lucastealer | 03fcd10e0a552222e3d0ab3308af694af5536e8980e50c98ecfe48d32b267c59

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afef2f9f5c5e3ac4a946cea031ef20e6.msi
Size

5.7MB
MD5

afef2f9f5c5e3ac4a946cea031ef20e6
SHA1

9cc6eb3707a9f58e6d5c024b1d0d53c4724c87ad
SHA256

03fcd10e0a552222e3d0ab3308af694af5536e8980e50c98ecfe48d32b267c59
SHA512

41e17bb4ad708c705830364d10d2617b5e098597fc630e0251c72da37158388626c926810ffa78f9a4d2da52529d8fd595e7e0cd4c22bc716f41609d9b0b4267
SSDEEP

49152:XpUPdFdYxt2SENs02k7OxHA32D9K1O5k0a5MLXrzL6yq5/Hdrbz5jLcwE/7z3V49:XpgKxPDM6+OLGThGWn126

Score

10^/10

lucastealer discovery spyware stealer

Malware Config

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer
Executes dropped EXE 1 IoCs

Processes:

UIServices.exe

pid process

616 UIServices.exe
Loads dropped DLL 5 IoCs

Processes:

MsiExec.exeUIServices.exe

pid process

1884 MsiExec.exe
1884 MsiExec.exe
1884 MsiExec.exe
616 UIServices.exe
1884 MsiExec.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

ICACLS.EXEICACLS.EXE

pid process

1392 ICACLS.EXE
2028 ICACLS.EXE
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
616	UIServices.exe

pid	process
1884	MsiExec.exe
1884	MsiExec.exe
1884	MsiExec.exe
616	UIServices.exe
1884	MsiExec.exe

pid	process
1392	ICACLS.EXE
2028	ICACLS.EXE

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com

flow	ioc
3	ip-api.com

Drops file in Windows directory 13 IoCs

Processes:

cmd.exemsiexec.exeEXPAND.EXE

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	cmd.exe
File opened for modification	C:\Windows\Installer\6cad7f.msi	msiexec.exe
File created	C:\Windows\Installer\6cad80.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1A4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7EB.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	cmd.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	cmd.exe
File created	C:\Windows\Installer\6cad7f.msi	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSID7DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6cad80.ipi	msiexec.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1548 schtasks.exe

pid	process
1548	schtasks.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cmd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cmd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exeUIServices.exe

pid process

1708 msiexec.exe
1708 msiexec.exe
616 UIServices.exe
616 UIServices.exe
616 UIServices.exe
616 UIServices.exe
616 UIServices.exe
616 UIServices.exe

pid	process
1708	msiexec.exe
1708	msiexec.exe
616	UIServices.exe
616	UIServices.exe
616	UIServices.exe
616	UIServices.exe
616	UIServices.exe
616	UIServices.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

Processes:

msiexec.exemsiexec.exevssvc.execmd.exeUIServices.exe

description	pid	process
Token: SeShutdownPrivilege	852	msiexec.exe
Token: SeIncreaseQuotaPrivilege	852	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeSecurityPrivilege	1708	msiexec.exe
Token: SeCreateTokenPrivilege	852	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	852	msiexec.exe
Token: SeLockMemoryPrivilege	852	msiexec.exe
Token: SeIncreaseQuotaPrivilege	852	msiexec.exe
Token: SeMachineAccountPrivilege	852	msiexec.exe
Token: SeTcbPrivilege	852	msiexec.exe
Token: SeSecurityPrivilege	852	msiexec.exe
Token: SeTakeOwnershipPrivilege	852	msiexec.exe
Token: SeLoadDriverPrivilege	852	msiexec.exe
Token: SeSystemProfilePrivilege	852	msiexec.exe
Token: SeSystemtimePrivilege	852	msiexec.exe
Token: SeProfSingleProcessPrivilege	852	msiexec.exe
Token: SeIncBasePriorityPrivilege	852	msiexec.exe
Token: SeCreatePagefilePrivilege	852	msiexec.exe
Token: SeCreatePermanentPrivilege	852	msiexec.exe
Token: SeBackupPrivilege	852	msiexec.exe
Token: SeRestorePrivilege	852	msiexec.exe
Token: SeShutdownPrivilege	852	msiexec.exe
Token: SeDebugPrivilege	852	msiexec.exe
Token: SeAuditPrivilege	852	msiexec.exe
Token: SeSystemEnvironmentPrivilege	852	msiexec.exe
Token: SeChangeNotifyPrivilege	852	msiexec.exe
Token: SeRemoteShutdownPrivilege	852	msiexec.exe
Token: SeUndockPrivilege	852	msiexec.exe
Token: SeSyncAgentPrivilege	852	msiexec.exe
Token: SeEnableDelegationPrivilege	852	msiexec.exe
Token: SeManageVolumePrivilege	852	msiexec.exe
Token: SeImpersonatePrivilege	852	msiexec.exe
Token: SeCreateGlobalPrivilege	852	msiexec.exe
Token: SeBackupPrivilege	1168	vssvc.exe
Token: SeRestorePrivilege	1168	vssvc.exe
Token: SeAuditPrivilege	1168	vssvc.exe
Token: SeBackupPrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1088	cmd.exe
Token: SeRestorePrivilege	1088	cmd.exe
Token: SeRestorePrivilege	1088	cmd.exe
Token: SeRestorePrivilege	1088	cmd.exe
Token: SeRestorePrivilege	1088	cmd.exe
Token: SeRestorePrivilege	1088	cmd.exe
Token: SeRestorePrivilege	1088	cmd.exe
Token: SeLoadDriverPrivilege	1088	cmd.exe
Token: SeLoadDriverPrivilege	1088	cmd.exe
Token: SeLoadDriverPrivilege	1088	cmd.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeShutdownPrivilege	616	UIServices.exe
Token: SeShutdownPrivilege	616	UIServices.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

852 msiexec.exe
852 msiexec.exe

pid	process
852	msiexec.exe
852	msiexec.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

msiexec.exeMsiExec.exeUIServices.execmd.exe

description	pid	process	target process
PID 1708 wrote to memory of 1884	1708	msiexec.exe	MsiExec.exe
PID 1708 wrote to memory of 1884	1708	msiexec.exe	MsiExec.exe
PID 1708 wrote to memory of 1884	1708	msiexec.exe	MsiExec.exe
PID 1708 wrote to memory of 1884	1708	msiexec.exe	MsiExec.exe
PID 1708 wrote to memory of 1884	1708	msiexec.exe	MsiExec.exe
PID 1708 wrote to memory of 1884	1708	msiexec.exe	MsiExec.exe
PID 1708 wrote to memory of 1884	1708	msiexec.exe	MsiExec.exe
PID 1884 wrote to memory of 1392	1884	MsiExec.exe	ICACLS.EXE
PID 1884 wrote to memory of 1392	1884	MsiExec.exe	ICACLS.EXE
PID 1884 wrote to memory of 1392	1884	MsiExec.exe	ICACLS.EXE
PID 1884 wrote to memory of 1392	1884	MsiExec.exe	ICACLS.EXE
PID 1884 wrote to memory of 1760	1884	MsiExec.exe	EXPAND.EXE
PID 1884 wrote to memory of 1760	1884	MsiExec.exe	EXPAND.EXE
PID 1884 wrote to memory of 1760	1884	MsiExec.exe	EXPAND.EXE
PID 1884 wrote to memory of 1760	1884	MsiExec.exe	EXPAND.EXE
PID 1884 wrote to memory of 616	1884	MsiExec.exe	UIServices.exe
PID 1884 wrote to memory of 616	1884	MsiExec.exe	UIServices.exe
PID 1884 wrote to memory of 616	1884	MsiExec.exe	UIServices.exe
PID 1884 wrote to memory of 616	1884	MsiExec.exe	UIServices.exe
PID 616 wrote to memory of 1088	616	UIServices.exe	cmd.exe
PID 616 wrote to memory of 1088	616	UIServices.exe	cmd.exe
PID 616 wrote to memory of 1088	616	UIServices.exe	cmd.exe
PID 1884 wrote to memory of 2028	1884	MsiExec.exe	ICACLS.EXE
PID 1884 wrote to memory of 2028	1884	MsiExec.exe	ICACLS.EXE
PID 1884 wrote to memory of 2028	1884	MsiExec.exe	ICACLS.EXE
PID 1884 wrote to memory of 2028	1884	MsiExec.exe	ICACLS.EXE
PID 1088 wrote to memory of 1548	1088	cmd.exe	schtasks.exe
PID 1088 wrote to memory of 1548	1088	cmd.exe	schtasks.exe
PID 1088 wrote to memory of 1548	1088	cmd.exe	schtasks.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\afef2f9f5c5e3ac4a946cea031ef20e6.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8CA44EC1BB15B1C43285FCDBC0B6E927
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:1392
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\files\UIServices.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\files\UIServices.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c "schtasks /Create /TR C:\Users\Admin\AppData\Local\Temp\\Google Chrome /SC ONLOGON /TN Google Chrome /IT"
      4⤵
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1088
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /TR C:\Users\Admin\AppData\Local\Temp\\Google Chrome /SC ONLOGON /TN Google Chrome /IT
        5⤵
        Creates scheduled task(s)
        
        PID:1548
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:2028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B8" "000000000000032C"
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\files.cab

Filesize
5.4MB

MD5
375e23274e9a65752052c4cc9fdef886

SHA1
7bd1c2e20fc78e7b45eb7aab97e8503667445d36

SHA256
670209bf83f6ad3e5a526e816c757524a38ce3a11522cd0693b4bbe3a837e581

SHA512
869040a610139de440b8c9f370d3d7b2f4882a883745d43bbab4756a030e22c6dee4b39bbe9490254f9d5c130578e84497bc821660006c38306bcfe61ac6218d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\files\UIServices.exe

Filesize
5.3MB

MD5
9edef0f9db07974c3ce9cba957327e78

SHA1
474f53d12af223f4c3da84f5832668fbb6611311

SHA256
90056c97ab02271509b04c192ae375ed775b5c2e642e4b85bec8d27742036e72

SHA512
e15a46dc659bf6ea591a69a7c40b0bd30626d5c533d21e48c3f4306f66a69ba822238461ad539b8d00bd9dd4c294ae43c1c54a1f2455eee2ade1670f93fcae09

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\files\UIServices.exe

Filesize
5.3MB

MD5
9edef0f9db07974c3ce9cba957327e78

SHA1
474f53d12af223f4c3da84f5832668fbb6611311

SHA256
90056c97ab02271509b04c192ae375ed775b5c2e642e4b85bec8d27742036e72

SHA512
e15a46dc659bf6ea591a69a7c40b0bd30626d5c533d21e48c3f4306f66a69ba822238461ad539b8d00bd9dd4c294ae43c1c54a1f2455eee2ade1670f93fcae09

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\files\VCRUNTIME140.dll

Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\msiwrapper.ini

Filesize
1KB

MD5
5cb04b565b14d48edf1b89271b6e1af9

SHA1
72809b65be113a19f72740982112a02c4b59f321

SHA256
6f7ed1b1a6cbe83cc031422a20388c90a7466d3cef663ca658250d64d136a641

SHA512
f5a1d514b6c7dcc81f7fa32085ad4558dc1b3f0735080b83d9d560ac7042961832d01f622f6d8021dc22c300da68d0eed77ec6c90e74206605ebd7a764ff4717

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\msiwrapper.ini

Filesize
1KB

MD5
1211a185c459d49c493caab96bf44b60

SHA1
9c0825afabd54a770a27b2a1c106c84d092867fa

SHA256
d08920e768dd26490d481cb85b63762bbac199eb82e13d1ee90d60f86f426e77

SHA512
7b6a2640e7724eb761849a3e0e1a90a73a9a8202a4926f34c5fb128caac663f94ac84dfb4e269ddbb6d347d25a7d91299c80f5384fcf83e99715ee4ee3cbc3b9

Download Submit
C:\Windows\Installer\MSIB1A4.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSID7EB.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\files\UIServices.exe

Filesize
5.3MB

MD5
9edef0f9db07974c3ce9cba957327e78

SHA1
474f53d12af223f4c3da84f5832668fbb6611311

SHA256
90056c97ab02271509b04c192ae375ed775b5c2e642e4b85bec8d27742036e72

SHA512
e15a46dc659bf6ea591a69a7c40b0bd30626d5c533d21e48c3f4306f66a69ba822238461ad539b8d00bd9dd4c294ae43c1c54a1f2455eee2ade1670f93fcae09

Download Submit
\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\files\UIServices.exe

Filesize
5.3MB

MD5
9edef0f9db07974c3ce9cba957327e78

SHA1
474f53d12af223f4c3da84f5832668fbb6611311

SHA256
90056c97ab02271509b04c192ae375ed775b5c2e642e4b85bec8d27742036e72

SHA512
e15a46dc659bf6ea591a69a7c40b0bd30626d5c533d21e48c3f4306f66a69ba822238461ad539b8d00bd9dd4c294ae43c1c54a1f2455eee2ade1670f93fcae09

Download Submit
\Users\Admin\AppData\Local\Temp\MW-ed144e16-446d-4960-948c-4390d28c0f50\files\vcruntime140.dll

Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
\Windows\Installer\MSIB1A4.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\Windows\Installer\MSID7EB.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
memory/616-67-0x0000000000000000-mapping.dmp

Download
memory/852-54-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download
memory/1088-71-0x0000000000000000-mapping.dmp

Download
memory/1392-60-0x0000000000000000-mapping.dmp

Download
memory/1548-73-0x0000000000000000-mapping.dmp

Download
memory/1760-63-0x0000000000000000-mapping.dmp

Download
memory/1884-57-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1884-56-0x0000000000000000-mapping.dmp

Download
memory/2028-72-0x0000000000000000-mapping.dmp

Download