Analysis
-
max time kernel
151s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-10-2021 04:58
Static task
static1
Behavioral task
behavioral1
Sample
rw.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
rw.dll
Resource
win10-en-20211014
General
-
Target
rw.dll
-
Size
356KB
-
MD5
a4893ca94d909ae8a152a8afc1a66523
-
SHA1
cfe5b8b1dba12c328994b2977ef6d82138c406dc
-
SHA256
54f3ad16acb12eb0c69afc3dee0c9354a8a1477e590ce223ebe2845de8470d37
-
SHA512
d5b97a444336a8fb2b136c8215e88ce032accce9704c9a7e7006a94c2b967dc032714ac109a0732ca9bd68454c58772bf79f244ecbe6f0952837745951d24540
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File renamed C:\Users\Admin\Pictures\GrantResume.crw => C:\Users\Admin\Pictures\GrantResume.crw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\PingDeny.png => C:\Users\Admin\Pictures\PingDeny.png.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\SkipGroup.tif => C:\Users\Admin\Pictures\SkipGroup.tif.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\UninstallConvert.tif => C:\Users\Admin\Pictures\UninstallConvert.tif.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\ConnectProtect.crw => C:\Users\Admin\Pictures\ConnectProtect.crw.MUYUS rundll32.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromSet.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\ConvertFromSet.tiff => C:\Users\Admin\Pictures\ConvertFromSet.tiff.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\DenyCompare.crw => C:\Users\Admin\Pictures\DenyCompare.crw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\SwitchConvertTo.tiff => C:\Users\Admin\Pictures\SwitchConvertTo.tiff.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\BackupExit.raw => C:\Users\Admin\Pictures\BackupExit.raw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\ConnectBlock.crw => C:\Users\Admin\Pictures\ConnectBlock.crw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\PublishImport.raw => C:\Users\Admin\Pictures\PublishImport.raw.MUYUS rundll32.exe File opened for modification C:\Users\Admin\Pictures\SwitchConvertTo.tiff rundll32.exe -
Drops startup file 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Users\Admin\Favorites\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Music\desktop.ini rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI rundll32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Links\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Desktop\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini rundll32.exe File opened for modification C:\Program Files\desktop.ini rundll32.exe File opened for modification C:\Program Files (x86)\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini rundll32.exe File opened for modification C:\Users\Public\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini rundll32.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Music\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Videos\desktop.ini rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini rundll32.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Libraries\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Documents\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Downloads\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini rundll32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nothumbnail_34.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\external_extensions.json rundll32.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js rundll32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\readme.txt rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar rundll32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\readme.txt rundll32.exe File created C:\Program Files\Java\jdk1.8.0_66\db\readme.txt rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006 rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_LinkDrop32x32.gif rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms rundll32.exe File created C:\Program Files\Microsoft Office\root\Office16\1036\readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\ui-strings.js rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV rundll32.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_ja.properties rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfont.properties.ja rundll32.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_it.properties rundll32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\readme.txt rundll32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ar-ae\readme.txt rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt rundll32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html rundll32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\readme.txt rundll32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\readme.txt rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\INDUST.INF rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css rundll32.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\readme.txt rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\nl.pak rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\ui-strings.js rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_replace_signer_18.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\next-arrow-hover.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions2x.png rundll32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_same_reviewers.gif rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\ui-strings.js rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png rundll32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\readme.txt rundll32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\ui-strings.js rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms rundll32.exe File created C:\Program Files\Common Files\microsoft shared\TextConv\en-US\readme.txt rundll32.exe File created C:\Program Files (x86)\Common Files\System\msadc\readme.txt rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties rundll32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\readme.txt rundll32.exe -
Drops file in Windows directory 3 IoCs
Processes:
ShellExperienceHost.exesvchost.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\1195458082.pri ShellExperienceHost.exe File created C:\Windows\rescache\_merged\4032412167\2690874625.pri ShellExperienceHost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe 3512 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1032 vssvc.exe Token: SeRestorePrivilege 1032 vssvc.exe Token: SeAuditPrivilege 1032 vssvc.exe Token: SeIncreaseQuotaPrivilege 368 WMIC.exe Token: SeSecurityPrivilege 368 WMIC.exe Token: SeTakeOwnershipPrivilege 368 WMIC.exe Token: SeLoadDriverPrivilege 368 WMIC.exe Token: SeSystemProfilePrivilege 368 WMIC.exe Token: SeSystemtimePrivilege 368 WMIC.exe Token: SeProfSingleProcessPrivilege 368 WMIC.exe Token: SeIncBasePriorityPrivilege 368 WMIC.exe Token: SeCreatePagefilePrivilege 368 WMIC.exe Token: SeBackupPrivilege 368 WMIC.exe Token: SeRestorePrivilege 368 WMIC.exe Token: SeShutdownPrivilege 368 WMIC.exe Token: SeDebugPrivilege 368 WMIC.exe Token: SeSystemEnvironmentPrivilege 368 WMIC.exe Token: SeRemoteShutdownPrivilege 368 WMIC.exe Token: SeUndockPrivilege 368 WMIC.exe Token: SeManageVolumePrivilege 368 WMIC.exe Token: 33 368 WMIC.exe Token: 34 368 WMIC.exe Token: 35 368 WMIC.exe Token: 36 368 WMIC.exe Token: SeIncreaseQuotaPrivilege 368 WMIC.exe Token: SeSecurityPrivilege 368 WMIC.exe Token: SeTakeOwnershipPrivilege 368 WMIC.exe Token: SeLoadDriverPrivilege 368 WMIC.exe Token: SeSystemProfilePrivilege 368 WMIC.exe Token: SeSystemtimePrivilege 368 WMIC.exe Token: SeProfSingleProcessPrivilege 368 WMIC.exe Token: SeIncBasePriorityPrivilege 368 WMIC.exe Token: SeCreatePagefilePrivilege 368 WMIC.exe Token: SeBackupPrivilege 368 WMIC.exe Token: SeRestorePrivilege 368 WMIC.exe Token: SeShutdownPrivilege 368 WMIC.exe Token: SeDebugPrivilege 368 WMIC.exe Token: SeSystemEnvironmentPrivilege 368 WMIC.exe Token: SeRemoteShutdownPrivilege 368 WMIC.exe Token: SeUndockPrivilege 368 WMIC.exe Token: SeManageVolumePrivilege 368 WMIC.exe Token: 33 368 WMIC.exe Token: 34 368 WMIC.exe Token: 35 368 WMIC.exe Token: 36 368 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 3988 ShellExperienceHost.exe 3988 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.execmd.exedescription pid process target process PID 2680 wrote to memory of 3512 2680 rundll32.exe rundll32.exe PID 2680 wrote to memory of 3512 2680 rundll32.exe rundll32.exe PID 2680 wrote to memory of 3512 2680 rundll32.exe rundll32.exe PID 3512 wrote to memory of 1052 3512 rundll32.exe cmd.exe PID 3512 wrote to memory of 1052 3512 rundll32.exe cmd.exe PID 3512 wrote to memory of 1052 3512 rundll32.exe cmd.exe PID 1052 wrote to memory of 368 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 368 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 368 1052 cmd.exe WMIC.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\rw.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\rw.dll,#12⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{19CDF45A-AB26-4CD3-A80A-DC59EDB6A247}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{19CDF45A-AB26-4CD3-A80A-DC59EDB6A247}'" delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-119-0x0000000000000000-mapping.dmp
-
memory/1052-118-0x0000000000000000-mapping.dmp
-
memory/3248-120-0x00000227C7C60000-0x00000227C7C70000-memory.dmpFilesize
64KB
-
memory/3248-121-0x00000227C7CA0000-0x00000227C7CB0000-memory.dmpFilesize
64KB
-
memory/3248-122-0x00000227C7DE0000-0x00000227C7DE1000-memory.dmpFilesize
4KB
-
memory/3248-123-0x00000227CA410000-0x00000227CA411000-memory.dmpFilesize
4KB
-
memory/3512-115-0x0000000000000000-mapping.dmp
-
memory/3512-117-0x0000000010000000-0x000000001005C000-memory.dmpFilesize
368KB
-
memory/3512-116-0x0000000000AD0000-0x0000000000B7E000-memory.dmpFilesize
696KB