c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846

Analysis

max time kernel
185s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe
Size 192KB
Sample221203-ftlqbabe7t
SHA256 c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846
MD5 63c789b0b11e0588898b3677305622c9
SHA1 ae024aab9aee2ef8ac29fe5849d5db2f15d5730d
SHA512 aee64af726267ccdb81664e869a033706c32252bd309fb2291e9e678761c8c46bbf8f5b359f44c929b6252ecbcc735a567710ac8e8bc96a19ffc129a26cf1259
SSDEEP 6144:SiC2F8NXC796TB9vj48cS94dSegArgpuNXJpS:SceVQkTrvj4K4dYWgpuzpS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

Executes dropped EXE 1 IoCs

pid	Process
3696	Trojan.exe

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Modify Existing Service

T1031

pid	Process
3096	netsh.exe
4620	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Trojan.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe

Loads dropped DLL 2 IoCs

pid	Process
2288	wscript.exe
2288	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Trojan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 61 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\0.0.0.0\Class = "uwlcpxemmpd.A"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\Implemented Categories	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\ThreadingModel = "Both"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\0.0.0.0	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\Class = "uwlcpxemmpd.A"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\RuntimeVersion = "v2.0.50727"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\ProgId\ = "uwlcpxemmpd.A"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.uwlcpxemmpd	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.A\CLSID	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.A\CLSID\ = "{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\Assembly = "uwlcpxemmpd, Version=0.0.0.0, Culture=neutral, PublicKeyToken=461d39c4a423da0b"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.A	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\ProgId	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.A	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\ = "uwlcpxemmpd.A"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\ProgId\ = "uwlcpxemmpd.uwlcpxemmpd"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\0.0.0.0	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\ProgId	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\Implemented Categories	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\Assembly = "uwlcpxemmpd, Version=0.0.0.0, Culture=neutral, PublicKeyToken=461d39c4a423da0b"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.uwlcpxemmpd	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.A\ = "uwlcpxemmpd.A"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\Class = "uwlcpxemmpd.uwlcpxemmpd"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\ProgId	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.uwlcpxemmpd\ = "uwlcpxemmpd.uwlcpxemmpd"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.uwlcpxemmpd\CLSID	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.uwlcpxemmpd\CLSID	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\0.0.0.0	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\ThreadingModel = "Both"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\ = "mscoree.dll"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\Implemented Categories	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\Implemented Categories	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\0.0.0.0\Assembly = "uwlcpxemmpd, Version=0.0.0.0, Culture=neutral, PublicKeyToken=461d39c4a423da0b"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\ProgId	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29}\0 = ".NET Category"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\0.0.0.0	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\0.0.0.0\Assembly = "uwlcpxemmpd, Version=0.0.0.0, Culture=neutral, PublicKeyToken=461d39c4a423da0b"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\ = "uwlcpxemmpd.uwlcpxemmpd"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.A\CLSID	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24AFC0B-BA8D-3D50-9B39-82E1C6D0A790}\InprocServer32\ = "mscoree.dll"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uwlcpxemmpd.uwlcpxemmpd\CLSID\ = "{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1407C1E3-1F37-3C47-9B43-A4CD6DA2EC8E}\InprocServer32\0.0.0.0\Class = "uwlcpxemmpd.uwlcpxemmpd"	Trojan.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe
Token: SeDebugPrivilege	3696	Trojan.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3696	3004	c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe	82
PID 3004 wrote to memory of 3696	3004	c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe	82
PID 3004 wrote to memory of 3696	3004	c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe	82
PID 3696 wrote to memory of 3096	3696	Trojan.exe	87
PID 3696 wrote to memory of 3096	3696	Trojan.exe	87
PID 3696 wrote to memory of 3096	3696	Trojan.exe	87
PID 3696 wrote to memory of 4620	3696	Trojan.exe	88
PID 3696 wrote to memory of 4620	3696	Trojan.exe	88
PID 3696 wrote to memory of 4620	3696	Trojan.exe	88
PID 3696 wrote to memory of 2288	3696	Trojan.exe	91
PID 3696 wrote to memory of 2288	3696	Trojan.exe	91
PID 3696 wrote to memory of 2288	3696	Trojan.exe	91

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

C:\Users\Admin\AppData\Local\Temp\c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe
"C:\Users\Admin\AppData\Local\Temp\c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3004
- C:\Users\Admin\AppData\Local\Temp\Trojan.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3696
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:3096
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\SysWOW64\wscript.exe" "wscript.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:4620
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\SysWOW64\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Trojan.vbe"
    3⤵
    - Loads dropped DLL
    PID:2288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Trojan.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Size 192KB
SHA256 c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846
MD5 63c789b0b11e0588898b3677305622c9
SHA1 ae024aab9aee2ef8ac29fe5849d5db2f15d5730d
SHA512 aee64af726267ccdb81664e869a033706c32252bd309fb2291e9e678761c8c46bbf8f5b359f44c929b6252ecbcc735a567710ac8e8bc96a19ffc129a26cf1259
SSDEEP 6144:SiC2F8NXC796TB9vj48cS94dSegArgpuNXJpS:SceVQkTrvj4K4dYWgpuzpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trojan.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Size 192KB
SHA256 c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846
MD5 63c789b0b11e0588898b3677305622c9
SHA1 ae024aab9aee2ef8ac29fe5849d5db2f15d5730d
SHA512 aee64af726267ccdb81664e869a033706c32252bd309fb2291e9e678761c8c46bbf8f5b359f44c929b6252ecbcc735a567710ac8e8bc96a19ffc129a26cf1259
SSDEEP 6144:SiC2F8NXC796TB9vj48cS94dSegArgpuNXJpS:SceVQkTrvj4K4dYWgpuzpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trojan.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Size 192KB
SHA256 c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846
MD5 63c789b0b11e0588898b3677305622c9
SHA1 ae024aab9aee2ef8ac29fe5849d5db2f15d5730d
SHA512 aee64af726267ccdb81664e869a033706c32252bd309fb2291e9e678761c8c46bbf8f5b359f44c929b6252ecbcc735a567710ac8e8bc96a19ffc129a26cf1259
SSDEEP 6144:SiC2F8NXC796TB9vj48cS94dSegArgpuNXJpS:SceVQkTrvj4K4dYWgpuzpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trojan.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Size 192KB
SHA256 c85099b1960621d338b29d0138a08928641b8e1092cc481a24d4111f4c10d846
MD5 63c789b0b11e0588898b3677305622c9
SHA1 ae024aab9aee2ef8ac29fe5849d5db2f15d5730d
SHA512 aee64af726267ccdb81664e869a033706c32252bd309fb2291e9e678761c8c46bbf8f5b359f44c929b6252ecbcc735a567710ac8e8bc96a19ffc129a26cf1259
SSDEEP 6144:SiC2F8NXC796TB9vj48cS94dSegArgpuNXJpS:SceVQkTrvj4K4dYWgpuzpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trojan.vbe

Path C:\Users\Admin\AppData\Local\Temp\Trojan.vbe
Size 54B
SHA256 e7f4b6618e85c5d086b0160fd5c6f0a21ddc1267f1113fda4046e0b7af78c534
MD5 0625008d3e21fded53b012367d715af5
SHA1 484fb838fa428fc36eb056f1df43e2e0726f2d62
SHA512 feae13152aa58330331063ac3ce22f5f62a7ad55a934c27e7ba884a14697285d876df7f14f10a54d95cb3598f48f8dabf253d5d107fc9b92afa946aac87a9e34
MD5 SHA1 SHA512

Submit Download

memory/2288-263-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/2288-262-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/2288-260-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/3004-166-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-170-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-142-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-144-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-145-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/3004-146-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-143-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-149-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-148-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-150-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-147-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-155-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-154-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-153-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-152-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-151-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-158-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-159-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-157-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-156-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-160-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-162-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-161-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-163-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-164-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-167-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-165-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-139-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-168-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-169-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-171-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-135-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-172-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-174-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-173-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-175-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-177-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-176-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-178-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-179-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-180-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-181-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-182-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-184-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-183-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-187-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-185-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-186-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-188-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-189-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-190-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-199-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/3004-132-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-136-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-137-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-141-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-140-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3004-138-0x00000000001C0000-0x00000000001DE000-memory.dmp

Download

memory/3696-198-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/3696-261-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads