njrat | 91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
Size

144KB
MD5

3dcf062bb8a1676412f65399ac258461
SHA1

78a093996ee01a05e01387904a9f32f35510edf2
SHA256

91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac
SHA512

cf2676b21452f34289b138d8077bb57342b7b10d18fcb1f7d76a293c3a2e6a44f3eacc3fdd91b78afea132064d935ab733b2af480903b6b1a1ca48ce51101f56
SSDEEP

3072:u1a5yo1K4rFnHBXo/f+QqfABAh6S1/Z7iFAtp8VX:e4yOjNpzQAABAh6Srp8

Score

10^/10

njrat admin evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

admin

nnew748.myvnc.com:1177

Mutex

749e61bd02cc756ea373bd81808cdf08

Attributes

reg_key
749e61bd02cc756ea373bd81808cdf08
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 7 IoCs

Processes:

WUDHost.exenotepad.exeAcctres.exenotepad.exeWUDHost.exeAcctres.exeWUDHost.exe

pid process

2604 WUDHost.exe
5100 notepad.exe
2816 Acctres.exe
4596 notepad.exe
4592 WUDHost.exe
2876 Acctres.exe
1104 WUDHost.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1448 netsh.exe

pid	process
2604	WUDHost.exe
5100	notepad.exe
2816	Acctres.exe
4596	notepad.exe
4592	WUDHost.exe
2876	Acctres.exe
1104	WUDHost.exe

pid	process
1448	netsh.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exenotepad.exeAcctres.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	notepad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Acctres.exe

Drops startup file 2 IoCs

Processes:

notepad.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\749e61bd02cc756ea373bd81808cdf08.exe	notepad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\749e61bd02cc756ea373bd81808cdf08.exe	notepad.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

notepad.exeWUDHost.exeWUDHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\749e61bd02cc756ea373bd81808cdf08 = "\"C:\\Users\\Admin\\AppData\\Roaming\\notepad.exe\" .."	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\749e61bd02cc756ea373bd81808cdf08 = "\"C:\\Users\\Admin\\AppData\\Roaming\\notepad.exe\" .."	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe"	WUDHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe"	WUDHost.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exenotepad.exeAcctres.exe

description	pid	process	target process
PID 4032 set thread context of 3920	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
PID 5100 set thread context of 4596	5100	notepad.exe	notepad.exe
PID 2816 set thread context of 2876	2816	Acctres.exe	Acctres.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe

pid	process
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exeWUDHost.exenotepad.exenotepad.exeAcctres.exeWUDHost.exe

description	pid	process
Token: SeDebugPrivilege	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
Token: SeDebugPrivilege	2604	WUDHost.exe
Token: SeDebugPrivilege	5100	notepad.exe
Token: SeDebugPrivilege	4596	notepad.exe
Token: SeDebugPrivilege	2816	Acctres.exe
Token: SeDebugPrivilege	1104	WUDHost.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exeWUDHost.exenotepad.exenotepad.exeAcctres.exe

description	pid	process	target process
PID 4032 wrote to memory of 3920	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
PID 4032 wrote to memory of 3920	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
PID 4032 wrote to memory of 3920	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
PID 4032 wrote to memory of 3920	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
PID 4032 wrote to memory of 3920	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
PID 4032 wrote to memory of 3920	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
PID 4032 wrote to memory of 3920	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
PID 4032 wrote to memory of 3920	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
PID 3920 wrote to memory of 5100	3920	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	notepad.exe
PID 3920 wrote to memory of 5100	3920	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	notepad.exe
PID 3920 wrote to memory of 5100	3920	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	notepad.exe
PID 4032 wrote to memory of 2604	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	WUDHost.exe
PID 4032 wrote to memory of 2604	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	WUDHost.exe
PID 4032 wrote to memory of 2604	4032	91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe	WUDHost.exe
PID 2604 wrote to memory of 2816	2604	WUDHost.exe	Acctres.exe
PID 2604 wrote to memory of 2816	2604	WUDHost.exe	Acctres.exe
PID 2604 wrote to memory of 2816	2604	WUDHost.exe	Acctres.exe
PID 5100 wrote to memory of 4596	5100	notepad.exe	notepad.exe
PID 5100 wrote to memory of 4596	5100	notepad.exe	notepad.exe
PID 5100 wrote to memory of 4596	5100	notepad.exe	notepad.exe
PID 5100 wrote to memory of 4596	5100	notepad.exe	notepad.exe
PID 5100 wrote to memory of 4596	5100	notepad.exe	notepad.exe
PID 5100 wrote to memory of 4596	5100	notepad.exe	notepad.exe
PID 5100 wrote to memory of 4596	5100	notepad.exe	notepad.exe
PID 5100 wrote to memory of 4596	5100	notepad.exe	notepad.exe
PID 5100 wrote to memory of 4592	5100	notepad.exe	WUDHost.exe
PID 5100 wrote to memory of 4592	5100	notepad.exe	WUDHost.exe
PID 5100 wrote to memory of 4592	5100	notepad.exe	WUDHost.exe
PID 4596 wrote to memory of 1448	4596	notepad.exe	netsh.exe
PID 4596 wrote to memory of 1448	4596	notepad.exe	netsh.exe
PID 4596 wrote to memory of 1448	4596	notepad.exe	netsh.exe
PID 2816 wrote to memory of 2876	2816	Acctres.exe	Acctres.exe
PID 2816 wrote to memory of 2876	2816	Acctres.exe	Acctres.exe
PID 2816 wrote to memory of 2876	2816	Acctres.exe	Acctres.exe
PID 2816 wrote to memory of 2876	2816	Acctres.exe	Acctres.exe
PID 2816 wrote to memory of 2876	2816	Acctres.exe	Acctres.exe
PID 2816 wrote to memory of 2876	2816	Acctres.exe	Acctres.exe
PID 2816 wrote to memory of 2876	2816	Acctres.exe	Acctres.exe
PID 2816 wrote to memory of 2876	2816	Acctres.exe	Acctres.exe
PID 2816 wrote to memory of 1104	2816	Acctres.exe	WUDHost.exe
PID 2816 wrote to memory of 1104	2816	Acctres.exe	WUDHost.exe
PID 2816 wrote to memory of 1104	2816	Acctres.exe	WUDHost.exe

C:\Users\Admin\AppData\Local\Temp\91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
"C:\Users\Admin\AppData\Local\Temp\91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032

C:\Users\Admin\AppData\Local\Temp\91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe
"C:\Users\Admin\AppData\Local\Temp\91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3920

C:\Users\Admin\AppData\Roaming\notepad.exe
"C:\Users\Admin\AppData\Roaming\notepad.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100

C:\Users\Admin\AppData\Roaming\notepad.exe
"C:\Users\Admin\AppData\Roaming\notepad.exe"
4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\notepad.exe" "notepad.exe" ENABLE
5⤵
- Modifies Windows Firewall
PID:1448

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
4⤵
- Executes dropped EXE
PID:4592

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
4⤵
- Executes dropped EXE
PID:2876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac.exe.log

Filesize
319B

MD5
824ba7b7eed8b900a98dd25129c4cd83

SHA1
54478770b2158000ef365591d42977cb854453a1

SHA256
d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03

SHA512
ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WUDHost.exe.log

Filesize
224B

MD5
c19eb8c8e7a40e6b987f9d2ee952996e

SHA1
6fc3049855bc9100643e162511673c6df0f28bfb

SHA256
677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a

SHA512
860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
144KB

MD5
3dcf062bb8a1676412f65399ac258461

SHA1
78a093996ee01a05e01387904a9f32f35510edf2

SHA256
91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac

SHA512
cf2676b21452f34289b138d8077bb57342b7b10d18fcb1f7d76a293c3a2e6a44f3eacc3fdd91b78afea132064d935ab733b2af480903b6b1a1ca48ce51101f56

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
144KB

MD5
3dcf062bb8a1676412f65399ac258461

SHA1
78a093996ee01a05e01387904a9f32f35510edf2

SHA256
91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac

SHA512
cf2676b21452f34289b138d8077bb57342b7b10d18fcb1f7d76a293c3a2e6a44f3eacc3fdd91b78afea132064d935ab733b2af480903b6b1a1ca48ce51101f56

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
144KB

MD5
3dcf062bb8a1676412f65399ac258461

SHA1
78a093996ee01a05e01387904a9f32f35510edf2

SHA256
91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac

SHA512
cf2676b21452f34289b138d8077bb57342b7b10d18fcb1f7d76a293c3a2e6a44f3eacc3fdd91b78afea132064d935ab733b2af480903b6b1a1ca48ce51101f56

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
13KB

MD5
87c7263aa4cb3444ef282661c4587035

SHA1
5e879db395d5ec83d7477c04fbb2fa63c6b0a6d9

SHA256
e84385b30e77b96b9461e34993a399cdcefbdea475a1ef3eb974d0744a42b46c

SHA512
1bbd4d4caad626282802e22a51211f0eb6afb08406eb8ac7868b0c06496d661c2c6ef67a506bf25f2a8296bbce82825fe00d67eda0b3caa40c9f30b4008f3426

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
13KB

MD5
87c7263aa4cb3444ef282661c4587035

SHA1
5e879db395d5ec83d7477c04fbb2fa63c6b0a6d9

SHA256
e84385b30e77b96b9461e34993a399cdcefbdea475a1ef3eb974d0744a42b46c

SHA512
1bbd4d4caad626282802e22a51211f0eb6afb08406eb8ac7868b0c06496d661c2c6ef67a506bf25f2a8296bbce82825fe00d67eda0b3caa40c9f30b4008f3426

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
13KB

MD5
87c7263aa4cb3444ef282661c4587035

SHA1
5e879db395d5ec83d7477c04fbb2fa63c6b0a6d9

SHA256
e84385b30e77b96b9461e34993a399cdcefbdea475a1ef3eb974d0744a42b46c

SHA512
1bbd4d4caad626282802e22a51211f0eb6afb08406eb8ac7868b0c06496d661c2c6ef67a506bf25f2a8296bbce82825fe00d67eda0b3caa40c9f30b4008f3426

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
13KB

MD5
87c7263aa4cb3444ef282661c4587035

SHA1
5e879db395d5ec83d7477c04fbb2fa63c6b0a6d9

SHA256
e84385b30e77b96b9461e34993a399cdcefbdea475a1ef3eb974d0744a42b46c

SHA512
1bbd4d4caad626282802e22a51211f0eb6afb08406eb8ac7868b0c06496d661c2c6ef67a506bf25f2a8296bbce82825fe00d67eda0b3caa40c9f30b4008f3426

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
13KB

MD5
87c7263aa4cb3444ef282661c4587035

SHA1
5e879db395d5ec83d7477c04fbb2fa63c6b0a6d9

SHA256
e84385b30e77b96b9461e34993a399cdcefbdea475a1ef3eb974d0744a42b46c

SHA512
1bbd4d4caad626282802e22a51211f0eb6afb08406eb8ac7868b0c06496d661c2c6ef67a506bf25f2a8296bbce82825fe00d67eda0b3caa40c9f30b4008f3426

Download Submit
C:\Users\Admin\AppData\Roaming\notepad.exe

Filesize
144KB

MD5
3dcf062bb8a1676412f65399ac258461

SHA1
78a093996ee01a05e01387904a9f32f35510edf2

SHA256
91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac

SHA512
cf2676b21452f34289b138d8077bb57342b7b10d18fcb1f7d76a293c3a2e6a44f3eacc3fdd91b78afea132064d935ab733b2af480903b6b1a1ca48ce51101f56

Download Submit
C:\Users\Admin\AppData\Roaming\notepad.exe

Filesize
144KB

MD5
3dcf062bb8a1676412f65399ac258461

SHA1
78a093996ee01a05e01387904a9f32f35510edf2

SHA256
91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac

SHA512
cf2676b21452f34289b138d8077bb57342b7b10d18fcb1f7d76a293c3a2e6a44f3eacc3fdd91b78afea132064d935ab733b2af480903b6b1a1ca48ce51101f56

Download Submit
C:\Users\Admin\AppData\Roaming\notepad.exe

Filesize
144KB

MD5
3dcf062bb8a1676412f65399ac258461

SHA1
78a093996ee01a05e01387904a9f32f35510edf2

SHA256
91d83becf536a7503dd281fbd799fbca4ea957ead28d5b3d6fc94adc30fe97ac

SHA512
cf2676b21452f34289b138d8077bb57342b7b10d18fcb1f7d76a293c3a2e6a44f3eacc3fdd91b78afea132064d935ab733b2af480903b6b1a1ca48ce51101f56

Download Submit
memory/1104-176-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/1104-174-0x0000000000000000-mapping.dmp

Download
memory/1104-177-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/1448-165-0x0000000000000000-mapping.dmp

Download
memory/2604-154-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/2604-144-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/2604-146-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/2604-138-0x0000000000000000-mapping.dmp

Download
memory/2816-148-0x0000000000000000-mapping.dmp

Download
memory/2816-153-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/2816-164-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/2876-169-0x0000000000000000-mapping.dmp

Download
memory/2876-172-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/3920-136-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/3920-134-0x0000000000000000-mapping.dmp

Download
memory/3920-143-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4032-132-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4032-152-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4032-133-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4592-158-0x0000000000000000-mapping.dmp

Download
memory/4592-173-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4592-163-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4592-167-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4596-155-0x0000000000000000-mapping.dmp

Download
memory/4596-166-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4596-162-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/4596-156-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5100-168-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/5100-147-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/5100-145-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download
memory/5100-137-0x0000000000000000-mapping.dmp

Download