Analysis
-
max time kernel
1231s -
max time network
1562s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-03-2021 22:49
Static task
static1
General
-
Target
SpaceX Starbase Invite.xlsm
-
Size
242KB
-
MD5
b46aa5f81d293bc7791a720b6447d01f
-
SHA1
a8ab19110c407b6e04e460fa8bc33685868a026d
-
SHA256
2355f05bca712ce31b1fef911395862eb34e73db7a3ca0a6bee2664024e47518
-
SHA512
8c3b80ff99948aa1f67ed9b6a9c5b2b1225b9246b71b7a8f97661bd054339f67e82aa7f118fed8462ce20ff1a58d9f07cb07c91f1220ac48d8fd1502f1be1e93
Malware Config
Extracted
dridex
111
77.220.64.135:443
107.180.90.10:6601
31.24.158.56:7275
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
wmic.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 812 1444 wmic.exe -
Processes:
resource yara_rule behavioral1/memory/1604-16-0x000000006B760000-0x000000006B792000-memory.dmp dridex_ldr behavioral1/memory/1604-18-0x000000006B760000-0x000000006B781000-memory.dmp dridex_ldr -
Blocklisted process makes network request 12 IoCs
Processes:
wmic.exeflow pid process 7 812 wmic.exe 11 812 wmic.exe 12 812 wmic.exe 13 812 wmic.exe 14 812 wmic.exe 16 812 wmic.exe 18 812 wmic.exe 19 812 wmic.exe 20 812 wmic.exe 21 812 wmic.exe 24 812 wmic.exe 26 812 wmic.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\TypeLib\{0BB2FFD1-40F6-4BE5-A765-DD3FB28CA7C9}\2.0 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\TypeLib\{0BB2FFD1-40F6-4BE5-A765-DD3FB28CA7C9}\2.0\FLAGS EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\TypeLib\{0BB2FFD1-40F6-4BE5-A765-DD3FB28CA7C9}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1656 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
wmic.exeEXCEL.EXEdescription pid process Token: SeIncreaseQuotaPrivilege 812 wmic.exe Token: SeSecurityPrivilege 812 wmic.exe Token: SeTakeOwnershipPrivilege 812 wmic.exe Token: SeLoadDriverPrivilege 812 wmic.exe Token: SeSystemProfilePrivilege 812 wmic.exe Token: SeSystemtimePrivilege 812 wmic.exe Token: SeProfSingleProcessPrivilege 812 wmic.exe Token: SeIncBasePriorityPrivilege 812 wmic.exe Token: SeCreatePagefilePrivilege 812 wmic.exe Token: SeBackupPrivilege 812 wmic.exe Token: SeRestorePrivilege 812 wmic.exe Token: SeShutdownPrivilege 812 wmic.exe Token: SeDebugPrivilege 812 wmic.exe Token: SeSystemEnvironmentPrivilege 812 wmic.exe Token: SeRemoteShutdownPrivilege 812 wmic.exe Token: SeUndockPrivilege 812 wmic.exe Token: SeManageVolumePrivilege 812 wmic.exe Token: 33 812 wmic.exe Token: 34 812 wmic.exe Token: 35 812 wmic.exe Token: SeIncreaseQuotaPrivilege 812 wmic.exe Token: SeSecurityPrivilege 812 wmic.exe Token: SeTakeOwnershipPrivilege 812 wmic.exe Token: SeLoadDriverPrivilege 812 wmic.exe Token: SeSystemProfilePrivilege 812 wmic.exe Token: SeSystemtimePrivilege 812 wmic.exe Token: SeProfSingleProcessPrivilege 812 wmic.exe Token: SeIncBasePriorityPrivilege 812 wmic.exe Token: SeCreatePagefilePrivilege 812 wmic.exe Token: SeBackupPrivilege 812 wmic.exe Token: SeRestorePrivilege 812 wmic.exe Token: SeShutdownPrivilege 812 wmic.exe Token: SeDebugPrivilege 812 wmic.exe Token: SeSystemEnvironmentPrivilege 812 wmic.exe Token: SeRemoteShutdownPrivilege 812 wmic.exe Token: SeUndockPrivilege 812 wmic.exe Token: SeManageVolumePrivilege 812 wmic.exe Token: 33 812 wmic.exe Token: 34 812 wmic.exe Token: 35 812 wmic.exe Token: SeShutdownPrivilege 1656 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1656 EXCEL.EXE 1656 EXCEL.EXE 1656 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
wmic.exerundll32.exedescription pid process target process PID 812 wrote to memory of 2024 812 wmic.exe rundll32.exe PID 812 wrote to memory of 2024 812 wmic.exe rundll32.exe PID 812 wrote to memory of 2024 812 wmic.exe rundll32.exe PID 2024 wrote to memory of 1604 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 1604 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 1604 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 1604 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 1604 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 1604 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 1604 2024 rundll32.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\SpaceX Starbase Invite.xlsm"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\wmic.exewmic os get /format:"C:\Users\Admin\AppData\Roaming\1DF1C.xsl"1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:/Windows/Temp//n10tn.dll ValidateLog2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:/Windows/Temp//n10tn.dll ValidateLog3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\1DF1C.xslMD5
ea71d43dea5ac0a4f1687d4b4c0f7a73
SHA106abfa510041b5eadaaad4aed4a196eca63f475a
SHA2569aecdb029868fb446bad577f10695472497bb2bfe87d30b3ef13da834742efaa
SHA5127e597efd1045738621da21c0972f46f360fe13d9988085fc29b479bb73d7de0506d6eef396eca1e6526505b5874760eaa73c1e09fcd149846306edd5bd73a40f
-
C:\Windows\Temp\n10tn.dllMD5
aca3ec396cbe8b33718eef86dd26f3c8
SHA1df6a2d47889a6bf49bb82170690a2324b498c1e2
SHA2566a081487cc498419c436fd3539a0ec4172575fc2b213f3e685a28c2871ede102
SHA512014e868d13091e76cde23b31444450130f4a783cb533924a4ff67acaa821c4071e8998aec7498a5789feab1c25f6a6b11f29c5a9b3a92adf2d6aaeb813f513f4
-
\Windows\Temp\n10tn.dllMD5
aca3ec396cbe8b33718eef86dd26f3c8
SHA1df6a2d47889a6bf49bb82170690a2324b498c1e2
SHA2566a081487cc498419c436fd3539a0ec4172575fc2b213f3e685a28c2871ede102
SHA512014e868d13091e76cde23b31444450130f4a783cb533924a4ff67acaa821c4071e8998aec7498a5789feab1c25f6a6b11f29c5a9b3a92adf2d6aaeb813f513f4
-
\Windows\Temp\n10tn.dllMD5
aca3ec396cbe8b33718eef86dd26f3c8
SHA1df6a2d47889a6bf49bb82170690a2324b498c1e2
SHA2566a081487cc498419c436fd3539a0ec4172575fc2b213f3e685a28c2871ede102
SHA512014e868d13091e76cde23b31444450130f4a783cb533924a4ff67acaa821c4071e8998aec7498a5789feab1c25f6a6b11f29c5a9b3a92adf2d6aaeb813f513f4
-
\Windows\Temp\n10tn.dllMD5
aca3ec396cbe8b33718eef86dd26f3c8
SHA1df6a2d47889a6bf49bb82170690a2324b498c1e2
SHA2566a081487cc498419c436fd3539a0ec4172575fc2b213f3e685a28c2871ede102
SHA512014e868d13091e76cde23b31444450130f4a783cb533924a4ff67acaa821c4071e8998aec7498a5789feab1c25f6a6b11f29c5a9b3a92adf2d6aaeb813f513f4
-
\Windows\Temp\n10tn.dllMD5
aca3ec396cbe8b33718eef86dd26f3c8
SHA1df6a2d47889a6bf49bb82170690a2324b498c1e2
SHA2566a081487cc498419c436fd3539a0ec4172575fc2b213f3e685a28c2871ede102
SHA512014e868d13091e76cde23b31444450130f4a783cb533924a4ff67acaa821c4071e8998aec7498a5789feab1c25f6a6b11f29c5a9b3a92adf2d6aaeb813f513f4
-
memory/272-7-0x000007FEF6F80000-0x000007FEF71FA000-memory.dmpFilesize
2.5MB
-
memory/1604-18-0x000000006B760000-0x000000006B781000-memory.dmpFilesize
132KB
-
memory/1604-17-0x00000000000F0000-0x00000000000F6000-memory.dmpFilesize
24KB
-
memory/1604-16-0x000000006B760000-0x000000006B792000-memory.dmpFilesize
200KB
-
memory/1604-10-0x0000000000000000-mapping.dmp
-
memory/1604-11-0x0000000074D11000-0x0000000074D13000-memory.dmpFilesize
8KB
-
memory/1656-2-0x000000002FFF1000-0x000000002FFF4000-memory.dmpFilesize
12KB
-
memory/1656-5-0x0000000005B10000-0x0000000005B12000-memory.dmpFilesize
8KB
-
memory/1656-3-0x0000000070E31000-0x0000000070E33000-memory.dmpFilesize
8KB
-
memory/1656-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2024-8-0x0000000000000000-mapping.dmp