61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2022 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
Size

554KB
MD5

920dbc03f2b68c7858e190b329564080
SHA1

816c13db1ca80eb5673cab7a47955dea8e9b98b6
SHA256

61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee
SHA512

726ad60eeb6868487336340d90d1fb56571b1ed4cae58766db95034b82f0523dcb57f60743dba8bc3df6876a2f34d9bab94f79ba7ae81aeb6ea33c41c6ceebc4
SSDEEP

6144:imVCRD/xy7N6MQ2K2mm0Wse1/QlmznD0ui2n3R9e/l+AlK/HLKzuCMU7cDFlGI/w:iFD/xys2K2mmHs+00Ddi2n3XeN+bHIT

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\VaultCmd.exe"	reg.exe

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\585N35DY7U.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\585N35DY7U.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
3888	VaultCmd.exe
2992	typeperf.exe
3856	VaultCmd.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4316-135-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral2/memory/4316-137-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral2/memory/4316-138-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral2/memory/4316-146-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral2/memory/4316-155-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral2/memory/4796-174-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	VaultCmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	typeperf.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3180 set thread context of 4316	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	83
PID 2992 set thread context of 4796	2992	typeperf.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4436	reg.exe
4544	reg.exe
3224	reg.exe
1364	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe
3888	VaultCmd.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
Token: 1	4316	AppLaunch.exe
Token: SeCreateTokenPrivilege	4316	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	4316	AppLaunch.exe
Token: SeLockMemoryPrivilege	4316	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	4316	AppLaunch.exe
Token: SeMachineAccountPrivilege	4316	AppLaunch.exe
Token: SeTcbPrivilege	4316	AppLaunch.exe
Token: SeSecurityPrivilege	4316	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	4316	AppLaunch.exe
Token: SeLoadDriverPrivilege	4316	AppLaunch.exe
Token: SeSystemProfilePrivilege	4316	AppLaunch.exe
Token: SeSystemtimePrivilege	4316	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	4316	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	4316	AppLaunch.exe
Token: SeCreatePagefilePrivilege	4316	AppLaunch.exe
Token: SeCreatePermanentPrivilege	4316	AppLaunch.exe
Token: SeBackupPrivilege	4316	AppLaunch.exe
Token: SeRestorePrivilege	4316	AppLaunch.exe
Token: SeShutdownPrivilege	4316	AppLaunch.exe
Token: SeDebugPrivilege	4316	AppLaunch.exe
Token: SeAuditPrivilege	4316	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	4316	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4316	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	4316	AppLaunch.exe
Token: SeUndockPrivilege	4316	AppLaunch.exe
Token: SeSyncAgentPrivilege	4316	AppLaunch.exe
Token: SeEnableDelegationPrivilege	4316	AppLaunch.exe
Token: SeManageVolumePrivilege	4316	AppLaunch.exe
Token: SeImpersonatePrivilege	4316	AppLaunch.exe
Token: SeCreateGlobalPrivilege	4316	AppLaunch.exe
Token: 31	4316	AppLaunch.exe
Token: 32	4316	AppLaunch.exe
Token: 33	4316	AppLaunch.exe
Token: 34	4316	AppLaunch.exe
Token: 35	4316	AppLaunch.exe
Token: SeDebugPrivilege	3888	VaultCmd.exe
Token: SeDebugPrivilege	2992	typeperf.exe
Token: SeDebugPrivilege	3856	VaultCmd.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4316	AppLaunch.exe
4316	AppLaunch.exe
4316	AppLaunch.exe
4316	AppLaunch.exe
4316	AppLaunch.exe
4796	AppLaunch.exe
4796	AppLaunch.exe
4316	AppLaunch.exe
4316	AppLaunch.exe
4316	AppLaunch.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4316	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	83
PID 3180 wrote to memory of 4316	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	83
PID 3180 wrote to memory of 4316	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	83
PID 3180 wrote to memory of 4316	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	83
PID 3180 wrote to memory of 4316	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	83
PID 3180 wrote to memory of 4316	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	83
PID 3180 wrote to memory of 4316	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	83
PID 4316 wrote to memory of 4044	4316	AppLaunch.exe	84
PID 4316 wrote to memory of 4044	4316	AppLaunch.exe	84
PID 4316 wrote to memory of 4044	4316	AppLaunch.exe	84
PID 4316 wrote to memory of 208	4316	AppLaunch.exe	85
PID 4316 wrote to memory of 208	4316	AppLaunch.exe	85
PID 4316 wrote to memory of 208	4316	AppLaunch.exe	85
PID 4316 wrote to memory of 224	4316	AppLaunch.exe	87
PID 4316 wrote to memory of 224	4316	AppLaunch.exe	87
PID 4316 wrote to memory of 224	4316	AppLaunch.exe	87
PID 4316 wrote to memory of 2748	4316	AppLaunch.exe	89
PID 4316 wrote to memory of 2748	4316	AppLaunch.exe	89
PID 4316 wrote to memory of 2748	4316	AppLaunch.exe	89
PID 208 wrote to memory of 4436	208	cmd.exe	92
PID 208 wrote to memory of 4436	208	cmd.exe	92
PID 208 wrote to memory of 4436	208	cmd.exe	92
PID 2748 wrote to memory of 3224	2748	cmd.exe	94
PID 2748 wrote to memory of 3224	2748	cmd.exe	94
PID 2748 wrote to memory of 3224	2748	cmd.exe	94
PID 224 wrote to memory of 4544	224	cmd.exe	93
PID 224 wrote to memory of 4544	224	cmd.exe	93
PID 224 wrote to memory of 4544	224	cmd.exe	93
PID 4044 wrote to memory of 1364	4044	cmd.exe	95
PID 4044 wrote to memory of 1364	4044	cmd.exe	95
PID 4044 wrote to memory of 1364	4044	cmd.exe	95
PID 3180 wrote to memory of 3888	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	96
PID 3180 wrote to memory of 3888	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	96
PID 3180 wrote to memory of 3888	3180	61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe	96
PID 3888 wrote to memory of 1632	3888	VaultCmd.exe	103
PID 3888 wrote to memory of 1632	3888	VaultCmd.exe	103
PID 3888 wrote to memory of 1632	3888	VaultCmd.exe	103
PID 1632 wrote to memory of 2288	1632	cmd.exe	105
PID 1632 wrote to memory of 2288	1632	cmd.exe	105
PID 1632 wrote to memory of 2288	1632	cmd.exe	105
PID 3888 wrote to memory of 2992	3888	VaultCmd.exe	106
PID 3888 wrote to memory of 2992	3888	VaultCmd.exe	106
PID 3888 wrote to memory of 2992	3888	VaultCmd.exe	106
PID 2992 wrote to memory of 4796	2992	typeperf.exe	109
PID 2992 wrote to memory of 4796	2992	typeperf.exe	109
PID 2992 wrote to memory of 4796	2992	typeperf.exe	109
PID 2992 wrote to memory of 4796	2992	typeperf.exe	109
PID 2992 wrote to memory of 4796	2992	typeperf.exe	109
PID 2992 wrote to memory of 4796	2992	typeperf.exe	109
PID 2992 wrote to memory of 4796	2992	typeperf.exe	109
PID 2992 wrote to memory of 3856	2992	typeperf.exe	110
PID 2992 wrote to memory of 3856	2992	typeperf.exe	110
PID 2992 wrote to memory of 3856	2992	typeperf.exe	110

C:\Users\Admin\AppData\Local\Temp\61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe
"C:\Users\Admin\AppData\Local\Temp\61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\585N35DY7U.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\585N35DY7U.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\585N35DY7U.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\585N35DY7U.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:3224
- C:\Users\Admin\AppData\Local\Temp\VaultCmd.exe
  "C:\Users\Admin\AppData\Local\Temp\VaultCmd.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /d "C:\Windows\explorer.exe, C:\Users\Admin\AppData\Local\Temp\VaultCmd.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /d "C:\Windows\explorer.exe, C:\Users\Admin\AppData\Local\Temp\VaultCmd.exe" /f
      4⤵
      Modifies WinLogon for persistence
      PID:2288
- - C:\Users\Admin\AppData\Local\Temp\typeperf.exe
    "C:\Users\Admin\AppData\Local\Temp\typeperf.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\VaultCmd.exe
      "C:\Users\Admin\AppData\Local\Temp\VaultCmd.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\VaultCmd.exe.log

Filesize
224B

MD5
33fe65aefdd54d746621e77615d65b49

SHA1
ee39605365280eeb998e52187bb7b0b754b6941a

SHA256
6f62b06a657a489ffd5eb2ee418809b2b8017bc6e1ca7c303476d43a046ac6b6

SHA512
5112e615fc51377326574cbad681ec4f492d4fc27479f7d8313f1f7d2a12c2ae44a1820e8128edc7e3ee01e43aedfba313c252b7b343c8fd5627fd92e0121a0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\VaultCmd.exe

Filesize
11KB

MD5
b571cd24128879c2ad9086303a8dfddc

SHA1
84ceae0866be13f019bc86a31eaddf6980c6a9da

SHA256
388ad7ca4e6403b8804269cd6c73f6a5e3a232b1f1c63687c515da77b0406a78

SHA512
646219a8d925453f8b2b1a0a7a7e4be389e024563e387f44f481e0564032bb16e2b58359a38037be935cdaa77342ec440fa8655b0df8c72e244c7dc5d4d00a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\VaultCmd.exe

Filesize
11KB

MD5
b571cd24128879c2ad9086303a8dfddc

SHA1
84ceae0866be13f019bc86a31eaddf6980c6a9da

SHA256
388ad7ca4e6403b8804269cd6c73f6a5e3a232b1f1c63687c515da77b0406a78

SHA512
646219a8d925453f8b2b1a0a7a7e4be389e024563e387f44f481e0564032bb16e2b58359a38037be935cdaa77342ec440fa8655b0df8c72e244c7dc5d4d00a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\VaultCmd.exe

Filesize
11KB

MD5
b571cd24128879c2ad9086303a8dfddc

SHA1
84ceae0866be13f019bc86a31eaddf6980c6a9da

SHA256
388ad7ca4e6403b8804269cd6c73f6a5e3a232b1f1c63687c515da77b0406a78

SHA512
646219a8d925453f8b2b1a0a7a7e4be389e024563e387f44f481e0564032bb16e2b58359a38037be935cdaa77342ec440fa8655b0df8c72e244c7dc5d4d00a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\typeperf.exe

Filesize
554KB

MD5
920dbc03f2b68c7858e190b329564080

SHA1
816c13db1ca80eb5673cab7a47955dea8e9b98b6

SHA256
61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee

SHA512
726ad60eeb6868487336340d90d1fb56571b1ed4cae58766db95034b82f0523dcb57f60743dba8bc3df6876a2f34d9bab94f79ba7ae81aeb6ea33c41c6ceebc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\typeperf.exe

Filesize
554KB

MD5
920dbc03f2b68c7858e190b329564080

SHA1
816c13db1ca80eb5673cab7a47955dea8e9b98b6

SHA256
61813e2eaf167ce0b7db5db00760d2247128b918d69c5cdd6d8c86ccb978e9ee

SHA512
726ad60eeb6868487336340d90d1fb56571b1ed4cae58766db95034b82f0523dcb57f60743dba8bc3df6876a2f34d9bab94f79ba7ae81aeb6ea33c41c6ceebc4

Download Submit
memory/2992-163-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/2992-162-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3180-133-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3180-132-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3180-165-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3856-179-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3856-178-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3888-156-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3888-154-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3888-164-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/4316-135-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4316-137-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4316-138-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4316-155-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4316-146-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4796-174-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download