6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48

Analysis

max time kernel
151s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
Size

556KB
MD5

900f7a4067193e3e4a395c6fa63f7b00
SHA1

8f8d440880e73495c9cb3ffbf37c61e7a00aaaf1
SHA256

6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48
SHA512

e14b65ac150a99c57e57c36f82dcc5349c6f0da23b6291d7dbbc0448ca3904f2818b8916320424aa7c01e3e1421cef5ab75a37f54faaf2c398408a4a9d4576c8
SSDEEP

12288:qmfGGuZBppS/EK/+7eAUxOpanp/iBfAL9rBgBbkxpTs1/fH1almP:qmfGGyfMVW7pUxjnp/p9OFkLe/gl

Score

8^/10

discovery evasion trojan

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
932	mscorsvw.exe
460	Process not Found
2024	mscorsvw.exe
520	mscorsvw.exe
888	mscorsvw.exe
1404	dllhost.exe
612	mscorsvw.exe
240	mscorsvw.exe

Loads dropped DLL 4 IoCs

pid	Process
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3845472200-3839195424-595303356-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3845472200-3839195424-595303356-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\F:	mscorsvw.exe
File opened (read-only)	\??\G:	mscorsvw.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\dllhost.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\system32\alg.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\locator.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\system32\vssvc.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\system32\wbengine.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\vds.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\system32\snmptrap.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\system32\vds.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\system32\fxssvc.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\alg.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File created	\??\c:\windows\system32\msdtc.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\system32\msiexec.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\system32\ui0detect.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	mscorsvw.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	mscorsvw.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	C:\Program Files\Internet Explorer\iexplore.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\program files (x86)\microsoft office\office14\groove.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	mscorsvw.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe

Drops file in Windows directory 43 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File created	\??\c:\windows\servicing\trustedinstaller.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\servicing\trustedinstaller.vir	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	\??\c:\windows\ehome\ehsched.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.vir	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{74ACD47E-D8C7-459E-BD61-43E5559E104C}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{74ACD47E-D8C7-459E-BD61-43E5559E104C}.crmlog	dllhost.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
888	mscorsvw.exe
888	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1200	6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
Token: SeShutdownPrivilege	888	mscorsvw.exe
Token: SeShutdownPrivilege	888	mscorsvw.exe
Token: SeShutdownPrivilege	888	mscorsvw.exe
Token: SeShutdownPrivilege	888	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	888	mscorsvw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 612	888	mscorsvw.exe	33
PID 888 wrote to memory of 612	888	mscorsvw.exe	33
PID 888 wrote to memory of 612	888	mscorsvw.exe	33
PID 888 wrote to memory of 240	888	mscorsvw.exe	34
PID 888 wrote to memory of 240	888	mscorsvw.exe	34
PID 888 wrote to memory of 240	888	mscorsvw.exe	34

C:\Users\Admin\AppData\Local\Temp\6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe
"C:\Users\Admin\AppData\Local\Temp\6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:932

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:520

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 19c -NGENProcess 1a0 -Pipe 1ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 19c -NGENProcess 1a0 -Pipe 1b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:240

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
622KB

MD5
d36a715e68453f0788bd06f41a32f93c

SHA1
12171c36db1dc004541e6f52c5b179ce866666f9

SHA256
821de94d7356dfa5b91861eaff2d751a435d2c21a39560e7d3b685a4d8663efd

SHA512
4e5c641f4983e88d23cc5df78337a189bb4f9680229c356fb68c196cae60eaaf3433d1d1aba6d58df0367a0909c4c578e8349b2db8f37e6a559bd715fd4dec7f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
622KB

MD5
d36a715e68453f0788bd06f41a32f93c

SHA1
12171c36db1dc004541e6f52c5b179ce866666f9

SHA256
821de94d7356dfa5b91861eaff2d751a435d2c21a39560e7d3b685a4d8663efd

SHA512
4e5c641f4983e88d23cc5df78337a189bb4f9680229c356fb68c196cae60eaaf3433d1d1aba6d58df0367a0909c4c578e8349b2db8f37e6a559bd715fd4dec7f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
650KB

MD5
eeb9637f22ba8f8bb05b206bed27f28a

SHA1
b5cdb85ed27ce44c83d422b602566e7b7e3ae60a

SHA256
c719cc3399c1ba586baa80c17706186a75a3fd89ee66c170a64aa0d0b3e14d7a

SHA512
15636e8cc17ae0ffaabaa2c1a705d9ee302d8ee9ccbb09d3fe8af02b626325cadda644a51d249442cf5173958917a6b17692b6165fbb6028ce5fa77723b089d2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
650KB

MD5
eeb9637f22ba8f8bb05b206bed27f28a

SHA1
b5cdb85ed27ce44c83d422b602566e7b7e3ae60a

SHA256
c719cc3399c1ba586baa80c17706186a75a3fd89ee66c170a64aa0d0b3e14d7a

SHA512
15636e8cc17ae0ffaabaa2c1a705d9ee302d8ee9ccbb09d3fe8af02b626325cadda644a51d249442cf5173958917a6b17692b6165fbb6028ce5fa77723b089d2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
650KB

MD5
eeb9637f22ba8f8bb05b206bed27f28a

SHA1
b5cdb85ed27ce44c83d422b602566e7b7e3ae60a

SHA256
c719cc3399c1ba586baa80c17706186a75a3fd89ee66c170a64aa0d0b3e14d7a

SHA512
15636e8cc17ae0ffaabaa2c1a705d9ee302d8ee9ccbb09d3fe8af02b626325cadda644a51d249442cf5173958917a6b17692b6165fbb6028ce5fa77723b089d2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
650KB

MD5
eeb9637f22ba8f8bb05b206bed27f28a

SHA1
b5cdb85ed27ce44c83d422b602566e7b7e3ae60a

SHA256
c719cc3399c1ba586baa80c17706186a75a3fd89ee66c170a64aa0d0b3e14d7a

SHA512
15636e8cc17ae0ffaabaa2c1a705d9ee302d8ee9ccbb09d3fe8af02b626325cadda644a51d249442cf5173958917a6b17692b6165fbb6028ce5fa77723b089d2

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
599KB

MD5
417380bcad221a0afa86ca513255b5f2

SHA1
02125894b1594afafa2fb73152701ae7640697dd

SHA256
a93cae8d177520236ef8747ee89526d879be10cf1ff27d23bd06adcdd5bd12e8

SHA512
83014163314193fcd2413c56b1ece670563a630f84b3c13194d1db23c079c161cab2048965b07a001c08b6aec964b7348068d62af8bba601498f15d22345a97f

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
599KB

MD5
417380bcad221a0afa86ca513255b5f2

SHA1
02125894b1594afafa2fb73152701ae7640697dd

SHA256
a93cae8d177520236ef8747ee89526d879be10cf1ff27d23bd06adcdd5bd12e8

SHA512
83014163314193fcd2413c56b1ece670563a630f84b3c13194d1db23c079c161cab2048965b07a001c08b6aec964b7348068d62af8bba601498f15d22345a97f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
630KB

MD5
9c7fbbfd3572867cd1c857020f179c6f

SHA1
20bbb4a9b6cbf2d4e8d44567677c3fce52157b5d

SHA256
1038854f2633f29d82baede62be8003b72110461ca56f33314ce49c1750c425c

SHA512
acc5cee07b97c4c4924eff13bda1dc1593b820e56eef80432d0c6f4f93b17fd18e9db19c307bffadf870a43cb8e1ef26376eefc7e19ba6516f6b3cca82d1bf2c

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
630KB

MD5
9c7fbbfd3572867cd1c857020f179c6f

SHA1
20bbb4a9b6cbf2d4e8d44567677c3fce52157b5d

SHA256
1038854f2633f29d82baede62be8003b72110461ca56f33314ce49c1750c425c

SHA512
acc5cee07b97c4c4924eff13bda1dc1593b820e56eef80432d0c6f4f93b17fd18e9db19c307bffadf870a43cb8e1ef26376eefc7e19ba6516f6b3cca82d1bf2c

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
549KB

MD5
80a52619f145c5b35dbf10b044cfa1b0

SHA1
4c854a13f41090dd33d844927b482ac1d6713e6a

SHA256
360cce8529db9e5a1756b1cf0f223bce2f5b443790179a3b7b243cc92a01b443

SHA512
facade758bddb47e8d17c3ed2f8cde598e3d95158f9e6322af69d6a383fac88e2e0611b4ae0ee11c93778696842198b06eed09a5132a25443c09bb15b03b3ea8

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
680KB

MD5
914da6d057d1edb2f14747e620ac8c9f

SHA1
80fbe98ae3d040577cdb008a8db2ac6f488863f4

SHA256
dd91b7cd2204ecbd480e67d15b5100ef0ee8aaa7245edd24438c4dec9a012f20

SHA512
59a913d866c81a332c6d51ca3e039eae309bc6422f644066676e2390f63297543d4a9ccc02b0e2145c129f507239e1f5a5416b110780fb21d81b89650a22ea6f

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.1MB

MD5
71a34a17ccfaeed31c575ad1b824e173

SHA1
4ac2c993919a49bbf8fb717381fd4eb5d06c9071

SHA256
b7e92523e9232d3a84fc8700176b8427b25766bbf4ccf1dbcc5c91c11cfaee37

SHA512
2753532b31191ef5d5c39ee5f4e8f5bb4b1e2a923d3e4145fa3b2906e7802d82513f9fa011ca9ac287fa8cac2f77f1bf96fa2cc991fe4e4d73ec071a4edfe0b2

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
770KB

MD5
e5d1fc4da2e5521736f9a3b40dd1bee3

SHA1
16ff79a7d8e8d523861e5e48497712dc62ff9a3a

SHA256
8c88c3c489548ed3b06492f370599e8eace369a4ac08a447160f1824177fe2e1

SHA512
79cfe48fb4b53c660adb529a1c3db1330b67a327a9414597f7a543980892fda40073581457060475600f8ed6b016244683c7949e736adbad44a29604ca8bb9a0

Download Submit
\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe

Filesize
5.2MB

MD5
49a82574903cfd2ce2006455bb5020b9

SHA1
deeb08d3c4e2665233722e1aa99f83a8784c197d

SHA256
3eb4a35b704dcbca96b0d916ad3a3c7eadb4d39dbb94338a8b22fe7d3aeb70e0

SHA512
13a4b255313f83daec0eff614c223352fdd7b07411021df14a0f888887e693fb3480f8b5d77172e2e2670b176b85c07b948c5e7a719d017bc540a83624eb3d50

Download Submit
\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
2.0MB

MD5
fee08c69b89f5f7a6f65d812c39737a1

SHA1
0c678b53c8704bfaa09064c9472a7f325b1b51a9

SHA256
7622fec947fc7320ae468cac93d359cc785513b257b79b1968a16b045da719e1

SHA512
c30a923c5cf749fdf75a0f4073b995f09fadcfeb45ebfca9a282c4992a6cec168a35a3b409593aeb5a59f874b0fea53c285d2a1aee7d8a16a558f378386853f9

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
664KB

MD5
502fc8d376a8000a9af24bef582a662f

SHA1
68b7bd2d4f3bc99f730baf153205d4350b3c5956

SHA256
c12600a05f877d25eabf9f9fc571b9760ef05581e6db9cff6a3cf1490ffa91b4

SHA512
cbdf0cc160cabf61b0edcefc3fd1c728110be4004371ceb9b8ec7087d2abbe6b10641a32a0ad7a05b5c1a87efbdd3558ee85a6ecee240feae16d9218dabd0fe3

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
576KB

MD5
0d2f1674c7efafe4296e352dc2254535

SHA1
3c824c40337fa1a3f43091e9460ac99ded020e82

SHA256
6147ec86a59d6d9306413c668fe84a8f8a7746d7f323b069d4612071cd528545

SHA512
d8da83dc3e3fbfbf015dfa202af307231b62ca6d1aa3e3aed69248e46cbd873c2492ed4d20409b965c51f7082380fcab17dac8be66479d0214571e6002de4f19

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
617KB

MD5
52712d9cfbe71b8fcd97c09a3d117ce5

SHA1
57a30c8326c2d288be23bc8455742c61cd34ae7f

SHA256
47af382f54e529e4708944b593cdc0179bfe4c07a1de948dba723935de8766b3

SHA512
970e8b26eb5835d9385e668355e59ced7e295aa9b1a81c377bdb3cc30ca0c73f9608ead640cff03f77774313dc8714fc5e38056fd6b0ce91159a0b8b08ce4d92

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
2041ca7eacd63478ddd1926b17eea4d1

SHA1
8d1bf682dccdd004dc51420e29056af9c88d1244

SHA256
50118de58d605c6d6756defa5e0dcefb9b5043e85d67d9c1ac22bb64682e48b2

SHA512
5c82281e0ef7c3bf75ca84bd3d37a9ec7badac702d506fa3b40467cdff98f0c4521d0c7859fb1dadf00d884f4494c198fd91db0a581abc16aa1f759722b75acc

Download Submit
\??\c:\windows\system32\ieetwcollector.exe

Filesize
649KB

MD5
9cef154853aec086189b3aa40164ff54

SHA1
3609ac2f7ef1373bb1b813c22a47ca2dac196a5a

SHA256
a1240788afdf682e487eb90d6af100e2be04c167692a21ba874830d016e8300d

SHA512
70d09f991fd0670ebd123ff6d1d4dc852c93dcad6dd1d5b098f82ff7e75b43c5368dbd9e61e4502c7d73cb267c2a820f12af825b97c940af9c2cdb33b1dfc76c

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
678KB

MD5
dd576c3b1071c2e789f0cae1c545944a

SHA1
957507464efc5a953ef8926d2f1a2e80c8b5812c

SHA256
d02334439cc63bd8e0f6ccece207fe43ac8a8b01532c0f18894cfcb564385c8d

SHA512
642e6d9515797f8c09fffe2ae8ec11ed0de54c7c19a2ed41d1cac25ea8107fa29a95f9a477c31421de151bd9f7f3c38c3576bb8067563585964c1ef9432dfb29

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
665KB

MD5
fbec6aa9de911ad62531477c63aa9f59

SHA1
8d14e46d3458ec46e2a85e5ebb40d28f20bfe4f0

SHA256
fd6617e7fda16bcc6316a41b1fbdcf2521166fdb6632e3d29e29e89fceb75e19

SHA512
4c3b76ad4c29864b42ddc2be3ed0f1b51a3f05b8261cc2bb00b161c3a706b69550711bf29b9f1209b06d039397ca52c0a6fd1abb711e3ac6be3dbb3d3ba79937

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
554KB

MD5
340e2f87176c299bf406e8240da9cc5a

SHA1
0a5ad98ae1752ccaeccb6c6f6e24ec14fc0d4dda

SHA256
a588185a8f5eb179826d1ef2260013dbe4a91ecec7e07be71e7f3aa69945620d

SHA512
6b42866ff522e5c2362e041d11e20eb87aa792ccdacb84bbd158c25a57046205aa1baa36a8e926da61afe09ad6d2feae0719a5d15efbade319519ca5738da0cf

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
580KB

MD5
21fe13dac3a65c5812f60aa0d6d53c31

SHA1
037aaf50c7998ef8f1a916717b9d7419e7261e6b

SHA256
41c49bb5177f8959df8a4879c66fdac58b1acf2a22b89caf84e227a7c4c398f2

SHA512
160941be64b410febd03ca3eb4f9eb9e219de97a715b78b6a883e30e6d1cef6ebe33e446587d61171894c7f9ba46c8a9dedc70e7ac155f9b1fa5f800204d0e50

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.0MB

MD5
3fee2e30053e2d31bae92bcdd3c15428

SHA1
9abe6b20cff1fc715c3a6403f87880400f58613d

SHA256
41fdd2eda1e2baa965736cff654701a9351211938d5bb5ed0c363591c480390d

SHA512
b600f6ca0d179ab97f471824b9243869192d63c671a747d9d6c33361def88913b9e2c64b3922fc75d8a1b7fda8f25e3c50ea4a17bcf3943bb9e6b27a0a87a809

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.1MB

MD5
5098e3889259903c752b815d9a5070fe

SHA1
71e6d59f1386438cd5882f3ba766df87571c7176

SHA256
7478b2cb7ec437a85194e9de5042aef933a61a675665aadce26c3e08bad690ec

SHA512
6dc11ed30e251e8f0d5e590c35b8996527fbf47ce4a947cb431061bb437763e04403ca5a4c5cbd951a31b4af303d38947fd4d12b2c8685a1af78f833e4d038a4

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
738KB

MD5
38ea665d32fd419a5842c79288de010f

SHA1
3d434f078dd8bde4b034f8f803a34ef195932fc5

SHA256
e123c00094d7540f26a4947152af8a508f27a9c20fe94aab5fc2210e0a967a08

SHA512
f82dff29b9049517dad5f55a2e45e9132ad30481c7a4f06d6283be8124501a2b62203b0f4222beae593e628d218b759cffc19dc576fb7839c01b524a88116613

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
2.0MB

MD5
7d401851b3c690aee2e3a619c6363ea5

SHA1
00296a0cfcb634b391cc10bdcdf040e4d2d6febd

SHA256
3cbbbb7545a6101ccd5963b5268bfd6d51435bf4b837477d8f1b458413c9d01d

SHA512
96b99a929a5836885e70375d9f2c522bfa2b47f5c12b5fb60a5f0a1fc09ef3cd003fbdcae361ed6e3586c49a1416a2ff43c04c8cb7886012f6cadd71415aaa87

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
622KB

MD5
d36a715e68453f0788bd06f41a32f93c

SHA1
12171c36db1dc004541e6f52c5b179ce866666f9

SHA256
821de94d7356dfa5b91861eaff2d751a435d2c21a39560e7d3b685a4d8663efd

SHA512
4e5c641f4983e88d23cc5df78337a189bb4f9680229c356fb68c196cae60eaaf3433d1d1aba6d58df0367a0909c4c578e8349b2db8f37e6a559bd715fd4dec7f

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
622KB

MD5
d36a715e68453f0788bd06f41a32f93c

SHA1
12171c36db1dc004541e6f52c5b179ce866666f9

SHA256
821de94d7356dfa5b91861eaff2d751a435d2c21a39560e7d3b685a4d8663efd

SHA512
4e5c641f4983e88d23cc5df78337a189bb4f9680229c356fb68c196cae60eaaf3433d1d1aba6d58df0367a0909c4c578e8349b2db8f37e6a559bd715fd4dec7f

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
650KB

MD5
eeb9637f22ba8f8bb05b206bed27f28a

SHA1
b5cdb85ed27ce44c83d422b602566e7b7e3ae60a

SHA256
c719cc3399c1ba586baa80c17706186a75a3fd89ee66c170a64aa0d0b3e14d7a

SHA512
15636e8cc17ae0ffaabaa2c1a705d9ee302d8ee9ccbb09d3fe8af02b626325cadda644a51d249442cf5173958917a6b17692b6165fbb6028ce5fa77723b089d2

Download Submit
\Windows\System32\dllhost.exe

Filesize
549KB

MD5
80a52619f145c5b35dbf10b044cfa1b0

SHA1
4c854a13f41090dd33d844927b482ac1d6713e6a

SHA256
360cce8529db9e5a1756b1cf0f223bce2f5b443790179a3b7b243cc92a01b443

SHA512
facade758bddb47e8d17c3ed2f8cde598e3d95158f9e6322af69d6a383fac88e2e0611b4ae0ee11c93778696842198b06eed09a5132a25443c09bb15b03b3ea8

Download Submit
\Windows\System32\dllhost.exe

Filesize
549KB

MD5
80a52619f145c5b35dbf10b044cfa1b0

SHA1
4c854a13f41090dd33d844927b482ac1d6713e6a

SHA256
360cce8529db9e5a1756b1cf0f223bce2f5b443790179a3b7b243cc92a01b443

SHA512
facade758bddb47e8d17c3ed2f8cde598e3d95158f9e6322af69d6a383fac88e2e0611b4ae0ee11c93778696842198b06eed09a5132a25443c09bb15b03b3ea8

Download Submit
memory/240-88-0x0000000140000000-0x00000001401F2000-memory.dmp

Filesize
1.9MB

Download
memory/240-99-0x0000000140000000-0x00000001401F2000-memory.dmp

Filesize
1.9MB

Download
memory/520-67-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/520-69-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/612-91-0x0000000140000000-0x00000001401F2000-memory.dmp

Filesize
1.9MB

Download
memory/612-81-0x0000000140000000-0x00000001401F2000-memory.dmp

Filesize
1.9MB

Download
memory/888-87-0x0000000140000000-0x00000001401F2000-memory.dmp

Filesize
1.9MB

Download
memory/888-72-0x0000000140000000-0x00000001401F2000-memory.dmp

Filesize
1.9MB

Download
memory/932-63-0x0000000010000000-0x00000000101B7000-memory.dmp

Filesize
1.7MB

Download
memory/932-57-0x0000000010000000-0x00000000101B7000-memory.dmp

Filesize
1.7MB

Download
memory/1200-55-0x0000000100000000-0x00000001001DA000-memory.dmp

Filesize
1.9MB

Download
memory/1200-54-0x0000000100000000-0x00000001001DA000-memory.dmp

Filesize
1.9MB

Download
memory/1404-89-0x0000000100000000-0x00000001001D9000-memory.dmp

Filesize
1.8MB

Download
memory/1404-77-0x0000000100000000-0x00000001001D9000-memory.dmp

Filesize
1.8MB

Download
memory/2024-65-0x0000000010000000-0x00000000101EB000-memory.dmp

Filesize
1.9MB

Download
memory/2024-62-0x0000000010000000-0x00000000101EB000-memory.dmp

Filesize
1.9MB

Download