ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28

Analysis

max time kernel
151s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
Size

585KB
MD5

28e41b880c6c6a3694968d349e165ddb
SHA1

b870581c5297030bea576016e5c14182890e61c0
SHA256

ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28
SHA512

7fce1f850483d83b886757a8967240b78a8b1e133a62f74ae5b603ac11e17043690c634a51236d70cf73379c8bce93e5af2b4ebcd362e3f1589850417547d275
SSDEEP

12288:APLpdAd2AvcFQoV14NmFZn3Zugh4mYyvzApwaniZ6iXWVDnvbVjl4:ApdcSJ4wFZJughpaliEMWV7Jja

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/960-78-0x0000000000411714-mapping.dmp	MailPassView
behavioral1/memory/960-79-0x0000000000120000-0x000000000013B000-memory.dmp	MailPassView
behavioral1/memory/836-129-0x0000000000411714-mapping.dmp	MailPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/960-78-0x0000000000411714-mapping.dmp	Nirsoft
behavioral1/memory/960-79-0x0000000000120000-0x000000000013B000-memory.dmp	Nirsoft
behavioral1/memory/836-129-0x0000000000411714-mapping.dmp	Nirsoft

Executes dropped EXE 5 IoCs

Processes:

AppMgnt.exehknswc.exeAppMgnt.exehknswc.exehknswc.exe

pid process

556 AppMgnt.exe
1592 hknswc.exe
808 AppMgnt.exe
804 hknswc.exe
836 hknswc.exe
Loads dropped DLL 2 IoCs

Processes:

ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exeAppMgnt.exe

pid process

2032 ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
556 AppMgnt.exe

pid	process
556	AppMgnt.exe
1592	hknswc.exe
808	AppMgnt.exe
804	hknswc.exe
836	hknswc.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exead03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exehknswc.exehknswc.exe

description	pid	process	target process
PID 2032 set thread context of 1584	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 set thread context of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1592 set thread context of 804	1592	hknswc.exe	hknswc.exe
PID 804 set thread context of 836	804	hknswc.exe	hknswc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1632 schtasks.exe
1096 schtasks.exe

pid	process
1632	schtasks.exe
1096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exeAppMgnt.exeAppMgnt.exehknswc.exe

pid	process
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
556	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
1592	hknswc.exe
808	AppMgnt.exe
2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exead03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exeAppMgnt.exehknswc.exeAppMgnt.exehknswc.exe

description	pid	process
Token: SeDebugPrivilege	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
Token: SeDebugPrivilege	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
Token: SeDebugPrivilege	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
Token: SeDebugPrivilege	556	AppMgnt.exe
Token: SeDebugPrivilege	1592	hknswc.exe
Token: SeDebugPrivilege	808	AppMgnt.exe
Token: SeDebugPrivilege	804	hknswc.exe

Suspicious use of WriteProcessMemory 58 IoCs

Processes:

ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exead03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exeAppMgnt.exeAppMgnt.exehknswc.exehknswc.exe

description	pid	process	target process
PID 2032 wrote to memory of 1584	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 2032 wrote to memory of 1584	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 2032 wrote to memory of 1584	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 2032 wrote to memory of 1584	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 2032 wrote to memory of 1584	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 2032 wrote to memory of 1584	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 2032 wrote to memory of 1584	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 2032 wrote to memory of 1584	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 2032 wrote to memory of 1584	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 wrote to memory of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 wrote to memory of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 wrote to memory of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 wrote to memory of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 wrote to memory of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 wrote to memory of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 wrote to memory of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 wrote to memory of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 wrote to memory of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 1584 wrote to memory of 960	1584	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
PID 2032 wrote to memory of 556	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	AppMgnt.exe
PID 2032 wrote to memory of 556	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	AppMgnt.exe
PID 2032 wrote to memory of 556	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	AppMgnt.exe
PID 2032 wrote to memory of 556	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	AppMgnt.exe
PID 556 wrote to memory of 1632	556	AppMgnt.exe	schtasks.exe
PID 556 wrote to memory of 1632	556	AppMgnt.exe	schtasks.exe
PID 556 wrote to memory of 1632	556	AppMgnt.exe	schtasks.exe
PID 556 wrote to memory of 1632	556	AppMgnt.exe	schtasks.exe
PID 556 wrote to memory of 1592	556	AppMgnt.exe	hknswc.exe
PID 556 wrote to memory of 1592	556	AppMgnt.exe	hknswc.exe
PID 556 wrote to memory of 1592	556	AppMgnt.exe	hknswc.exe
PID 556 wrote to memory of 1592	556	AppMgnt.exe	hknswc.exe
PID 2032 wrote to memory of 808	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	AppMgnt.exe
PID 2032 wrote to memory of 808	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	AppMgnt.exe
PID 2032 wrote to memory of 808	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	AppMgnt.exe
PID 2032 wrote to memory of 808	2032	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe	AppMgnt.exe
PID 808 wrote to memory of 1096	808	AppMgnt.exe	schtasks.exe
PID 808 wrote to memory of 1096	808	AppMgnt.exe	schtasks.exe
PID 808 wrote to memory of 1096	808	AppMgnt.exe	schtasks.exe
PID 808 wrote to memory of 1096	808	AppMgnt.exe	schtasks.exe
PID 1592 wrote to memory of 804	1592	hknswc.exe	hknswc.exe
PID 1592 wrote to memory of 804	1592	hknswc.exe	hknswc.exe
PID 1592 wrote to memory of 804	1592	hknswc.exe	hknswc.exe
PID 1592 wrote to memory of 804	1592	hknswc.exe	hknswc.exe
PID 1592 wrote to memory of 804	1592	hknswc.exe	hknswc.exe
PID 1592 wrote to memory of 804	1592	hknswc.exe	hknswc.exe
PID 1592 wrote to memory of 804	1592	hknswc.exe	hknswc.exe
PID 1592 wrote to memory of 804	1592	hknswc.exe	hknswc.exe
PID 1592 wrote to memory of 804	1592	hknswc.exe	hknswc.exe
PID 804 wrote to memory of 836	804	hknswc.exe	hknswc.exe
PID 804 wrote to memory of 836	804	hknswc.exe	hknswc.exe
PID 804 wrote to memory of 836	804	hknswc.exe	hknswc.exe
PID 804 wrote to memory of 836	804	hknswc.exe	hknswc.exe
PID 804 wrote to memory of 836	804	hknswc.exe	hknswc.exe
PID 804 wrote to memory of 836	804	hknswc.exe	hknswc.exe
PID 804 wrote to memory of 836	804	hknswc.exe	hknswc.exe
PID 804 wrote to memory of 836	804	hknswc.exe	hknswc.exe
PID 804 wrote to memory of 836	804	hknswc.exe	hknswc.exe
PID 804 wrote to memory of 836	804	hknswc.exe	hknswc.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe

C:\Users\Admin\AppData\Local\Temp\ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
"C:\Users\Admin\AppData\Local\Temp\ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2032
- C:\Users\Admin\AppData\Local\Temp\ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
  "C:\Users\Admin\AppData\Local\Temp\ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Users\Admin\AppData\Local\Temp\ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe
    "C:\Users\Admin\AppData\Local\Temp\ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28.exe" /stext C:\ProgramData\Mails.txt
    3⤵
    PID:960
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /SC ONLOGON /TN PolicyManager /TR C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1632
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:804
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe" /stext C:\ProgramData\Mails.txt
        5⤵
        Executes dropped EXE
        
        PID:836
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /SC ONLOGON /TN PolicyManager /TR C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe

Filesize
9KB

MD5
377b246a502bff19611c046bc4b9528a

SHA1
c33004ffce509610657ee50a942fbac7c085487e

SHA256
a82131e63d829ab1a4c284069a707a25aba0c0f5f372e5e70a3d824db6b19648

SHA512
9794a02ef553adf0ec48566c25abf6d327040476155102a4e934984c0529fd9e6b85b019756a166d5490aad9eb03dfd65144be590717430e9102a907158d81d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe

Filesize
9KB

MD5
377b246a502bff19611c046bc4b9528a

SHA1
c33004ffce509610657ee50a942fbac7c085487e

SHA256
a82131e63d829ab1a4c284069a707a25aba0c0f5f372e5e70a3d824db6b19648

SHA512
9794a02ef553adf0ec48566c25abf6d327040476155102a4e934984c0529fd9e6b85b019756a166d5490aad9eb03dfd65144be590717430e9102a907158d81d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe

Filesize
9KB

MD5
377b246a502bff19611c046bc4b9528a

SHA1
c33004ffce509610657ee50a942fbac7c085487e

SHA256
a82131e63d829ab1a4c284069a707a25aba0c0f5f372e5e70a3d824db6b19648

SHA512
9794a02ef553adf0ec48566c25abf6d327040476155102a4e934984c0529fd9e6b85b019756a166d5490aad9eb03dfd65144be590717430e9102a907158d81d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe

Filesize
585KB

MD5
28e41b880c6c6a3694968d349e165ddb

SHA1
b870581c5297030bea576016e5c14182890e61c0

SHA256
ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28

SHA512
7fce1f850483d83b886757a8967240b78a8b1e133a62f74ae5b603ac11e17043690c634a51236d70cf73379c8bce93e5af2b4ebcd362e3f1589850417547d275

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe

Filesize
585KB

MD5
28e41b880c6c6a3694968d349e165ddb

SHA1
b870581c5297030bea576016e5c14182890e61c0

SHA256
ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28

SHA512
7fce1f850483d83b886757a8967240b78a8b1e133a62f74ae5b603ac11e17043690c634a51236d70cf73379c8bce93e5af2b4ebcd362e3f1589850417547d275

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe

Filesize
585KB

MD5
28e41b880c6c6a3694968d349e165ddb

SHA1
b870581c5297030bea576016e5c14182890e61c0

SHA256
ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28

SHA512
7fce1f850483d83b886757a8967240b78a8b1e133a62f74ae5b603ac11e17043690c634a51236d70cf73379c8bce93e5af2b4ebcd362e3f1589850417547d275

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe

Filesize
585KB

MD5
28e41b880c6c6a3694968d349e165ddb

SHA1
b870581c5297030bea576016e5c14182890e61c0

SHA256
ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28

SHA512
7fce1f850483d83b886757a8967240b78a8b1e133a62f74ae5b603ac11e17043690c634a51236d70cf73379c8bce93e5af2b4ebcd362e3f1589850417547d275

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe

Filesize
9KB

MD5
377b246a502bff19611c046bc4b9528a

SHA1
c33004ffce509610657ee50a942fbac7c085487e

SHA256
a82131e63d829ab1a4c284069a707a25aba0c0f5f372e5e70a3d824db6b19648

SHA512
9794a02ef553adf0ec48566c25abf6d327040476155102a4e934984c0529fd9e6b85b019756a166d5490aad9eb03dfd65144be590717430e9102a907158d81d3

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe

Filesize
585KB

MD5
28e41b880c6c6a3694968d349e165ddb

SHA1
b870581c5297030bea576016e5c14182890e61c0

SHA256
ad03f5989eb133644bf447cfdcc2884cea36ad61781e11a21507cc6c0ace1e28

SHA512
7fce1f850483d83b886757a8967240b78a8b1e133a62f74ae5b603ac11e17043690c634a51236d70cf73379c8bce93e5af2b4ebcd362e3f1589850417547d275

Download Submit
memory/556-94-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/556-83-0x0000000000000000-mapping.dmp

Download
memory/556-96-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/804-108-0x000000000047661E-mapping.dmp

Download
memory/804-118-0x0000000000080000-0x00000000000FC000-memory.dmp

Filesize
496KB

Download
memory/804-139-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/804-135-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/804-111-0x0000000000080000-0x00000000000FC000-memory.dmp

Filesize
496KB

Download
memory/804-115-0x0000000000080000-0x00000000000FC000-memory.dmp

Filesize
496KB

Download
memory/808-138-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/808-134-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/808-98-0x0000000000000000-mapping.dmp

Download
memory/836-129-0x0000000000411714-mapping.dmp

Download
memory/960-72-0x0000000000120000-0x000000000013B000-memory.dmp

Filesize
108KB

Download
memory/960-79-0x0000000000120000-0x000000000013B000-memory.dmp

Filesize
108KB

Download
memory/960-78-0x0000000000411714-mapping.dmp

Download
memory/960-69-0x0000000000120000-0x000000000013B000-memory.dmp

Filesize
108KB

Download
memory/960-70-0x0000000000120000-0x000000000013B000-memory.dmp

Filesize
108KB

Download
memory/960-74-0x0000000000120000-0x000000000013B000-memory.dmp

Filesize
108KB

Download
memory/960-75-0x0000000000120000-0x000000000013B000-memory.dmp

Filesize
108KB

Download
memory/1096-101-0x0000000000000000-mapping.dmp

Download
memory/1584-63-0x000000000047661E-mapping.dmp

Download
memory/1584-65-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1584-62-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1584-57-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1584-61-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1584-136-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1584-67-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1584-60-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1584-58-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1584-93-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1592-90-0x0000000000000000-mapping.dmp

Download
memory/1592-137-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1592-95-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1632-87-0x0000000000000000-mapping.dmp

Download
memory/2032-55-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/2032-56-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/2032-97-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/2032-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download