a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
Size

98KB
MD5

a26e6798f6c74735a97ecba300b2945a
SHA1

7111433cba15ef9381278fbac15157772f7475b5
SHA256

a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36
SHA512

06f775dde85b069f758ff644cd13cdb0369a40a42fb78d4fcb7e0d2fb398ac08c47e49e2c9d7db40fdb69adc888758ace92bee68f79cdfb173458e287480ad9b
SSDEEP

1536:igYPhQXwIiPrrjThO+lUBrzCxry1ec7rUyj239au7538iJkZX/4p0N2N:FYP2XerzhOUxu/XUtauF8iJkZP4pn

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\WindWare\__tmp_rar_sfx_access_check_7088701	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File created	C:\Program Files\WindWare\iedw.ico	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File opened for modification	C:\Program Files\WindWare\tb.vbs	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File opened for modification	C:\Program Files\WindWare\Internet Exploror.lnk	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File created	C:\Program Files\WindWare\淘宝-购物.lnk	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File opened for modification	C:\Program Files\WindWare\淘宝-购物.lnk	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File opened for modification	C:\Program Files\WindWare	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File opened for modification	C:\Program Files\WindWare\iedw.ico	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File created	C:\Program Files\WindWare\tb.cmd	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File opened for modification	C:\Program Files\WindWare\tb.cmd	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File created	C:\Program Files\WindWare\tb.vbs	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File created	C:\Program Files\WindWare\Internet Exploror.lnk	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
File created	C:\Program Files\Internet Explorer\iedw.ico	cmd.exe
File opened for modification	C:\Program Files\Internet Explorer\iedw.ico	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32\ = "%systemRoot%\\SysWow64\\shdocvw.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command\ = "C:\\progra~1\\Intern~1\\iexplore.exe http://www.dao666.com/go/taobao.htm"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InfoTip = "╠╘▒ª╣║╬∩╠╪╝█╙┼╗▌╟°"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\HideOnDesktopPerUser	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iedw.ico"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\Attributes = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\ = "╠╘▒ª-╣║╬∩(&H)"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\HideFolderVerbs	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\LocalizedString = "╠╘▒ª-╣║╬∩"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\MUIVerb = "@shdoclc.dll,-10241"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\WantsParsDisplayName	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32\ThreadingModel = "Apartment"	reg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2044	1516	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe	27
PID 1516 wrote to memory of 2044	1516	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe	27
PID 1516 wrote to memory of 2044	1516	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe	27
PID 1516 wrote to memory of 2044	1516	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe	27
PID 1516 wrote to memory of 2044	1516	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe	27
PID 1516 wrote to memory of 2044	1516	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe	27
PID 1516 wrote to memory of 2044	1516	a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe	27
PID 2044 wrote to memory of 1792	2044	WScript.exe	28
PID 2044 wrote to memory of 1792	2044	WScript.exe	28
PID 2044 wrote to memory of 1792	2044	WScript.exe	28
PID 2044 wrote to memory of 1792	2044	WScript.exe	28
PID 2044 wrote to memory of 1792	2044	WScript.exe	28
PID 2044 wrote to memory of 1792	2044	WScript.exe	28
PID 2044 wrote to memory of 1792	2044	WScript.exe	28
PID 1792 wrote to memory of 1600	1792	cmd.exe	30
PID 1792 wrote to memory of 1600	1792	cmd.exe	30
PID 1792 wrote to memory of 1600	1792	cmd.exe	30
PID 1792 wrote to memory of 1600	1792	cmd.exe	30
PID 1792 wrote to memory of 1600	1792	cmd.exe	30
PID 1792 wrote to memory of 1600	1792	cmd.exe	30
PID 1792 wrote to memory of 1600	1792	cmd.exe	30
PID 1792 wrote to memory of 1728	1792	cmd.exe	31
PID 1792 wrote to memory of 1728	1792	cmd.exe	31
PID 1792 wrote to memory of 1728	1792	cmd.exe	31
PID 1792 wrote to memory of 1728	1792	cmd.exe	31
PID 1792 wrote to memory of 1728	1792	cmd.exe	31
PID 1792 wrote to memory of 1728	1792	cmd.exe	31
PID 1792 wrote to memory of 1728	1792	cmd.exe	31
PID 1792 wrote to memory of 1548	1792	cmd.exe	32
PID 1792 wrote to memory of 1548	1792	cmd.exe	32
PID 1792 wrote to memory of 1548	1792	cmd.exe	32
PID 1792 wrote to memory of 1548	1792	cmd.exe	32
PID 1792 wrote to memory of 1548	1792	cmd.exe	32
PID 1792 wrote to memory of 1548	1792	cmd.exe	32
PID 1792 wrote to memory of 1548	1792	cmd.exe	32
PID 1792 wrote to memory of 972	1792	cmd.exe	33
PID 1792 wrote to memory of 972	1792	cmd.exe	33
PID 1792 wrote to memory of 972	1792	cmd.exe	33
PID 1792 wrote to memory of 972	1792	cmd.exe	33
PID 1792 wrote to memory of 972	1792	cmd.exe	33
PID 1792 wrote to memory of 972	1792	cmd.exe	33
PID 1792 wrote to memory of 972	1792	cmd.exe	33
PID 1792 wrote to memory of 1700	1792	cmd.exe	34
PID 1792 wrote to memory of 1700	1792	cmd.exe	34
PID 1792 wrote to memory of 1700	1792	cmd.exe	34
PID 1792 wrote to memory of 1700	1792	cmd.exe	34
PID 1792 wrote to memory of 1700	1792	cmd.exe	34
PID 1792 wrote to memory of 1700	1792	cmd.exe	34
PID 1792 wrote to memory of 1700	1792	cmd.exe	34
PID 1792 wrote to memory of 1204	1792	cmd.exe	35
PID 1792 wrote to memory of 1204	1792	cmd.exe	35
PID 1792 wrote to memory of 1204	1792	cmd.exe	35
PID 1792 wrote to memory of 1204	1792	cmd.exe	35
PID 1792 wrote to memory of 1204	1792	cmd.exe	35
PID 1792 wrote to memory of 1204	1792	cmd.exe	35
PID 1792 wrote to memory of 1204	1792	cmd.exe	35
PID 1792 wrote to memory of 588	1792	cmd.exe	36
PID 1792 wrote to memory of 588	1792	cmd.exe	36
PID 1792 wrote to memory of 588	1792	cmd.exe	36
PID 1792 wrote to memory of 588	1792	cmd.exe	36
PID 1792 wrote to memory of 588	1792	cmd.exe	36
PID 1792 wrote to memory of 588	1792	cmd.exe	36
PID 1792 wrote to memory of 588	1792	cmd.exe	36
PID 1792 wrote to memory of 1940	1792	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe
"C:\Users\Admin\AppData\Local\Temp\a3d20573a47b6d41aa293989043810bbf8893b86742183e3f9e6952400958a36.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files\WindWare\tb.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\tb.cmd
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}"
      4⤵
      Modifies registry class
      PID:1600
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}" /v "InfoTip" /t REG_SZ /d "╠╘▒ª╣║╬∩╠╪╝█╙┼╗▌╟°" /f
      4⤵
      Modifies registry class
      PID:1728
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}" /v "LocalizedString" /t REG_SZ /d "╠╘▒ª-╣║╬∩" /f
      4⤵
      Modifies registry class
      PID:1548
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon"
      4⤵
      Modifies registry class
      PID:972
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "C:\Program Files\Internet Explorer\iedw.ico" /f
      4⤵
      Modifies registry class
      PID:1700
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32"
      4⤵
      Modifies registry class
      PID:1204
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f
      4⤵
      Modifies registry class
      PID:588
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
      4⤵
      Modifies registry class
      PID:1940
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell"
      4⤵
      Modifies registry class
      PID:1656
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell" /ve /t REG_SZ /d "╠╘▒ª-╣║╬∩(&H)" /f
      4⤵
      Modifies registry class
      PID:1808
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)"
      4⤵
      Modifies registry class
      PID:548
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f
      4⤵
      Modifies registry class
      PID:1488
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command"
      4⤵
      Modifies registry class
      PID:976
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\╠╘▒ª-╣║╬∩(&H)\Command" /ve /t REG_SZ /d "C:\progra~1\Intern~1\iexplore.exe http://www.dao666.com/go/taobao.htm" /f
      4⤵
      Modifies registry class
      PID:760
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder"
      4⤵
      Modifies registry class
      PID:980
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry class
      PID:1508
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:1960
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WindWare\Internet Exploror.lnk

Filesize
104B

MD5
b6090a24bad18a0205bb215cb1fd42e6

SHA1
da56e637a186333e1fa8401b9600e9efcadbe86b

SHA256
5cf73d8ba3a6656e804041884cefc0148c3ef80fd4b8633a6647a033082f15f8

SHA512
4ca8a5cd200eaf8d8a023c47e7a279e41279c045bf567b81f95e93ca25d5a51dec2786de98efa5b907ec5633c8400e497f6bcaf636d4591d7c42e21ec3039ad4

Download Submit
C:\Program Files\WindWare\iedw.ico

Filesize
14KB

MD5
468fada123f5548ac87e57bae81f6782

SHA1
edb8f012c25906e6afd8bf335b495e16c440243d

SHA256
091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d

SHA512
635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa

Download Submit
C:\Program Files\WindWare\tb.cmd

Filesize
2KB

MD5
4b8b392ac99df4d6f2239666eed11fa1

SHA1
27984247b633823df077b190e5ec5317a539698d

SHA256
6a0861f8cc7c16a931bb80ec8b270bd5e9081bdcd04f981a44238ee8e4a257a0

SHA512
f69762846470bd711b89c59429dd68812de9ff8828237f9c61283770f90c8f9bbe1c2c539f429cc0308832816ac3368b5925032103f3ae1e94b24247fc64ba3c

Download Submit
C:\Program Files\WindWare\tb.vbs

Filesize
126B

MD5
633a419fc58b7353d6eaef683fe1fca1

SHA1
5ece6a3d396e1888c5c051b12411537e3957aee1

SHA256
786068fda43174b1dc28073d1d0861aeb06debe26b2a6a9453680976f0433d2b

SHA512
f209583d2e0b9392a49c6f276be1f91cc4f719ae5284b72971e5ca2dd7bb1759fd59873ddba7ebf200944dd9855ee49c9528fe906efa8d9e0c9adad677457b50

Download Submit
memory/1516-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download