Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
29/09/2022, 09:44
Behavioral task
behavioral1
Sample
a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe
Resource
win7-20220812-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe
- Size 669KB
- Sample220929-lqg6lsada5
- SHA256 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf
- MD5 225fef16f054c69c11dfc5a22007c650
- SHA1 9ee3f21f5d6c9266c0a368bfa60076715dff6ed9
- SHA512 b20f3ce34675078174085537f982fb7702d90fefead38481ad3a3d8b34c591c4a4ae8c24fb95810b79ed71427044d2ccf501cb095e6edc64bf673400c7bd584c
- SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DbKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HW6KrKe
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- MedusaLocker
Ransomware with several variants first seen in September 2019.
- MedusaLocker payload 2 IoCs
resource yara_rule behavioral2/files/0x0006000000022e60-135.dat family_medusalocker behavioral2/files/0x0006000000022e60-136.dat family_medusalocker -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe - Executes dropped EXE 1 IoCs
pid Process 872 svhost.exe - Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\BackupUnlock.tif => C:\Users\Admin\Pictures\BackupUnlock.tif.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened for modification C:\Users\Admin\Pictures\ConvertSearch.tiff a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened for modification C:\Users\Admin\Pictures\DisableBlock.tiff a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File renamed C:\Users\Admin\Pictures\ReadRepair.raw => C:\Users\Admin\Pictures\ReadRepair.raw.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File renamed C:\Users\Admin\Pictures\RestoreComplete.raw => C:\Users\Admin\Pictures\RestoreComplete.raw.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File renamed C:\Users\Admin\Pictures\SkipSend.crw => C:\Users\Admin\Pictures\SkipSend.crw.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File renamed C:\Users\Admin\Pictures\UndoSend.tif => C:\Users\Admin\Pictures\UndoSend.tif.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File renamed C:\Users\Admin\Pictures\ConvertSearch.tiff => C:\Users\Admin\Pictures\ConvertSearch.tiff.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File renamed C:\Users\Admin\Pictures\DisableBlock.tiff => C:\Users\Admin\Pictures\DisableBlock.tiff.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File renamed C:\Users\Admin\Pictures\InvokeSwitch.tif => C:\Users\Admin\Pictures\InvokeSwitch.tif.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened for modification C:\Users\Admin\Pictures\OptimizeSave.tiff a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File renamed C:\Users\Admin\Pictures\OptimizeSave.tiff => C:\Users\Admin\Pictures\OptimizeSave.tiff.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File renamed C:\Users\Admin\Pictures\WriteResume.png => C:\Users\Admin\Pictures\WriteResume.png.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\I: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\L: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\M: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\Q: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\T: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\W: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\X: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\A: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\E: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\F: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\H: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\J: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\N: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\R: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\B: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\K: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\O: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\P: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\V: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\Y: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\S: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\U: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\Z: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3380 wmic.exe Token: SeSecurityPrivilege 3380 wmic.exe Token: SeTakeOwnershipPrivilege 3380 wmic.exe Token: SeLoadDriverPrivilege 3380 wmic.exe Token: SeSystemProfilePrivilege 3380 wmic.exe Token: SeSystemtimePrivilege 3380 wmic.exe Token: SeProfSingleProcessPrivilege 3380 wmic.exe Token: SeIncBasePriorityPrivilege 3380 wmic.exe Token: SeCreatePagefilePrivilege 3380 wmic.exe Token: SeBackupPrivilege 3380 wmic.exe Token: SeRestorePrivilege 3380 wmic.exe Token: SeShutdownPrivilege 3380 wmic.exe Token: SeDebugPrivilege 3380 wmic.exe Token: SeSystemEnvironmentPrivilege 3380 wmic.exe Token: SeRemoteShutdownPrivilege 3380 wmic.exe Token: SeUndockPrivilege 3380 wmic.exe Token: SeManageVolumePrivilege 3380 wmic.exe Token: 33 3380 wmic.exe Token: 34 3380 wmic.exe Token: 35 3380 wmic.exe Token: 36 3380 wmic.exe Token: SeIncreaseQuotaPrivilege 3980 wmic.exe Token: SeSecurityPrivilege 3980 wmic.exe Token: SeTakeOwnershipPrivilege 3980 wmic.exe Token: SeLoadDriverPrivilege 3980 wmic.exe Token: SeSystemProfilePrivilege 3980 wmic.exe Token: SeSystemtimePrivilege 3980 wmic.exe Token: SeProfSingleProcessPrivilege 3980 wmic.exe Token: SeIncBasePriorityPrivilege 3980 wmic.exe Token: SeCreatePagefilePrivilege 3980 wmic.exe Token: SeBackupPrivilege 3980 wmic.exe Token: SeRestorePrivilege 3980 wmic.exe Token: SeShutdownPrivilege 3980 wmic.exe Token: SeDebugPrivilege 3980 wmic.exe Token: SeSystemEnvironmentPrivilege 3980 wmic.exe Token: SeRemoteShutdownPrivilege 3980 wmic.exe Token: SeUndockPrivilege 3980 wmic.exe Token: SeManageVolumePrivilege 3980 wmic.exe Token: 33 3980 wmic.exe Token: 34 3980 wmic.exe Token: 35 3980 wmic.exe Token: 36 3980 wmic.exe Token: SeIncreaseQuotaPrivilege 4884 wmic.exe Token: SeSecurityPrivilege 4884 wmic.exe Token: SeTakeOwnershipPrivilege 4884 wmic.exe Token: SeLoadDriverPrivilege 4884 wmic.exe Token: SeSystemProfilePrivilege 4884 wmic.exe Token: SeSystemtimePrivilege 4884 wmic.exe Token: SeProfSingleProcessPrivilege 4884 wmic.exe Token: SeIncBasePriorityPrivilege 4884 wmic.exe Token: SeCreatePagefilePrivilege 4884 wmic.exe Token: SeBackupPrivilege 4884 wmic.exe Token: SeRestorePrivilege 4884 wmic.exe Token: SeShutdownPrivilege 4884 wmic.exe Token: SeDebugPrivilege 4884 wmic.exe Token: SeSystemEnvironmentPrivilege 4884 wmic.exe Token: SeRemoteShutdownPrivilege 4884 wmic.exe Token: SeUndockPrivilege 4884 wmic.exe Token: SeManageVolumePrivilege 4884 wmic.exe Token: 33 4884 wmic.exe Token: 34 4884 wmic.exe Token: 35 4884 wmic.exe Token: 36 4884 wmic.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4868 wrote to memory of 3380 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 85 PID 4868 wrote to memory of 3380 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 85 PID 4868 wrote to memory of 3380 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 85 PID 4868 wrote to memory of 3980 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 87 PID 4868 wrote to memory of 3980 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 87 PID 4868 wrote to memory of 3980 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 87 PID 4868 wrote to memory of 4884 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 89 PID 4868 wrote to memory of 4884 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 89 PID 4868 wrote to memory of 4884 4868 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 89 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe"C:\Users\Admin\AppData\Local\Temp\a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4868 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:872
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\svhost.exe
- Size 669KB
- SHA256 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf
- MD5 225fef16f054c69c11dfc5a22007c650
- SHA1 9ee3f21f5d6c9266c0a368bfa60076715dff6ed9
- SHA512 b20f3ce34675078174085537f982fb7702d90fefead38481ad3a3d8b34c591c4a4ae8c24fb95810b79ed71427044d2ccf501cb095e6edc64bf673400c7bd584c
- SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DbKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HW6KrKe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\svhost.exe
- Size 669KB
- SHA256 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf
- MD5 225fef16f054c69c11dfc5a22007c650
- SHA1 9ee3f21f5d6c9266c0a368bfa60076715dff6ed9
- SHA512 b20f3ce34675078174085537f982fb7702d90fefead38481ad3a3d8b34c591c4a4ae8c24fb95810b79ed71427044d2ccf501cb095e6edc64bf673400c7bd584c
- SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DbKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HW6KrKe
- MD5 SHA1 SHA512 SSDEEP