Overview
overview
10Static
static
102022-06-16...ts.zip
windows7_x64
12022-06-16...ts.zip
windows10-2004_x64
12022-06-16...ke.txt
windows7_x64
12022-06-16...ke.txt
windows10-2004_x64
12022-06-16...LL.dll
windows7_x64
12022-06-16...LL.dll
windows10-2004_x64
12022-06-16...ff.bin
windows7_x64
32022-06-16...ff.bin
windows10-2004_x64
32022-06-16...bs.txt
windows7_x64
12022-06-16...bs.txt
windows10-2004_x64
12022-06-16...gv.bin
windows7_x64
32022-06-16...gv.bin
windows10-2004_x64
32022-06-16...us.txt
windows7_x64
12022-06-16...us.txt
windows10-2004_x64
12022-06-16...ry.bin
windows7_x64
32022-06-16...ry.bin
windows10-2004_x64
32022-06-16...LL.dll
windows7_x64
12022-06-16...LL.dll
windows10-2004_x64
12022-06-16...px.txt
windows7_x64
12022-06-16...px.txt
windows10-2004_x64
1SCAN-016063.html
windows7_x64
1SCAN-016063.html
windows10-2004_x64
1SCAN-01606...le.zip
windows7_x64
1SCAN-01606...le.zip
windows10-2004_x64
1SCAN-016063.pdf.msi
windows7_x64
10SCAN-016063.pdf.msi
windows10-2004_x64
10SCAN-016063.html
windows7_x64
1SCAN-016063.html
windows10-2004_x64
1SCAN-016063.pdf.msi
windows7_x64
10SCAN-016063.pdf.msi
windows10-2004_x64
10SCAN-026764.html
windows7_x64
1SCAN-026764.html
windows10-2004_x64
1Analysis
-
max time kernel
153s -
max time network
109s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-06-2022 12:52
Static task
static1
Behavioral task
behavioral1
Sample
2022-06-16-Matanbuchus-and-Cobalt-Strike-malware-and-artifacts.zip
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
2022-06-16-Matanbuchus-and-Cobalt-Strike-malware-and-artifacts.zip
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral3
Sample
2022-06-16-IOCs-for-Matanbuchus-and-Cobalt-Strike.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral4
Sample
2022-06-16-IOCs-for-Matanbuchus-and-Cobalt-Strike.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral5
Sample
2022-06-16-Matanbuchus-DLL.dll
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral6
Sample
2022-06-16-Matanbuchus-DLL.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral7
Sample
2022-06-16-extic.icu-empower-type.tiff.bin
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral8
Sample
2022-06-16-extic.icu-empower-type.tiff.bin
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral9
Sample
2022-06-16-notify.vbs.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral10
Sample
2022-06-16-notify.vbs.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral11
Sample
2022-06-16-reykh.icu-load-hunt.jpgv.bin
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral12
Sample
2022-06-16-reykh.icu-load-hunt.jpgv.bin
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral13
Sample
2022-06-16-scheduled-task-for-Matanbuchus.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral14
Sample
2022-06-16-scheduled-task-for-Matanbuchus.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral15
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-converted-to-XOR-ed-binary.bin
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral16
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-converted-to-XOR-ed-binary.bin
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral17
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-decoded-DLL.dll
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral18
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-decoded-DLL.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral19
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral20
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral21
Sample
SCAN-016063.html
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral22
Sample
SCAN-016063.html
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral23
Sample
SCAN-016063-from-html-file.zip
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral24
Sample
SCAN-016063-from-html-file.zip
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral25
Sample
SCAN-016063.pdf.msi
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral26
Sample
SCAN-016063.pdf.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral27
Sample
SCAN-016063.html
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral28
Sample
SCAN-016063.html
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral29
Sample
SCAN-016063.pdf.msi
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral30
Sample
SCAN-016063.pdf.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral31
Sample
SCAN-026764.html
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral32
Sample
SCAN-026764.html
Resource
win10v2004-20220414-en
windows10-2004_x64
General
-
Target
SCAN-016063.pdf.msi
-
Size
224KB
-
MD5
ff82937564ff59eb6207f079cdc8e43d
-
SHA1
7cfe0a71c4a2508a1af80e640ec8b1b034edb604
-
SHA256
face46e6593206867da39e47001f134a00385898a36b8142a21ad54954682666
-
SHA512
4c4c2f59ef157de6570bf16daff958d9ccdafd8ba6cf3f946cabaa413c085c05242b2499552e789f0f0bc9e1cbf0b74ec6327340d29c80a694aeddf444788ee1
Malware Config
Signatures
-
Matanbuchus
A loader sold as MaaS first seen in February 2021.
-
Blocklisted process makes network request 3 IoCs
flow pid Process 2 1504 msiexec.exe 4 1504 msiexec.exe 6 1992 msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 1736 regsvr32.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\6ca028.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\6ca027.msi msiexec.exe File opened for modification C:\Windows\Installer\6ca027.msi msiexec.exe File created C:\Windows\Installer\6ca028.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA458.tmp msiexec.exe File created C:\Windows\Installer\6ca02a.msi msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1992 msiexec.exe 1992 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1504 msiexec.exe Token: SeIncreaseQuotaPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeSecurityPrivilege 1992 msiexec.exe Token: SeCreateTokenPrivilege 1504 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1504 msiexec.exe Token: SeLockMemoryPrivilege 1504 msiexec.exe Token: SeIncreaseQuotaPrivilege 1504 msiexec.exe Token: SeMachineAccountPrivilege 1504 msiexec.exe Token: SeTcbPrivilege 1504 msiexec.exe Token: SeSecurityPrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeLoadDriverPrivilege 1504 msiexec.exe Token: SeSystemProfilePrivilege 1504 msiexec.exe Token: SeSystemtimePrivilege 1504 msiexec.exe Token: SeProfSingleProcessPrivilege 1504 msiexec.exe Token: SeIncBasePriorityPrivilege 1504 msiexec.exe Token: SeCreatePagefilePrivilege 1504 msiexec.exe Token: SeCreatePermanentPrivilege 1504 msiexec.exe Token: SeBackupPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeShutdownPrivilege 1504 msiexec.exe Token: SeDebugPrivilege 1504 msiexec.exe Token: SeAuditPrivilege 1504 msiexec.exe Token: SeSystemEnvironmentPrivilege 1504 msiexec.exe Token: SeChangeNotifyPrivilege 1504 msiexec.exe Token: SeRemoteShutdownPrivilege 1504 msiexec.exe Token: SeUndockPrivilege 1504 msiexec.exe Token: SeSyncAgentPrivilege 1504 msiexec.exe Token: SeEnableDelegationPrivilege 1504 msiexec.exe Token: SeManageVolumePrivilege 1504 msiexec.exe Token: SeImpersonatePrivilege 1504 msiexec.exe Token: SeCreateGlobalPrivilege 1504 msiexec.exe Token: SeBackupPrivilege 1812 vssvc.exe Token: SeRestorePrivilege 1812 vssvc.exe Token: SeAuditPrivilege 1812 vssvc.exe Token: SeBackupPrivilege 1992 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeRestorePrivilege 804 DrvInst.exe Token: SeRestorePrivilege 804 DrvInst.exe Token: SeRestorePrivilege 804 DrvInst.exe Token: SeRestorePrivilege 804 DrvInst.exe Token: SeRestorePrivilege 804 DrvInst.exe Token: SeRestorePrivilege 804 DrvInst.exe Token: SeRestorePrivilege 804 DrvInst.exe Token: SeLoadDriverPrivilege 804 DrvInst.exe Token: SeLoadDriverPrivilege 804 DrvInst.exe Token: SeLoadDriverPrivilege 804 DrvInst.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1504 msiexec.exe 1504 msiexec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1548 1992 msiexec.exe 32 PID 1992 wrote to memory of 1548 1992 msiexec.exe 32 PID 1992 wrote to memory of 1548 1992 msiexec.exe 32 PID 1992 wrote to memory of 820 1992 msiexec.exe 31 PID 1992 wrote to memory of 820 1992 msiexec.exe 31 PID 1992 wrote to memory of 820 1992 msiexec.exe 31 PID 1992 wrote to memory of 820 1992 msiexec.exe 31 PID 1992 wrote to memory of 820 1992 msiexec.exe 31 PID 820 wrote to memory of 1736 820 regsvr32.exe 33 PID 820 wrote to memory of 1736 820 regsvr32.exe 33 PID 820 wrote to memory of 1736 820 regsvr32.exe 33 PID 820 wrote to memory of 1736 820 regsvr32.exe 33 PID 820 wrote to memory of 1736 820 regsvr32.exe 33 PID 820 wrote to memory of 1736 820 regsvr32.exe 33 PID 820 wrote to memory of 1736 820 regsvr32.exe 33
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SCAN-016063.pdf.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1504
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\system32\regsvr32.exeregsvr32.exe -n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll2⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\regsvr32.exe-n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll3⤵
- Loads dropped DLL
PID:1736
-
-
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\AdobeFontPack\notify.vbs2⤵PID:1548
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000554" "0000000000000574"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:804
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5308336e7f515478969b24c13ded11ede
SHA18fb0cf42b77dbbef224a1e5fc38abc2486320775
SHA256889b832323726a9f10ad03f85562048fdcfe20c9ff6f9d37412cf477b4e92ff9
SHA51261ad97228cd6c3909ef3ac5e4940199971f293bdd0d5eb7916e60469573a44b6287c0fa1e0b6c1389df35eb6c9a7d2a61fdb318d4a886a3821ef5a9dab3ac24f
-
Filesize
1KB
MD578f2fcaa601f2fb4ebc937ba532e7549
SHA1ddfb16cd4931c973a2037d3fc83a4d7d775d05e4
SHA256552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
SHA512bcad73a7a5afb7120549dd54ba1f15c551ae24c7181f008392065d1ed006e6fa4fa5a60538d52461b15a12f5292049e929cffde15cc400dec9cdfca0b36a68dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ebb2bf5cede2ea9375c20458b760fb9c
SHA135ff02336318b2b671844222b015d97620a65766
SHA256f139d91b4512b0ac9e0375f8e19d47be18540943f4a5a05cf970866cb9d4415b
SHA51256038c23b51d64a8f9b9ff46cc1ad863199e524f673d2119f5cbce19c6066c952aee27740d4a1b0d2089b0334e370395efb26d1242df922ab0d17de2fc173020
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
Filesize254B
MD566ef886757911e8af04c7eff542d0e2c
SHA17be3fa27d3a4cbccfef2e45386e6b41f95681b31
SHA256c0e3dbc9f1cfd919fc552d92210843a0843803635787f60d75eee7b194eb8add
SHA5128ee3ee121ea60c97de9229c6cecf0633c4b0c43f463622eecf3634dcf022b37bc446ca67a2787a2fc89d243061f60f29cb0b663ab375a5060ac5f4a609631fdc
-
Filesize
401KB
MD58cb8cf84ab20159702e6803cd6ce364a
SHA105103f90540f3e8a9599e9f1ab6a11c791aec393
SHA25614debc481aa0a26d3a0bdeed0e56b3ae9e301220f2606aae624d57a9d0617d6f
SHA5129d9cb037b9c79f88fb89a9757f6c27848d7cc7c448594faf58cedb12925756206106235a2dd44142157e19e2c17535fa942156322768e62579aab55e6a6f64da
-
Filesize
68B
MD50308aa2c8dab8a69de41f5d16679bb9b
SHA1c6827bf44a433ff086e787653361859d6f6e2fb3
SHA2560a7e8fd68575db5f84c18b9a26e4058323d1357e2a29a5b12278e4bfa6939489
SHA5121a1ca92e3c8d52c8b5adbb3117a88d8a2a8c33eaf2f7b0d620fe006653f57f4ba0b803884616594ca31e13a1b0b59ddae52cecf044621ec44371084dac6beb72
-
Filesize
401KB
MD58cb8cf84ab20159702e6803cd6ce364a
SHA105103f90540f3e8a9599e9f1ab6a11c791aec393
SHA25614debc481aa0a26d3a0bdeed0e56b3ae9e301220f2606aae624d57a9d0617d6f
SHA5129d9cb037b9c79f88fb89a9757f6c27848d7cc7c448594faf58cedb12925756206106235a2dd44142157e19e2c17535fa942156322768e62579aab55e6a6f64da