e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee

Analysis

max time kernel
190s
max time network
80s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe
Size

235KB
MD5

ce2898891899fc271747040fe6c510c0
SHA1

26d429ec0433fb51b91b62ced4f9f83df46c19a7
SHA256

e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee
SHA512

23436c96e5fb76868851b7578f5ad6a6810c3d03a5362177260c8d1e106f78d43d553e59066e54b1e48f000c156cfd83b3aedb55e9d09f84a84647d7410bcd1f
SSDEEP

6144:SjLOjTZIVuJCRZBkcJpEBhRenwYB07XabU+Erpxl:wLO+MJCSIzmPl

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	duouv.exe

Executes dropped EXE 4 IoCs

pid	Process
1912	apdat.exe
1328	duouv.exe
1284	bpdat.exe
2008	cpdat.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1340-82-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/1340-84-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/1340-85-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/1340-89-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/1340-90-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/1340-97-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
520	cmd.exe

Loads dropped DLL 7 IoCs

pid	Process
1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe
1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe
1912	apdat.exe
1912	apdat.exe
1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe
1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe
1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe

Adds Run key to start application 2 TTPs 45 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /t"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /I"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /v"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /n"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /b"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /J"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /l"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /z"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /G"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /X"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /Z"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /W"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /F"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /Q"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /w"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /R"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /P"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /H"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /e"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /V"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /N"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /d"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /q"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /u"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /L"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /A"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /k"	duouv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /U"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /T"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /f"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /K"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /S"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /c"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /j"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /D"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /M"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /C"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /m"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /E"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /i"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /r"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /O"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /h"	duouv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\duouv = "C:\\Users\\Admin\\duouv.exe /y"	duouv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 1340	1284	bpdat.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1232	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1912	apdat.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1328	duouv.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe
1340	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	tasklist.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1912	apdat.exe
1328	duouv.exe
1284	bpdat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1912	1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe	28
PID 1384 wrote to memory of 1912	1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe	28
PID 1384 wrote to memory of 1912	1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe	28
PID 1384 wrote to memory of 1912	1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe	28
PID 1912 wrote to memory of 1328	1912	apdat.exe	29
PID 1912 wrote to memory of 1328	1912	apdat.exe	29
PID 1912 wrote to memory of 1328	1912	apdat.exe	29
PID 1912 wrote to memory of 1328	1912	apdat.exe	29
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1912	1328	duouv.exe	28
PID 1328 wrote to memory of 1912	1328	duouv.exe	28
PID 1912 wrote to memory of 1764	1912	apdat.exe	30
PID 1912 wrote to memory of 1764	1912	apdat.exe	30
PID 1912 wrote to memory of 1764	1912	apdat.exe	30
PID 1912 wrote to memory of 1764	1912	apdat.exe	30
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1384 wrote to memory of 1284	1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe	32
PID 1384 wrote to memory of 1284	1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe	32
PID 1384 wrote to memory of 1284	1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe	32
PID 1384 wrote to memory of 1284	1384	e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe	32
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1764 wrote to memory of 1232	1764	cmd.exe	33
PID 1764 wrote to memory of 1232	1764	cmd.exe	33
PID 1764 wrote to memory of 1232	1764	cmd.exe	33
PID 1764 wrote to memory of 1232	1764	cmd.exe	33
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1384	1328	duouv.exe	20
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1764	1328	duouv.exe	30
PID 1328 wrote to memory of 1284	1328	duouv.exe	32
PID 1328 wrote to memory of 1284	1328	duouv.exe	32

C:\Users\Admin\AppData\Local\Temp\e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe
"C:\Users\Admin\AppData\Local\Temp\e900bcc6173819ee322b0383a2dece635781d25d022daa8080231dfb5f74acee.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\apdat.exe
  "C:\Users\Admin\apdat.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Users\Admin\duouv.exe
    "C:\Users\Admin\duouv.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del apdat.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1232
- C:\Users\Admin\bpdat.exe
  "C:\Users\Admin\bpdat.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  PID:1284
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\a.bat" "
    3⤵
    PID:1712
- C:\Users\Admin\cpdat.exe
  "C:\Users\Admin\cpdat.exe"
  2⤵
  - Executes dropped EXE
  PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Dxj..bat" > nul 2> nul
    3⤵
    PID:932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Deletes itself
  PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
300B

MD5
919d096776055079517938d3dbbdcc08

SHA1
4215956f4dede0b8bd6d25691d6a85976f7ea264

SHA256
394244fc96f81df145edd75017d3814eb7cc592edfbc260442ebd6e2e9980ce6

SHA512
6ef84031ef02e923d3615b7bf0e76a107401b2e89b16fa03dc608b0ca1cfd96ff6bcea825acbea6b6efc24cb324fbf30f6a8fdf91efc20aba86dfc1afea1034c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dxj..bat

Filesize
118B

MD5
57b7002bd20ec73150ffb9325266eb63

SHA1
21386befe73c362bfbcc2608eaec37005775bdd2

SHA256
cc825493e1d03a170edf01e29715e3438897ed0a1eebdeeb1316cf021d035065

SHA512
98dcca468cdf75ae3019aa7b6aadd681b2c883e7d34ca19c88da4a35f2eb1bcc0e10ecbeccf32e12d24e4f6fb2ea5d380657f2707aed021d78e1daef6152243f

Download Submit
C:\Users\Admin\a.bat

Filesize
113B

MD5
66b2c6f19da3ae21d6c05d74d66e77ad

SHA1
e55912921b484e2309700c4fd207c3bef5e426fd

SHA256
997e128acbe45008504244efa5081c58a0238015822fa402ebcd2e12831e5187

SHA512
5b096a3a673b6d7f69dc8d8eee6faf9280e6433b9bc33aa234cf8a7701c539420e87340447e7e6efafff8e9f2028dda43f91d03d0baba78c944cd7d7a580a651

Download Submit
C:\Users\Admin\apdat.exe

Filesize
168KB

MD5
2d0d7c0f6c69376565c31c0dd35e8378

SHA1
15d15a02859662ad669f345853693627b9208aa7

SHA256
4586653d7cdad61fddda7481c9f5fae0751a59cb8566a333a314af9f960d03e4

SHA512
b120056d975348af06599c5ea67308981e7211abb1d96ff482d6fcc5d193155e35ac94e803a12685941ea54256527cfcad6a82ac4e0644cdb95ec7048a99f60e

Download Submit
C:\Users\Admin\apdat.exe

Filesize
168KB

MD5
2d0d7c0f6c69376565c31c0dd35e8378

SHA1
15d15a02859662ad669f345853693627b9208aa7

SHA256
4586653d7cdad61fddda7481c9f5fae0751a59cb8566a333a314af9f960d03e4

SHA512
b120056d975348af06599c5ea67308981e7211abb1d96ff482d6fcc5d193155e35ac94e803a12685941ea54256527cfcad6a82ac4e0644cdb95ec7048a99f60e

Download Submit
C:\Users\Admin\bpdat.exe

Filesize
132KB

MD5
8b564673bb28181880f2ad0a76e52b28

SHA1
f3e82858bee1262d97080950109013ae999d7135

SHA256
cb3a924930bb98193eadaa75ad6c8a4584d6c0d5cc16f23ba80088950a472c62

SHA512
9b0d20aba11e848d4fef3109d7fc435a7292d28f05e1f09667aa7f16269299356be0d981e47c7e958846d03d83577a6132a3f92bfba2ac42be39c99cb27744cf

Download Submit
C:\Users\Admin\bpdat.exe

Filesize
132KB

MD5
8b564673bb28181880f2ad0a76e52b28

SHA1
f3e82858bee1262d97080950109013ae999d7135

SHA256
cb3a924930bb98193eadaa75ad6c8a4584d6c0d5cc16f23ba80088950a472c62

SHA512
9b0d20aba11e848d4fef3109d7fc435a7292d28f05e1f09667aa7f16269299356be0d981e47c7e958846d03d83577a6132a3f92bfba2ac42be39c99cb27744cf

Download Submit
C:\Users\Admin\cpdat.exe

Filesize
140KB

MD5
68c50db3bfc0d0bec1c8625ddf4ab3b9

SHA1
2989eba1f8ec6ba094f74c3a63d8b56f0d6b0d5d

SHA256
00b3fa92f25949bb6d5cb5d91c8a3641c12b6e9ff6c8560d49f6dc2a4a065ce4

SHA512
cdae71d850c453d6a61747cc5b7635d1b172ed235a4468d559e00bf4b5f7027969d72f79e8f22547373314a188dd9def4fcc7034b8b385421578cd34475876b6

Download Submit
C:\Users\Admin\cpdat.exe

Filesize
140KB

MD5
68c50db3bfc0d0bec1c8625ddf4ab3b9

SHA1
2989eba1f8ec6ba094f74c3a63d8b56f0d6b0d5d

SHA256
00b3fa92f25949bb6d5cb5d91c8a3641c12b6e9ff6c8560d49f6dc2a4a065ce4

SHA512
cdae71d850c453d6a61747cc5b7635d1b172ed235a4468d559e00bf4b5f7027969d72f79e8f22547373314a188dd9def4fcc7034b8b385421578cd34475876b6

Download Submit
C:\Users\Admin\duouv.exe

Filesize
168KB

MD5
c02ca4732dbdad83b46b4774b805cb64

SHA1
5544986c50747971731e128d3b862262bd38c0ca

SHA256
e8c139fa8cd902d12cba851e12b3d2cdbf1eb1255c04666d46307b375dda4dff

SHA512
cb9b217192ab796249ba4955df4b15b41922239445396191088836ae078f7edbcf5221185a29a4c1179ee2fb0f2c8e1aa880a752a1fbcd9c212f02beb2126ea6

Download Submit
C:\Users\Admin\duouv.exe

Filesize
168KB

MD5
c02ca4732dbdad83b46b4774b805cb64

SHA1
5544986c50747971731e128d3b862262bd38c0ca

SHA256
e8c139fa8cd902d12cba851e12b3d2cdbf1eb1255c04666d46307b375dda4dff

SHA512
cb9b217192ab796249ba4955df4b15b41922239445396191088836ae078f7edbcf5221185a29a4c1179ee2fb0f2c8e1aa880a752a1fbcd9c212f02beb2126ea6

Download Submit
\Users\Admin\apdat.exe

Filesize
168KB

MD5
2d0d7c0f6c69376565c31c0dd35e8378

SHA1
15d15a02859662ad669f345853693627b9208aa7

SHA256
4586653d7cdad61fddda7481c9f5fae0751a59cb8566a333a314af9f960d03e4

SHA512
b120056d975348af06599c5ea67308981e7211abb1d96ff482d6fcc5d193155e35ac94e803a12685941ea54256527cfcad6a82ac4e0644cdb95ec7048a99f60e

Download Submit
\Users\Admin\apdat.exe

Filesize
168KB

MD5
2d0d7c0f6c69376565c31c0dd35e8378

SHA1
15d15a02859662ad669f345853693627b9208aa7

SHA256
4586653d7cdad61fddda7481c9f5fae0751a59cb8566a333a314af9f960d03e4

SHA512
b120056d975348af06599c5ea67308981e7211abb1d96ff482d6fcc5d193155e35ac94e803a12685941ea54256527cfcad6a82ac4e0644cdb95ec7048a99f60e

Download Submit
\Users\Admin\bpdat.exe

Filesize
132KB

MD5
8b564673bb28181880f2ad0a76e52b28

SHA1
f3e82858bee1262d97080950109013ae999d7135

SHA256
cb3a924930bb98193eadaa75ad6c8a4584d6c0d5cc16f23ba80088950a472c62

SHA512
9b0d20aba11e848d4fef3109d7fc435a7292d28f05e1f09667aa7f16269299356be0d981e47c7e958846d03d83577a6132a3f92bfba2ac42be39c99cb27744cf

Download Submit
\Users\Admin\bpdat.exe

Filesize
132KB

MD5
8b564673bb28181880f2ad0a76e52b28

SHA1
f3e82858bee1262d97080950109013ae999d7135

SHA256
cb3a924930bb98193eadaa75ad6c8a4584d6c0d5cc16f23ba80088950a472c62

SHA512
9b0d20aba11e848d4fef3109d7fc435a7292d28f05e1f09667aa7f16269299356be0d981e47c7e958846d03d83577a6132a3f92bfba2ac42be39c99cb27744cf

Download Submit
\Users\Admin\cpdat.exe

Filesize
140KB

MD5
68c50db3bfc0d0bec1c8625ddf4ab3b9

SHA1
2989eba1f8ec6ba094f74c3a63d8b56f0d6b0d5d

SHA256
00b3fa92f25949bb6d5cb5d91c8a3641c12b6e9ff6c8560d49f6dc2a4a065ce4

SHA512
cdae71d850c453d6a61747cc5b7635d1b172ed235a4468d559e00bf4b5f7027969d72f79e8f22547373314a188dd9def4fcc7034b8b385421578cd34475876b6

Download Submit
\Users\Admin\duouv.exe

Filesize
168KB

MD5
c02ca4732dbdad83b46b4774b805cb64

SHA1
5544986c50747971731e128d3b862262bd38c0ca

SHA256
e8c139fa8cd902d12cba851e12b3d2cdbf1eb1255c04666d46307b375dda4dff

SHA512
cb9b217192ab796249ba4955df4b15b41922239445396191088836ae078f7edbcf5221185a29a4c1179ee2fb0f2c8e1aa880a752a1fbcd9c212f02beb2126ea6

Download Submit
\Users\Admin\duouv.exe

Filesize
168KB

MD5
c02ca4732dbdad83b46b4774b805cb64

SHA1
5544986c50747971731e128d3b862262bd38c0ca

SHA256
e8c139fa8cd902d12cba851e12b3d2cdbf1eb1255c04666d46307b375dda4dff

SHA512
cb9b217192ab796249ba4955df4b15b41922239445396191088836ae078f7edbcf5221185a29a4c1179ee2fb0f2c8e1aa880a752a1fbcd9c212f02beb2126ea6

Download Submit
memory/520-105-0x0000000000000000-mapping.dmp

Download
memory/932-101-0x0000000000000000-mapping.dmp

Download
memory/1232-80-0x0000000000000000-mapping.dmp

Download
memory/1284-75-0x0000000000000000-mapping.dmp

Download
memory/1328-65-0x0000000000000000-mapping.dmp

Download
memory/1340-82-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1340-97-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1340-90-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1340-81-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1340-85-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1340-86-0x000000000040D7E0-mapping.dmp

Download
memory/1340-84-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1340-89-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1384-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1712-91-0x0000000000000000-mapping.dmp

Download
memory/1764-72-0x0000000000000000-mapping.dmp

Download
memory/1912-71-0x0000000003411000-0x000000000395D000-memory.dmp

Filesize
5.3MB

Download
memory/1912-57-0x0000000000000000-mapping.dmp

Download
memory/2008-98-0x0000000000350000-0x0000000000359000-memory.dmp

Filesize
36KB

Download
memory/2008-99-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-100-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-102-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-94-0x0000000000000000-mapping.dmp

Download