blackmoon | aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7

Analysis

max time kernel
113s
max time network
180s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
Size

2.0MB
MD5

cc888e112e6212bc0a77c5628ceb2e23
SHA1

7c16d0c6349af720642109c67435236a3239d273
SHA256

aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7
SHA512

3b6c1121eac1d9609e2e20f923d6b80020701402a70abd3eaa7c2dc8035b047ff011c057ff101e59e4f8dcffbdd4f486f9224fb5c2336163cb9771a0612b0557
SSDEEP

49152:P96pwkZmHLcZEQ8L09njnxvcjxFSKmQV00ObPT+Db0KZCgHk9:5okLcZEoZg3SV3+D4jn

Score

10^/10

blackmoon banker evasion trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

Processes:

resource	yara_rule
\Users\Admin\Desktop\good\good.exe	family_blackmoon
\Users\Admin\Desktop\good\good.exe	family_blackmoon
C:\Users\Admin\Desktop\good\good.exe	family_blackmoon
C:\Users\Admin\Desktop\good\good.exe	family_blackmoon
\Users\Admin\Desktop\good\good.exe	family_blackmoon

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
Executes dropped EXE 1 IoCs

Processes:

good.exe

pid process

1972 good.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe

pid	process
1972	good.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1416-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-83-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-91-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-99-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1416-111-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Wine	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe

Loads dropped DLL 3 IoCs

Processes:

aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exegood.exe

pid	process
1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
1972	good.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe

pid process

1416 aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000ffef2f97ab0124299f5776bb2b8f28867d28185db1ef849a46f3faf354f2866c000000000e80000000020000200000007ae52009a63ee803b6a5af9df797007ec4fcb679baf16526e9e2b2a8b5e921869000000013794dee3bb7244785be4046197f7387038158413ab09c50e7782baf17b77a2b9c16bfcef59c2a673ffd64d719a1e59240a248bf795bf0703670851d3b83b0e9315870999e294dce31c6a322ad9080f06718bafa70d2ee77ede25a3cfab9dd1a246f6a165d7485d381f20691cc2136baf0b06a74fb10c6173e4b58b3355d1649dd84fea6c00b61b4a1b7406eee0e522d40000000ba9f2870cc64265db896542995c483bbae4daac5e9f9091998e40e0fa8ab01526d6a21831acceafdd64cb2c05bedd8a4690d698363a7008f39faf03d3eab0e06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\pan.lanzoui.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f767123d04d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376523767"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\lanzoui.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\pan.lanzoui.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\lanzoui.com\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36BBAE20-7030-11ED-A7A0-663367632C22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\lanzoui.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000a332dc29a9f43f8ca8764934e268892951e8e76e40f5d0549cd2c99bf87b45d6000000000e8000000002000020000000e1fc51af00219912e776c68a8ff5f0757d19e4dc25f5c4f3d2ed90cbe50a7c02200000001a97b009621372eaf28d96f60046dce0a36884a8d33c783937efe7e9e18cede2400000003019ecd926198f57c9611bd47bf695aa1c8f0dcfe5167c2526739c955fdeee84cd5acea05f3d01b41c649efdb00d5583ae90563343d45e4ce05c1e3b86dd001e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe

pid process

1416 aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1016 iexplore.exe

pid	process
1016	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exeiexplore.exeIEXPLORE.EXE

pid	process
1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
1016	iexplore.exe
1016	iexplore.exe
360	IEXPLORE.EXE
360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exeiexplore.exe

description	pid	process	target process
PID 1416 wrote to memory of 1972	1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe	good.exe
PID 1416 wrote to memory of 1972	1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe	good.exe
PID 1416 wrote to memory of 1972	1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe	good.exe
PID 1416 wrote to memory of 1972	1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe	good.exe
PID 1416 wrote to memory of 1016	1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe	iexplore.exe
PID 1416 wrote to memory of 1016	1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe	iexplore.exe
PID 1416 wrote to memory of 1016	1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe	iexplore.exe
PID 1416 wrote to memory of 1016	1416	aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe	iexplore.exe
PID 1016 wrote to memory of 360	1016	iexplore.exe	IEXPLORE.EXE
PID 1016 wrote to memory of 360	1016	iexplore.exe	IEXPLORE.EXE
PID 1016 wrote to memory of 360	1016	iexplore.exe	IEXPLORE.EXE
PID 1016 wrote to memory of 360	1016	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe
"C:\Users\Admin\AppData\Local\Temp\aa0f430e5c143bfaec8a9a5c46b3cb0b7f16b9defad69cf677c4a8879eb9bcd7.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\Desktop\good\good.exe
"C:\Users\Admin\Desktop\good\good.exe" i
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://pan.lanzou.com/p/282851105
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1016 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9393a5ebfc289b784ee4ffbed173b459

SHA1
3f28987d6c4a963b8c457d86a1a1d95b23771c5e

SHA256
c7d6e58fd7a402320f3ebf4126af0de5f133fac4d6e292e927c775095913ae38

SHA512
f739793ef807e837426fa6e6af77b2608e4a8c51b7bef3f68d98c5b871b94dfe13589b3cf60f556df003bf23e89c1cda33b2db8d24bf8dfa44f8e123e39bcb76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat
Filesize
1KB

MD5
91c3cdaf9847ce5cda26ed997c9bfb1e

SHA1
4573ba61f61928e448bddd75573b9c34d7a0bca4

SHA256
0c3aa4a31c626c789d2dcf1af09d00831818a40c4026875f45697c4b2e7b7a63

SHA512
9daef1c01d3695acc418b7796bc280090b34eef3af0e6933a61aebf83e5804ba8d4c77ebd5b4283679f881c9c7dc5bae8e2f6a9e87c6940d0a1380bd4798250d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WW9KZ7J8.txt
Filesize
601B

MD5
544b639da2506957941c0c2446197f90

SHA1
8fe0daf188995474bcbfe48efcc1ab5966f73ad8

SHA256
ebf22cabc6b7935cf77c70e21628c0fb3d872eddb7c2c5c4107e2a9bc5c54a9e

SHA512
d9d39af60cfbc92f67809fbbe353576c0b3bd1126461a5ebe0363d9d1760c0ecdff0df17fb52b4f7824fddc17b0c4ecd1a119fb41dafdc784c6df1284643de97

Download Submit
C:\Users\Admin\Desktop\good\cfg.ini
Filesize
105B

MD5
2660d292cd135fbef3a113a41c6063e9

SHA1
177b90dc51e08238331adafb04cc534f807fee7f

SHA256
eb0bb128f5c245dbc9429c3b40fdb4721db3b820fa4c1454eb82f8af1260f3e6

SHA512
6bd11f302795d8ca8c7268efb6cb1b9ce6a14dfb062918c0a9f686550c4d256cc6ccfe814533d8b57bf54e38d8358a3922c7984b6a1243b65e8d204b74314706

Download Submit
C:\Users\Admin\Desktop\good\good.exe
Filesize
107KB

MD5
446d420e57d1818aa690364f59a487c0

SHA1
627bb0a8f70bef07494a9e0c078b1659d23da8de

SHA256
ed303b005e5a2e39a4c58a17dec360eced3794d6b6aeaf963cb5ab77bc64490d

SHA512
9d447f71b4b788c51bcd2ee28ae2fc134972b89b983c2e4e69e392895f841d2b69f81b4e383d309e23b9b85c25162a0274f4cab8837d94c20b3c9435f8362ba3

Download Submit
C:\Users\Admin\Desktop\good\good.exe
Filesize
107KB

MD5
446d420e57d1818aa690364f59a487c0

SHA1
627bb0a8f70bef07494a9e0c078b1659d23da8de

SHA256
ed303b005e5a2e39a4c58a17dec360eced3794d6b6aeaf963cb5ab77bc64490d

SHA512
9d447f71b4b788c51bcd2ee28ae2fc134972b89b983c2e4e69e392895f841d2b69f81b4e383d309e23b9b85c25162a0274f4cab8837d94c20b3c9435f8362ba3

Download Submit
\Users\Admin\Desktop\good\good.exe
Filesize
107KB

MD5
446d420e57d1818aa690364f59a487c0

SHA1
627bb0a8f70bef07494a9e0c078b1659d23da8de

SHA256
ed303b005e5a2e39a4c58a17dec360eced3794d6b6aeaf963cb5ab77bc64490d

SHA512
9d447f71b4b788c51bcd2ee28ae2fc134972b89b983c2e4e69e392895f841d2b69f81b4e383d309e23b9b85c25162a0274f4cab8837d94c20b3c9435f8362ba3

Download Submit
\Users\Admin\Desktop\good\good.exe
Filesize
107KB

MD5
446d420e57d1818aa690364f59a487c0

SHA1
627bb0a8f70bef07494a9e0c078b1659d23da8de

SHA256
ed303b005e5a2e39a4c58a17dec360eced3794d6b6aeaf963cb5ab77bc64490d

SHA512
9d447f71b4b788c51bcd2ee28ae2fc134972b89b983c2e4e69e392895f841d2b69f81b4e383d309e23b9b85c25162a0274f4cab8837d94c20b3c9435f8362ba3

Download Submit
\Users\Admin\Desktop\good\good.exe
Filesize
107KB

MD5
446d420e57d1818aa690364f59a487c0

SHA1
627bb0a8f70bef07494a9e0c078b1659d23da8de

SHA256
ed303b005e5a2e39a4c58a17dec360eced3794d6b6aeaf963cb5ab77bc64490d

SHA512
9d447f71b4b788c51bcd2ee28ae2fc134972b89b983c2e4e69e392895f841d2b69f81b4e383d309e23b9b85c25162a0274f4cab8837d94c20b3c9435f8362ba3

Download Submit
memory/1416-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-77-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-83-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-91-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-54-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/1416-99-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-100-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/1416-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-55-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/1416-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-109-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/1416-110-0x00000000777A0000-0x0000000077920000-memory.dmp

Filesize
1.5MB

Download
memory/1416-111-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1416-56-0x00000000777A0000-0x0000000077920000-memory.dmp

Filesize
1.5MB

Download
memory/1972-103-0x0000000000000000-mapping.dmp

Download