Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-06-2022 02:19
Static task
static1
Behavioral task
behavioral1
Sample
1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe
Resource
win10v2004-20220414-en
General
-
Target
1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe
-
Size
229KB
-
MD5
94de0eca22a51386728d08d404e27338
-
SHA1
c605eb37c4a9503b74187051510d0cf7e43ac4cd
-
SHA256
1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
-
SHA512
646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 12 IoCs
Processes:
wmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exepid process 1216 wmipsxdl.exe 2036 wmipsxdl.exe 432 wmipsxdl.exe 1060 wmipsxdl.exe 1356 wmipsxdl.exe 1996 wmipsxdl.exe 1360 wmipsxdl.exe 1220 wmipsxdl.exe 2004 wmipsxdl.exe 1124 wmipsxdl.exe 1104 wmipsxdl.exe 1004 wmipsxdl.exe -
Processes:
resource yara_rule behavioral1/memory/900-55-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/900-57-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/900-58-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/900-63-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/900-64-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/900-65-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/900-66-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/900-71-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2036-83-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2036-84-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2036-85-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2036-86-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2036-87-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2036-93-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1060-105-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1060-107-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1060-112-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1996-125-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1996-130-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1220-143-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1220-144-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1220-149-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1124-163-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1124-164-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1124-170-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1004-183-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
wmipsxdl.exepid process 2036 wmipsxdl.exe -
Loads dropped DLL 12 IoCs
Processes:
1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exepid process 900 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 900 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 2036 wmipsxdl.exe 2036 wmipsxdl.exe 1060 wmipsxdl.exe 1060 wmipsxdl.exe 1996 wmipsxdl.exe 1996 wmipsxdl.exe 1220 wmipsxdl.exe 1220 wmipsxdl.exe 1124 wmipsxdl.exe 1124 wmipsxdl.exe -
Maps connected drives based on registry 3 TTPs 14 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exe1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exewmipsxdl.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmipsxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmipsxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmipsxdl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmipsxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmipsxdl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmipsxdl.exe -
Drops file in System32 directory 12 IoCs
Processes:
1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exedescription ioc process File created C:\Windows\SysWOW64\wmipsxdl.exe 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe File opened for modification C:\Windows\SysWOW64\wmipsxdl.exe wmipsxdl.exe File created C:\Windows\SysWOW64\wmipsxdl.exe wmipsxdl.exe File created C:\Windows\SysWOW64\wmipsxdl.exe wmipsxdl.exe File created C:\Windows\SysWOW64\wmipsxdl.exe wmipsxdl.exe File opened for modification C:\Windows\SysWOW64\wmipsxdl.exe wmipsxdl.exe File created C:\Windows\SysWOW64\wmipsxdl.exe wmipsxdl.exe File opened for modification C:\Windows\SysWOW64\wmipsxdl.exe 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe File opened for modification C:\Windows\SysWOW64\wmipsxdl.exe wmipsxdl.exe File opened for modification C:\Windows\SysWOW64\wmipsxdl.exe wmipsxdl.exe File opened for modification C:\Windows\SysWOW64\wmipsxdl.exe wmipsxdl.exe File created C:\Windows\SysWOW64\wmipsxdl.exe wmipsxdl.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exedescription pid process target process PID 864 set thread context of 900 864 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe PID 1216 set thread context of 2036 1216 wmipsxdl.exe wmipsxdl.exe PID 432 set thread context of 1060 432 wmipsxdl.exe wmipsxdl.exe PID 1356 set thread context of 1996 1356 wmipsxdl.exe wmipsxdl.exe PID 1360 set thread context of 1220 1360 wmipsxdl.exe wmipsxdl.exe PID 2004 set thread context of 1124 2004 wmipsxdl.exe wmipsxdl.exe PID 1104 set thread context of 1004 1104 wmipsxdl.exe wmipsxdl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exepid process 900 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 2036 wmipsxdl.exe 1060 wmipsxdl.exe 1996 wmipsxdl.exe 1220 wmipsxdl.exe 1124 wmipsxdl.exe 1004 wmipsxdl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exewmipsxdl.exedescription pid process target process PID 864 wrote to memory of 900 864 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe PID 864 wrote to memory of 900 864 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe PID 864 wrote to memory of 900 864 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe PID 864 wrote to memory of 900 864 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe PID 864 wrote to memory of 900 864 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe PID 864 wrote to memory of 900 864 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe PID 864 wrote to memory of 900 864 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe PID 900 wrote to memory of 1216 900 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe wmipsxdl.exe PID 900 wrote to memory of 1216 900 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe wmipsxdl.exe PID 900 wrote to memory of 1216 900 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe wmipsxdl.exe PID 900 wrote to memory of 1216 900 1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe wmipsxdl.exe PID 1216 wrote to memory of 2036 1216 wmipsxdl.exe wmipsxdl.exe PID 1216 wrote to memory of 2036 1216 wmipsxdl.exe wmipsxdl.exe PID 1216 wrote to memory of 2036 1216 wmipsxdl.exe wmipsxdl.exe PID 1216 wrote to memory of 2036 1216 wmipsxdl.exe wmipsxdl.exe PID 1216 wrote to memory of 2036 1216 wmipsxdl.exe wmipsxdl.exe PID 1216 wrote to memory of 2036 1216 wmipsxdl.exe wmipsxdl.exe PID 1216 wrote to memory of 2036 1216 wmipsxdl.exe wmipsxdl.exe PID 2036 wrote to memory of 432 2036 wmipsxdl.exe wmipsxdl.exe PID 2036 wrote to memory of 432 2036 wmipsxdl.exe wmipsxdl.exe PID 2036 wrote to memory of 432 2036 wmipsxdl.exe wmipsxdl.exe PID 2036 wrote to memory of 432 2036 wmipsxdl.exe wmipsxdl.exe PID 432 wrote to memory of 1060 432 wmipsxdl.exe wmipsxdl.exe PID 432 wrote to memory of 1060 432 wmipsxdl.exe wmipsxdl.exe PID 432 wrote to memory of 1060 432 wmipsxdl.exe wmipsxdl.exe PID 432 wrote to memory of 1060 432 wmipsxdl.exe wmipsxdl.exe PID 432 wrote to memory of 1060 432 wmipsxdl.exe wmipsxdl.exe PID 432 wrote to memory of 1060 432 wmipsxdl.exe wmipsxdl.exe PID 432 wrote to memory of 1060 432 wmipsxdl.exe wmipsxdl.exe PID 1060 wrote to memory of 1356 1060 wmipsxdl.exe wmipsxdl.exe PID 1060 wrote to memory of 1356 1060 wmipsxdl.exe wmipsxdl.exe PID 1060 wrote to memory of 1356 1060 wmipsxdl.exe wmipsxdl.exe PID 1060 wrote to memory of 1356 1060 wmipsxdl.exe wmipsxdl.exe PID 1356 wrote to memory of 1996 1356 wmipsxdl.exe wmipsxdl.exe PID 1356 wrote to memory of 1996 1356 wmipsxdl.exe wmipsxdl.exe PID 1356 wrote to memory of 1996 1356 wmipsxdl.exe wmipsxdl.exe PID 1356 wrote to memory of 1996 1356 wmipsxdl.exe wmipsxdl.exe PID 1356 wrote to memory of 1996 1356 wmipsxdl.exe wmipsxdl.exe PID 1356 wrote to memory of 1996 1356 wmipsxdl.exe wmipsxdl.exe PID 1356 wrote to memory of 1996 1356 wmipsxdl.exe wmipsxdl.exe PID 1996 wrote to memory of 1360 1996 wmipsxdl.exe wmipsxdl.exe PID 1996 wrote to memory of 1360 1996 wmipsxdl.exe wmipsxdl.exe PID 1996 wrote to memory of 1360 1996 wmipsxdl.exe wmipsxdl.exe PID 1996 wrote to memory of 1360 1996 wmipsxdl.exe wmipsxdl.exe PID 1360 wrote to memory of 1220 1360 wmipsxdl.exe wmipsxdl.exe PID 1360 wrote to memory of 1220 1360 wmipsxdl.exe wmipsxdl.exe PID 1360 wrote to memory of 1220 1360 wmipsxdl.exe wmipsxdl.exe PID 1360 wrote to memory of 1220 1360 wmipsxdl.exe wmipsxdl.exe PID 1360 wrote to memory of 1220 1360 wmipsxdl.exe wmipsxdl.exe PID 1360 wrote to memory of 1220 1360 wmipsxdl.exe wmipsxdl.exe PID 1360 wrote to memory of 1220 1360 wmipsxdl.exe wmipsxdl.exe PID 1220 wrote to memory of 2004 1220 wmipsxdl.exe wmipsxdl.exe PID 1220 wrote to memory of 2004 1220 wmipsxdl.exe wmipsxdl.exe PID 1220 wrote to memory of 2004 1220 wmipsxdl.exe wmipsxdl.exe PID 1220 wrote to memory of 2004 1220 wmipsxdl.exe wmipsxdl.exe PID 2004 wrote to memory of 1124 2004 wmipsxdl.exe wmipsxdl.exe PID 2004 wrote to memory of 1124 2004 wmipsxdl.exe wmipsxdl.exe PID 2004 wrote to memory of 1124 2004 wmipsxdl.exe wmipsxdl.exe PID 2004 wrote to memory of 1124 2004 wmipsxdl.exe wmipsxdl.exe PID 2004 wrote to memory of 1124 2004 wmipsxdl.exe wmipsxdl.exe PID 2004 wrote to memory of 1124 2004 wmipsxdl.exe wmipsxdl.exe PID 2004 wrote to memory of 1124 2004 wmipsxdl.exe wmipsxdl.exe PID 1124 wrote to memory of 1104 1124 wmipsxdl.exe wmipsxdl.exe PID 1124 wrote to memory of 1104 1124 wmipsxdl.exe wmipsxdl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe"C:\Users\Admin\AppData\Local\Temp\1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe"C:\Users\Admin\AppData\Local\Temp\1197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\system32\wmipsxdl.exe" C:\Users\Admin\AppData\Local\Temp\1197DC~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\SysWOW64\wmipsxdl.exe" C:\Users\Admin\AppData\Local\Temp\1197DC~1.EXE4⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\system32\wmipsxdl.exe" C:\Windows\SysWOW64\wmipsxdl.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\SysWOW64\wmipsxdl.exe" C:\Windows\SysWOW64\wmipsxdl.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\system32\wmipsxdl.exe" C:\Windows\SysWOW64\wmipsxdl.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\SysWOW64\wmipsxdl.exe" C:\Windows\SysWOW64\wmipsxdl.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\system32\wmipsxdl.exe" C:\Windows\SysWOW64\wmipsxdl.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\SysWOW64\wmipsxdl.exe" C:\Windows\SysWOW64\wmipsxdl.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\system32\wmipsxdl.exe" C:\Windows\SysWOW64\wmipsxdl.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\SysWOW64\wmipsxdl.exe" C:\Windows\SysWOW64\wmipsxdl.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\system32\wmipsxdl.exe" C:\Windows\SysWOW64\wmipsxdl.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmipsxdl.exe"C:\Windows\SysWOW64\wmipsxdl.exe" C:\Windows\SysWOW64\wmipsxdl.exe14⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
C:\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
\Windows\SysWOW64\wmipsxdl.exeFilesize
229KB
MD594de0eca22a51386728d08d404e27338
SHA1c605eb37c4a9503b74187051510d0cf7e43ac4cd
SHA2561197dc8fab822747c6fb2cfecd917a17e45b417237a5c6a99dd3585a1d2c407d
SHA512646889e0d260ff4248a47391f70a634d6852f332e6e4751d1ae9b831a7aa18bebd6f14e72a8ee76b118547995f1e512718a2bb48611795d3ca8393142dbe29c7
-
memory/432-101-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/432-91-0x0000000000000000-mapping.dmp
-
memory/864-60-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/900-62-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB
-
memory/900-64-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/900-59-0x0000000000467400-mapping.dmp
-
memory/900-63-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/900-58-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/900-71-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/900-57-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/900-54-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/900-55-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/900-66-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/900-65-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1004-176-0x0000000000467400-mapping.dmp
-
memory/1004-183-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1060-112-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1060-105-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1060-107-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1060-99-0x0000000000467400-mapping.dmp
-
memory/1104-178-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1104-168-0x0000000000000000-mapping.dmp
-
memory/1124-164-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1124-163-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1124-170-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1124-156-0x0000000000467400-mapping.dmp
-
memory/1216-80-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1216-69-0x0000000000000000-mapping.dmp
-
memory/1220-149-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1220-144-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1220-143-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1220-136-0x0000000000467400-mapping.dmp
-
memory/1356-110-0x0000000000000000-mapping.dmp
-
memory/1356-120-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1360-138-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1360-128-0x0000000000000000-mapping.dmp
-
memory/1996-125-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1996-130-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1996-118-0x0000000000467400-mapping.dmp
-
memory/2004-150-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2004-158-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2004-147-0x0000000000000000-mapping.dmp
-
memory/2036-85-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2036-84-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2036-86-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2036-87-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2036-83-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2036-93-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2036-78-0x0000000000467400-mapping.dmp