IOC Report

loading gif

Files

File Path
Type
Category
Malicious
ff0231.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
malicious
C:\Users\user\AppData\Local\Temp\nsoCFAB.tmp\xavjqrgsngv.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Temp\2wyt68ql38qw
data
dropped
clean

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ff0231.exe
"C:\Users\user\Desktop\ff0231.exe"
malicious
C:\Users\user\Desktop\ff0231.exe
"C:\Users\user\Desktop\ff0231.exe"
malicious
C:\Windows\explorer.exe
C:\Windows\Explorer.EXE
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
malicious
C:\Windows\explorer.exe
explorer.exe
malicious
C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\user\Desktop\ff0231.exe"
clean
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
clean

URLs

Name
IP
Malicious
http://www.comptesgratuit.fr/fh3c/?7nhH=Hxl0d2MH-t9Hyv&z0GdXd=ygpAwtep7WxWCgU1n5iY5amVcELu0tSIdE/9Y9Jyy4nkdNu97XXXbghTbpjnrxNYSyQT
185.53.178.54
malicious
www.prometaly.fr/fh3c/
malicious
http://www.facebook-meta.net/fh3c/?z0GdXd=WoHcE9GCxXT7wUBgkc+2l4Z3+m1n5nn1xCnIHBmko3viCo3Igm4+Oh54SxcB0NGJBR7p&7nhH=Hxl0d2MH-t9Hyv
15.197.142.173
malicious
http://www.schuette.tech/fh3c/?z0GdXd=N2vEI1OX7w/3udy+ydCYc971PZER2FJlK1gZL6lMnGSu15qwd848spLio4s8j+VNLmhX&7nhH=Hxl0d2MH-t9Hyv
5.9.96.94
malicious
http://www.teslaislandboys.com/fh3c/?7nhH=Hxl0d2MH-t9Hyv&z0GdXd=n2wKPxZ8pCyDi97rnXro6S5Jba3+KYmZJcqoataOVa/Ib+/xmeU19xREWNmNK15lIZxN
142.250.203.115
clean
http://nsis.sf.net/NSIS_Error
unknown
clean
http://nsis.sf.net/NSIS_ErrorError
unknown
clean
http://cirn.one
unknown
clean
http://www.evchargeoracle.com/fh3c/?z0GdXd=TEDmW6iEX7An5lAq1gB0cQiS4L3buUHqtO3o3qqMncoo4GVsMboScKfxnSemig/wshnV&7nhH=Hxl0d2MH-t9Hyv
34.102.136.180
clean

Domains

Name
IP
Malicious
www.comptesgratuit.fr
185.53.178.54
malicious
www.schuette.tech
5.9.96.94
malicious
facebook-meta.net
15.197.142.173
malicious
www.facebook-meta.net
unknown
malicious
www.teslaislandboys.com
unknown
malicious
www.evchargeoracle.com
unknown
malicious
www.meta-facebook.life
unknown
malicious
www.chasesecurobanking.com
unknown
malicious
evchargeoracle.com
34.102.136.180
clean
ghs.googlehosted.com
142.250.203.115
clean
meta-facebook.life
34.102.136.180
clean
There are 1 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
5.9.96.94
www.schuette.tech
Germany
malicious
185.53.178.54
www.comptesgratuit.fr
Germany
malicious
15.197.142.173
facebook-meta.net
United States
malicious
142.250.203.115
ghs.googlehosted.com
United States
clean
34.102.136.180
evchargeoracle.com
United States
clean

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\StagingInfo\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}
DriveNumber
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{ef47ea26-ec76-4a6e-8680-9e53b539546d}
Generation
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4b110390-e32a-400c-bf41-7fe93773464a}
Generation
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b8455d9b-4916-480e-8b44-905b33ca001e}
Generation
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}
Generation
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop
IconLayouts
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search
InstalledWin32AppsRevision
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001040E
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103FE
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010400
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103E6
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103E8
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103E0
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103DE
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103D0
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103CA
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103C6
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103B4
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103B2
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103AE
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010388
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010386
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010394
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010380
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001037E
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010378
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001035E
VirtualDesktop
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop
IconLayouts
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$$windows.data.signals.registrations\Current
Data
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search
InstalledWin32AppsRevision
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.101
CheckSetting
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.100
CheckSetting
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.check.101
CheckSetting
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithProgids
WMP11.AssocFile.3G2
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithProgids
WMP11.AssocFile.3GP
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithProgids
WMP11.AssocFile.3G2
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithProgids
WMP11.AssocFile.3GP
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\OpenWithProgids
WMP11.AssocFile.ADTS
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adt\OpenWithProgids
WMP11.AssocFile.ADTS
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adts\OpenWithProgids
WMP11.AssocFile.ADTS
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithProgids
WMP11.AssocFile.AIFF
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithProgids
WMP11.AssocFile.AIFF
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithProgids
WMP11.AssocFile.AIFF
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithProgids
WMP11.AssocFile.ASF
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithProgids
WMP11.AssocFile.ASX
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithProgids
WMP11.AssocFile.AU
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au3\OpenWithProgids
AutoIt3Script
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithProgids
WMP11.AssocFile.AVI
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids
Paint.Picture
clean