76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e

Analysis

max time kernel
141s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Size

60KB
MD5

a0068ae7ff0080ef15e60e1d213c53b1
SHA1

1685fd8007c01c2efc9f273f092cda13141fb0eb
SHA256

76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e
SHA512

f71440dbfa9780d7edb4691a1a353099f4408b05479d7d91b9406a988fa3d15cebe196662306ea9aaad75d9c6a1a8f7659fb7c04568e455411768aec861d35cb
SSDEEP

768:ukpLA8BtBV0QJcW5wqInmNSfyvwx+BKXCJW+trdvsWCJn66kvORBX80X/s:3kQJcqwmIfj+ECJG/kvO40vs

Score

9^/10

collection spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Executes dropped EXE 1 IoCs

pid	Process
1432	wmimgmt.exe

Loads dropped DLL 2 IoCs

pid	Process
2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	reg.exe

Discovers systems in the same network 1 TTPs 4 IoCs

discovery

Remote System Discovery

T1018

pid	Process
1620	net.exe
1996	net.exe
1264	net.exe
1536	net.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1680	tasklist.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1316	ipconfig.exe
452	NETSTAT.EXE
1476	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1936	systeminfo.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
784	PING.EXE

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeBackupPrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeRestorePrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeBackupPrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeBackupPrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeRestorePrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeBackupPrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeRestorePrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeBackupPrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeRestorePrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeBackupPrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeRestorePrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeBackupPrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeRestorePrivilege	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
Token: SeDebugPrivilege	1680	tasklist.exe
Token: SeDebugPrivilege	452	NETSTAT.EXE
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeRestorePrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe
Token: SeBackupPrivilege	1432	wmimgmt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1432	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe	26
PID 2000 wrote to memory of 1432	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe	26
PID 2000 wrote to memory of 1432	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe	26
PID 2000 wrote to memory of 1432	2000	76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe	26
PID 1432 wrote to memory of 1752	1432	wmimgmt.exe	27
PID 1432 wrote to memory of 1752	1432	wmimgmt.exe	27
PID 1432 wrote to memory of 1752	1432	wmimgmt.exe	27
PID 1432 wrote to memory of 1752	1432	wmimgmt.exe	27
PID 1752 wrote to memory of 1264	1752	cmd.exe	29
PID 1752 wrote to memory of 1264	1752	cmd.exe	29
PID 1752 wrote to memory of 1264	1752	cmd.exe	29
PID 1752 wrote to memory of 1264	1752	cmd.exe	29
PID 1752 wrote to memory of 468	1752	cmd.exe	30
PID 1752 wrote to memory of 468	1752	cmd.exe	30
PID 1752 wrote to memory of 468	1752	cmd.exe	30
PID 1752 wrote to memory of 468	1752	cmd.exe	30
PID 1752 wrote to memory of 1748	1752	cmd.exe	31
PID 1752 wrote to memory of 1748	1752	cmd.exe	31
PID 1752 wrote to memory of 1748	1752	cmd.exe	31
PID 1752 wrote to memory of 1748	1752	cmd.exe	31
PID 1748 wrote to memory of 1720	1748	net.exe	32
PID 1748 wrote to memory of 1720	1748	net.exe	32
PID 1748 wrote to memory of 1720	1748	net.exe	32
PID 1748 wrote to memory of 1720	1748	net.exe	32
PID 1752 wrote to memory of 1320	1752	cmd.exe	33
PID 1752 wrote to memory of 1320	1752	cmd.exe	33
PID 1752 wrote to memory of 1320	1752	cmd.exe	33
PID 1752 wrote to memory of 1320	1752	cmd.exe	33
PID 1320 wrote to memory of 1224	1320	net.exe	34
PID 1320 wrote to memory of 1224	1320	net.exe	34
PID 1320 wrote to memory of 1224	1320	net.exe	34
PID 1320 wrote to memory of 1224	1320	net.exe	34
PID 1752 wrote to memory of 1680	1752	cmd.exe	35
PID 1752 wrote to memory of 1680	1752	cmd.exe	35
PID 1752 wrote to memory of 1680	1752	cmd.exe	35
PID 1752 wrote to memory of 1680	1752	cmd.exe	35
PID 1752 wrote to memory of 1936	1752	cmd.exe	37
PID 1752 wrote to memory of 1936	1752	cmd.exe	37
PID 1752 wrote to memory of 1936	1752	cmd.exe	37
PID 1752 wrote to memory of 1936	1752	cmd.exe	37
PID 1752 wrote to memory of 988	1752	cmd.exe	39
PID 1752 wrote to memory of 988	1752	cmd.exe	39
PID 1752 wrote to memory of 988	1752	cmd.exe	39
PID 1752 wrote to memory of 988	1752	cmd.exe	39
PID 1752 wrote to memory of 1536	1752	cmd.exe	40
PID 1752 wrote to memory of 1536	1752	cmd.exe	40
PID 1752 wrote to memory of 1536	1752	cmd.exe	40
PID 1752 wrote to memory of 1536	1752	cmd.exe	40
PID 1752 wrote to memory of 1764	1752	cmd.exe	41
PID 1752 wrote to memory of 1764	1752	cmd.exe	41
PID 1752 wrote to memory of 1764	1752	cmd.exe	41
PID 1752 wrote to memory of 1764	1752	cmd.exe	41
PID 1752 wrote to memory of 1316	1752	cmd.exe	42
PID 1752 wrote to memory of 1316	1752	cmd.exe	42
PID 1752 wrote to memory of 1316	1752	cmd.exe	42
PID 1752 wrote to memory of 1316	1752	cmd.exe	42
PID 1752 wrote to memory of 888	1752	cmd.exe	43
PID 1752 wrote to memory of 888	1752	cmd.exe	43
PID 1752 wrote to memory of 888	1752	cmd.exe	43
PID 1752 wrote to memory of 888	1752	cmd.exe	43
PID 1752 wrote to memory of 912	1752	cmd.exe	44
PID 1752 wrote to memory of 912	1752	cmd.exe	44
PID 1752 wrote to memory of 912	1752	cmd.exe	44
PID 1752 wrote to memory of 912	1752	cmd.exe	44

C:\Users\Admin\AppData\Local\Temp\76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe
"C:\Users\Admin\AppData\Local\Temp\76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\ProgramData\Application Data\wmimgmt.exe
  "C:\ProgramData\Application Data\wmimgmt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /v:on /c C:\Users\Admin\AppData\Local\Temp\ghi.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
      4⤵
      PID:1264
  - - C:\Windows\SysWOW64\chcp.com
      chcp
      4⤵
      PID:468
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:1720
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1320
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1224
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1680
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1936
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\find.exe
      find "REG_"
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office
      4⤵
      PID:1764
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
      4⤵
      PID:888
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
      4⤵
      PID:784
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts" /s
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts" /s
      4⤵
      Accesses Microsoft Outlook accounts
      PID:1300
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_CURRENT_USER\Software\Mirabilis\ICQ" /s
      4⤵
      PID:860
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger" /s
      4⤵
      PID:944
  - - C:\Windows\SysWOW64\net.exe
      net user Admin
      4⤵
      PID:1952
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Admin
        5⤵
        
        PID:2000
  - - C:\Windows\SysWOW64\net.exe
      net user Admin /domain
      4⤵
      PID:1592
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Admin /domain
        5⤵
        
        PID:1588
  - - C:\Windows\SysWOW64\net.exe
      net group
      4⤵
      PID:936
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group
        5⤵
        
        PID:976
  - - C:\Windows\SysWOW64\net.exe
      net group /domain
      4⤵
      PID:1556
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group /domain
        5⤵
        
        PID:680
  - - C:\Windows\SysWOW64\net.exe
      net group "domain admins"
      4⤵
      PID:632
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain admins"
        5⤵
        
        PID:1720
  - - C:\Windows\SysWOW64\net.exe
      net group "domain admins" /domain
      4⤵
      PID:1568
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain admins" /domain
        5⤵
        
        PID:760
  - - C:\Windows\SysWOW64\net.exe
      net group "domain computers"
      4⤵
      PID:1208
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain computers"
        5⤵
        
        PID:1456
  - - C:\Windows\SysWOW64\net.exe
      net group "domain computers" /domain
      4⤵
      PID:1508
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain computers" /domain
        5⤵
        
        PID:964
  - - C:\Windows\SysWOW64\net.exe
      net group "domain controllers"
      4⤵
      PID:1948
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain controllers"
        5⤵
        
        PID:1936
  - - C:\Windows\SysWOW64\net.exe
      net group "domain controllers" /domain
      4⤵
      PID:1080
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain controllers" /domain
        5⤵
        
        PID:1536
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1316
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:452
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -r
      4⤵
      Gathers network information
      PID:1476
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        
        PID:1300
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:860
  - - C:\Windows\SysWOW64\net.exe
      net start
      4⤵
      PID:1968
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start
        5⤵
        
        PID:1584
  - - C:\Windows\SysWOW64\net.exe
      net use
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo n"
      4⤵
      PID:1692
  - - C:\Windows\SysWOW64\net.exe
      net share
      4⤵
      PID:1588
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:2040
  - - C:\Windows\SysWOW64\net.exe
      net view /domain
      4⤵
      Discovers systems in the same network
      PID:1264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "------"
      4⤵
      PID:240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "domain"
      4⤵
      PID:1224
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      PID:812
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "¬A╛╣"
      4⤵
      PID:1456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "░⌡ªµª¿"
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "├ⁿ┴ε"
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "completed successfully"
      4⤵
      PID:984
  - - C:\Windows\SysWOW64\net.exe
      net view /domain:"WORKGROUP"
      4⤵
      Discovers systems in the same network
      PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\workgrp.tmp "
      4⤵
      PID:888
  - - C:\Windows\SysWOW64\find.exe
      find "\\"
      4⤵
      PID:968
  - - C:\Windows\SysWOW64\net.exe
      net view \\ORXGKKZC
      4⤵
      Discovers systems in the same network
      PID:1620
  - - C:\Windows\SysWOW64\net.exe
      net view \\ORXGKKZC
      4⤵
      Discovers systems in the same network
      PID:1996
  - - C:\Windows\SysWOW64\find.exe
      find "Disk"
      4⤵
      PID:864
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 ORXGKKZC
      4⤵
      Runs ping.exe
      PID:784
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i "Pinging Reply Request Unknown"
      4⤵
      PID:1636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Account Manipulation

T1098

Privilege Escalation

Defense Evasion

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Application Data\wmimgmt.exe

Filesize
60KB

MD5
a0068ae7ff0080ef15e60e1d213c53b1

SHA1
1685fd8007c01c2efc9f273f092cda13141fb0eb

SHA256
76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e

SHA512
f71440dbfa9780d7edb4691a1a353099f4408b05479d7d91b9406a988fa3d15cebe196662306ea9aaad75d9c6a1a8f7659fb7c04568e455411768aec861d35cb

Download Submit
C:\ProgramData\wmimgmt.exe

Filesize
60KB

MD5
a0068ae7ff0080ef15e60e1d213c53b1

SHA1
1685fd8007c01c2efc9f273f092cda13141fb0eb

SHA256
76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e

SHA512
f71440dbfa9780d7edb4691a1a353099f4408b05479d7d91b9406a988fa3d15cebe196662306ea9aaad75d9c6a1a8f7659fb7c04568e455411768aec861d35cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\INFO.TXT

Filesize
49B

MD5
916216b15d4c110b0534ec378292f653

SHA1
f36e7d20c40f874b401ca11f44a8e24a0dc80e1a

SHA256
ad99629c9b75312e25b81f9c370710601ae1b2fd34279533240287aa36f226ac

SHA512
0262a7e27dbc58673d189b527581ec572a5ca5f23e16d7625e9ff0e541466d2501a9ae449db0878749227aa13b3310b6d36375d73438bbf844badc88e7036de7

Download Submit
C:\Users\Admin\AppData\Local\Temp\drivers.p

Filesize
10B

MD5
3594ed70083b6e10efbfbcd4142b6454

SHA1
59b91832fc3778d2dba62642935c61fb768c760c

SHA256
c1aead592e2eb892263a7b1a7ca36484c73013be81dda18ccbe6a35138799823

SHA512
418466d5b10ba557bdb229cfcf7e190e7cedd9fd52a72e2591f78fc1c5c983b04c60c9307e8919c3d7e366d71c54a325d4f20e4ad4850677b115ca9c562d0586

Download Submit
C:\Users\Admin\AppData\Local\Temp\ghi.bat

Filesize
4KB

MD5
b91bc08162fbc3445c5424b77183b807

SHA1
52b2a60db40cdcc655648a65210ed26219c033e1

SHA256
7cec366268426139777f0776ba3cbce6a50f4112a96fa88190bee2ebe665275a

SHA512
2f19fe96209dcb4e189a8fecddcac40ebed8ce0c6999a469268b57e74e9e830a7b03c1d024c616797ae9029a4566fa96006f29e1fa042bca1534d1d815ae8b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.log

Filesize
153B

MD5
b256c8a481b065860c2812e742f50250

SHA1
51ddf02764fb12d88822450e8a27f9deac85fe54

SHA256
b167a692a2ff54cc5625797ddc367ba8736797130b93961d68b9150aef2f0e12

SHA512
f425ae70449d16bdb05fcc7913744fb0a81ab81278735d77ce316007b8298ad3c3991a29af67b336420f7dca94702271e59186174b5b78b5cdab1f8ce0163360

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.log

Filesize
64B

MD5
e29f80bf6f6a756e0bc6d7f5189a9bb2

SHA1
acdd1032b7dc189f8e68b390fe6fd964618acd72

SHA256
8bfe9f81e5c82cbfe69203c993009c22f940f20727fa8cb43773958bf0eba7c7

SHA512
f390fc82bdeb43721aa08f3666a4ed7d9ad4a5c1ff91be6967336417a5a5b7968b945773f68effcbe961072b801c3681455cf98b956cd802eba24190bd54268e

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.log

Filesize
64B

MD5
e29f80bf6f6a756e0bc6d7f5189a9bb2

SHA1
acdd1032b7dc189f8e68b390fe6fd964618acd72

SHA256
8bfe9f81e5c82cbfe69203c993009c22f940f20727fa8cb43773958bf0eba7c7

SHA512
f390fc82bdeb43721aa08f3666a4ed7d9ad4a5c1ff91be6967336417a5a5b7968b945773f68effcbe961072b801c3681455cf98b956cd802eba24190bd54268e

Download Submit
C:\Users\Admin\AppData\Local\Temp\t.log

Filesize
72B

MD5
59f2768506355d8bc50979f6d64ded26

SHA1
b2d315b3857bec8335c526a08d08d6a1b5f5c151

SHA256
7f9f3cbab32b3a5022bed245092835cb12502fa2e79d85c8c45d478918ee6569

SHA512
e9aa231d19cb5f93711cd3ffee4a6bd8764b21249ed7eb06ff34bcb457cd075384a0858ea35a99280bff16c01875a4ed79598a6503fcf5262da6f0849b5b1028

Download Submit
C:\Users\Admin\AppData\Local\Temp\t.log

Filesize
64B

MD5
e29f80bf6f6a756e0bc6d7f5189a9bb2

SHA1
acdd1032b7dc189f8e68b390fe6fd964618acd72

SHA256
8bfe9f81e5c82cbfe69203c993009c22f940f20727fa8cb43773958bf0eba7c7

SHA512
f390fc82bdeb43721aa08f3666a4ed7d9ad4a5c1ff91be6967336417a5a5b7968b945773f68effcbe961072b801c3681455cf98b956cd802eba24190bd54268e

Download Submit
C:\Users\Admin\AppData\Local\Temp\t.log

Filesize
64B

MD5
e29f80bf6f6a756e0bc6d7f5189a9bb2

SHA1
acdd1032b7dc189f8e68b390fe6fd964618acd72

SHA256
8bfe9f81e5c82cbfe69203c993009c22f940f20727fa8cb43773958bf0eba7c7

SHA512
f390fc82bdeb43721aa08f3666a4ed7d9ad4a5c1ff91be6967336417a5a5b7968b945773f68effcbe961072b801c3681455cf98b956cd802eba24190bd54268e

Download Submit
C:\Users\Admin\AppData\Local\Temp\workgrp.tmp

Filesize
234B

MD5
70c06d45272314d12cf853ed98edb663

SHA1
da26e6d9ed4adf06bffa8f53733c3e9728ac50ab

SHA256
dfc7e4a6a2c2810965f6f42806c7daa6a6d92fd3f404e67a66b6b1e956b2283c

SHA512
d11701d492f52e2abfebb837cd91a6a920dd0fe186a4dcce2775f2bf47c1947ca0dbb86bbe10cb504016610ef81ff5f2871ef3376cb7c592fe4b6ad19819d645

Download Submit
\ProgramData\wmimgmt.exe

Filesize
60KB

MD5
a0068ae7ff0080ef15e60e1d213c53b1

SHA1
1685fd8007c01c2efc9f273f092cda13141fb0eb

SHA256
76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e

SHA512
f71440dbfa9780d7edb4691a1a353099f4408b05479d7d91b9406a988fa3d15cebe196662306ea9aaad75d9c6a1a8f7659fb7c04568e455411768aec861d35cb

Download Submit
\ProgramData\wmimgmt.exe

Filesize
60KB

MD5
a0068ae7ff0080ef15e60e1d213c53b1

SHA1
1685fd8007c01c2efc9f273f092cda13141fb0eb

SHA256
76d1c120d7fd6a5cbcb2799c650b81a23220096cce22d7d2659a6a98b051985e

SHA512
f71440dbfa9780d7edb4691a1a353099f4408b05479d7d91b9406a988fa3d15cebe196662306ea9aaad75d9c6a1a8f7659fb7c04568e455411768aec861d35cb

Download Submit
memory/1432-67-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2000-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/2000-59-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2000-55-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads