de994811d16c3b1e39850858a8b39dcdf404fd08caae1cf45cc44128c8d62203

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2022 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7093096a671541f8c8c27d40dddb3879.exe
Size

124KB
MD5

7093096a671541f8c8c27d40dddb3879
SHA1

c799d7eca8154f510472e1dc1e97c0b64da8843e
SHA256

de994811d16c3b1e39850858a8b39dcdf404fd08caae1cf45cc44128c8d62203
SHA512

72a1965c961b0f17f9f5d2aec23bc470e9850761486697eed895a461e0f896ebdc8a0352ef8f64e7d5914e5d7230bb616db78a363a9e80f07e43626adcd7c6b0
SSDEEP

3072:c1i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgOks5YmMOMYcYY51i/NU8F:Ki/NjO5YBgegD0PHzSv3Oai/NN

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe"	7093096a671541f8c8c27d40dddb3879.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	7093096a671541f8c8c27d40dddb3879.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	7093096a671541f8c8c27d40dddb3879.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	7093096a671541f8c8c27d40dddb3879.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	7093096a671541f8c8c27d40dddb3879.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\windows.exe	7093096a671541f8c8c27d40dddb3879.exe
File opened for modification	C:\WINDOWS\windows.exe	7093096a671541f8c8c27d40dddb3879.exe
File opened for modification	C:\WINDOWS\windows.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "369272142"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	7093096a671541f8c8c27d40dddb3879.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3360F56B-2E3C-11ED-AECB-C264E7FE3618} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "197118291"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30982729"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d9120000000000200000000001066000000010000200000006a8a7dbd46a74ed06df1d4e32ddf02e3cfa27c0679d70357fb64ed8f06ec0846000000000e80000000020000200000000dc247d9fcd11982a0763727dd2d6c480b04115b63d308473bb77e5d0f2b5800200000002b0ea0d818512eac84fb0d11ec7b05c825149aba0e32e7e63eac4c1bf84e5bec4000000062bcafcc939555befdbd0d4f6b535aa127621e812eb850197dc8e5ee9434e90403d2cda9fde4fee04f1cf87c8a967c58936cbf4feee8e0e08137304b7bf938a6	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "146805338"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30982729"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "146805338"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30982729"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005a141049c2d801	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d91200000000002000000000010660000000100002000000063d3db4f36c7608c0cef264e782094b02cf800568daa7fbb9fccb288daab4726000000000e80000000020000200000009e5acd5b147d6eb2726ce661ebfa288909d000e68608ed8f5a09d2b114e35386200000007358c00b3a4489eb3490fc7f7bb1d9e9aefa7742afc45964cf4125a65442b4d7400000009ab65ca3e46858b39565ba7228ede9fef54c9e9c32cade76187f96d908f9ea6987146fa38ea61667ae3eaa27789161a6274f20de0144faaf1775250cd39c6ad5	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b067001149c2d801	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	7093096a671541f8c8c27d40dddb3879.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1308	7093096a671541f8c8c27d40dddb3879.exe
1308	7093096a671541f8c8c27d40dddb3879.exe
1308	7093096a671541f8c8c27d40dddb3879.exe
1308	7093096a671541f8c8c27d40dddb3879.exe
1308	7093096a671541f8c8c27d40dddb3879.exe
1308	7093096a671541f8c8c27d40dddb3879.exe
1308	7093096a671541f8c8c27d40dddb3879.exe
1308	7093096a671541f8c8c27d40dddb3879.exe
1308	7093096a671541f8c8c27d40dddb3879.exe
1308	7093096a671541f8c8c27d40dddb3879.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1308	7093096a671541f8c8c27d40dddb3879.exe
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
4224	IEXPLORE.EXE
4224	IEXPLORE.EXE
4224	IEXPLORE.EXE
4224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1924	1308	7093096a671541f8c8c27d40dddb3879.exe	82
PID 1308 wrote to memory of 1924	1308	7093096a671541f8c8c27d40dddb3879.exe	82
PID 1924 wrote to memory of 4224	1924	IEXPLORE.EXE	83
PID 1924 wrote to memory of 4224	1924	IEXPLORE.EXE	83
PID 1924 wrote to memory of 4224	1924	IEXPLORE.EXE	83
PID 1308 wrote to memory of 4776	1308	7093096a671541f8c8c27d40dddb3879.exe	84
PID 1308 wrote to memory of 4776	1308	7093096a671541f8c8c27d40dddb3879.exe	84
PID 1308 wrote to memory of 4412	1308	7093096a671541f8c8c27d40dddb3879.exe	85
PID 1308 wrote to memory of 4412	1308	7093096a671541f8c8c27d40dddb3879.exe	85
PID 1308 wrote to memory of 4412	1308	7093096a671541f8c8c27d40dddb3879.exe	85
PID 4412 wrote to memory of 2064	4412	cmd.exe	87
PID 4412 wrote to memory of 2064	4412	cmd.exe	87
PID 4412 wrote to memory of 2064	4412	cmd.exe	87
PID 1308 wrote to memory of 3552	1308	7093096a671541f8c8c27d40dddb3879.exe	88
PID 1308 wrote to memory of 3552	1308	7093096a671541f8c8c27d40dddb3879.exe	88
PID 1308 wrote to memory of 3552	1308	7093096a671541f8c8c27d40dddb3879.exe	88
PID 3552 wrote to memory of 2756	3552	cmd.exe	90
PID 3552 wrote to memory of 2756	3552	cmd.exe	90
PID 3552 wrote to memory of 2756	3552	cmd.exe	90
PID 1308 wrote to memory of 4704	1308	7093096a671541f8c8c27d40dddb3879.exe	91
PID 1308 wrote to memory of 4704	1308	7093096a671541f8c8c27d40dddb3879.exe	91
PID 1308 wrote to memory of 4704	1308	7093096a671541f8c8c27d40dddb3879.exe	91
PID 4704 wrote to memory of 5044	4704	cmd.exe	93
PID 4704 wrote to memory of 5044	4704	cmd.exe	93
PID 4704 wrote to memory of 5044	4704	cmd.exe	93
PID 1308 wrote to memory of 4584	1308	7093096a671541f8c8c27d40dddb3879.exe	94
PID 1308 wrote to memory of 4584	1308	7093096a671541f8c8c27d40dddb3879.exe	94
PID 1308 wrote to memory of 4584	1308	7093096a671541f8c8c27d40dddb3879.exe	94
PID 4584 wrote to memory of 4836	4584	cmd.exe	96
PID 4584 wrote to memory of 4836	4584	cmd.exe	96
PID 4584 wrote to memory of 4836	4584	cmd.exe	96
PID 1308 wrote to memory of 3892	1308	7093096a671541f8c8c27d40dddb3879.exe	97
PID 1308 wrote to memory of 3892	1308	7093096a671541f8c8c27d40dddb3879.exe	97
PID 1308 wrote to memory of 3892	1308	7093096a671541f8c8c27d40dddb3879.exe	97
PID 3892 wrote to memory of 2520	3892	cmd.exe	99
PID 3892 wrote to memory of 2520	3892	cmd.exe	99
PID 3892 wrote to memory of 2520	3892	cmd.exe	99
PID 1308 wrote to memory of 3120	1308	7093096a671541f8c8c27d40dddb3879.exe	100
PID 1308 wrote to memory of 3120	1308	7093096a671541f8c8c27d40dddb3879.exe	100
PID 1308 wrote to memory of 3120	1308	7093096a671541f8c8c27d40dddb3879.exe	100
PID 3120 wrote to memory of 3688	3120	cmd.exe	102
PID 3120 wrote to memory of 3688	3120	cmd.exe	102
PID 3120 wrote to memory of 3688	3120	cmd.exe	102
PID 1308 wrote to memory of 3332	1308	7093096a671541f8c8c27d40dddb3879.exe	103
PID 1308 wrote to memory of 3332	1308	7093096a671541f8c8c27d40dddb3879.exe	103
PID 1308 wrote to memory of 3332	1308	7093096a671541f8c8c27d40dddb3879.exe	103
PID 3332 wrote to memory of 4612	3332	cmd.exe	105
PID 3332 wrote to memory of 4612	3332	cmd.exe	105
PID 3332 wrote to memory of 4612	3332	cmd.exe	105

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2520	attrib.exe
3688	attrib.exe
4612	attrib.exe
2064	attrib.exe
2756	attrib.exe
5044	attrib.exe
4836	attrib.exe

C:\Users\Admin\AppData\Local\Temp\7093096a671541f8c8c27d40dddb3879.exe
"C:\Users\Admin\AppData\Local\Temp\7093096a671541f8c8c27d40dddb3879.exe"
1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.212ok.com/Gbook.asp?qita
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4224
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
  2⤵
  - Modifies Internet Explorer settings
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - Views/modifies file attributes
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:4836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:2520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\WINDOWS\windows.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:3688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "c:\system.exe"
    3⤵
    - Views/modifies file attributes
    PID:4612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\windows.exe

Filesize
124KB

MD5
7a41d5a2fc1fec2308e8dbec213cd107

SHA1
df8fc0b2eb41ed809183d6a901972d8fbf1b7c2f

SHA256
a7dc031e3080b7c70e4985dfe60e619373e48b6b4e1fc6002009c2377dfaa5b8

SHA512
1e3112aeaee667df99206c3237e5eaa900c27b0574089553c7240bbac7054487fbff2a12c331c14ff02d85dabdcbadc5ea67b73a9d83d2bbdb4fd5ddf8fb6f16

Download Submit
C:\system.exe

Filesize
124KB

MD5
deb8fd0b235e0249c595d8536de48bc1

SHA1
46388034ef2f238fb7bed79dc38c2cdc5e853ec4

SHA256
1edef110f51bc82ce6eb464cb35c403724982df3dc6ec73807d0d27c3cb6d54d

SHA512
e819df0c24dfc484b2b69a6766d82a54b35d0b54bd3006becf6158d900c586066a5dcdec207e73896f9cfa4ffe4ab95ca8f3228bcece2081404c4d6f115ad716

Download Submit