA512 c366d2d62e0535802852a5be7bb1b7356b88a6e9e7ac1dbd7e8239ebcf255612568a7da26bf0f08b19e537b705a41fa45126c5a4175c32fc4db22f251b614fa9
SSDEEP 12288:msZzwz3GOFkAYtfdNnA+jBpIYbupiIlcrvkNmPAjxn9Bxl/5Rgw+Q1vO3b2kD0Mc:dZm3GakAYl/Asu45kn3h/j1cgMJ2
TLSH
T1E9E433B916A689BA277D14D2FC43E57BCB7C63FC123884D1EE04D28059DADE9CCC9429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupPush.vdx.locked

Path C:\Users\Admin\Downloads\BackupPush.vdx.locked
Size 659KB
SHA256 2a1c1360b67b166bbc53b98afba2ce1d29fc541e45187e26790625b722d74fbf
MD5 45037e2b9a668a82919c158f1e09d1fe
SHA1 e82ad74e39d6aac05c52c4e3aa1ebdc794849f47
SHA512 7a5c4dba2550a34c2c0750acf2e771fe5eed5773fda70763eed7bf6b0547cd87a907956da87ea83011e9344b0e12ad8296cc6168cb0b69c610be2d7cf9c60ea5
SSDEEP 12288:/fEzHqTfo5Isg180GnoEl5oW7hTPaV+gYzsHCXbTlhl8lCr+QMXYuVn:/fEzKTjN18nB8W7hTPE2ACrD7c
TLSH
T174E4238488E8F8CD4A44C14ED6D06D2865788A3E63FA10ED7652C13D985EFF1DE0EB75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectOptimize.cab.locked

Path C:\Users\Admin\Downloads\ConnectOptimize.cab.locked
Size 362KB
SHA256 ad9be36448c9952b866da03aa6c03406aada5175a0d528e572df1abb75d0d12c
MD5 94a5a411330a810eaffcd0f9ae857922
SHA1 2038bb277a29f2aabb92f94a6685005d5c0b62cb
SHA512 eee4db162da33d7884806b75b3679d8c4e1994a3500269b00d4be6e73c263d50dc770968f39c761d21af56c21278fe0ff680f9ccdd11fc811cbfb8e54bc24ab3
SSDEEP 6144:D68NitcrmbFyAPlvwe7yon+VrJAYSsbqsjJASh9O2qJ83MPrCdyrOONmt5A2bbO+:W8oOCbF79vwe7/01AAbJ9OBlu0rOOktd
TLSH
T1968423A2158F700899424062FBA405B7CDD291D07B9FE544FAD38DBE696BC78933C6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-175-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/1544-163-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/1664-155-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/1760-147-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/2088-118-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/2100-117-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/2344-129-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/2552-133-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/2620-171-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/2996-165-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/3300-167-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/3388-120-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/3468-169-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/3528-132-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/3868-125-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/3872-173-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/3940-128-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/4164-124-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/4228-146-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/4532-150-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/4576-38-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/4636-157-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/4944-137-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/4956-153-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/5044-159-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/5196-151-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/5296-119-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/5316-161-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/5624-136-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/5844-140-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/5860-2-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/5980-121-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download

memory/5996-143-0x00007FF7B6B60000-0x00007FF7B6B77000-memory.dmp

Download