laplas | 015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925

Analysis

max time kernel
83s
max time network
91s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-03-2023 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Other.Malware-gen.25698.21095.msi
Size

3.8MB
MD5

c39fec313f716b37b80ccf946ef5cc83
SHA1

7af29257d77bab7ed5a70293abe44da3c1c10c37
SHA256

015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925
SHA512

0eeb8fa73bbf1886101db96ea376343fae6bae872a264b55feb58a1060c75772f45b5244b005613830e056cd7a58f8307bb54c01417cacd7a57d46542b160291
SSDEEP

49152:LpUPlOPlQRNDP9nqI5KKs2p8iYu9ap7QqKHKG+n2H6h1Ug:LpTt4NDVPKB2vinG8n2Hs

Score

10^/10

laplas clipper discovery spyware stealer

Malware Config

Extracted

Family

laplas

http://193.233.20.134

Attributes

api_key
57728dce0f7018e17faf9f061cb2d77048e08414376baf6d860b78e74e83c208

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1496	Bpznb.exe
1280	Bpznb.exe

Loads dropped DLL 7 IoCs

pid	Process
804	MsiExec.exe
804	MsiExec.exe
804	MsiExec.exe
804	MsiExec.exe
804	MsiExec.exe
1496	Bpznb.exe
804	MsiExec.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
928	ICACLS.EXE
1572	ICACLS.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1496 set thread context of 1280	1496	Bpznb.exe	37

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI66A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6700.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\6ca852.ipi	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB5D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6ca852.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6ca851.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6ca851.msi	msiexec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Bpznb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Bpznb.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
868	msiexec.exe
868	msiexec.exe
1280	Bpznb.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1524	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeSecurityPrivilege	868	msiexec.exe
Token: SeCreateTokenPrivilege	1524	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1524	msiexec.exe
Token: SeLockMemoryPrivilege	1524	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1524	msiexec.exe
Token: SeMachineAccountPrivilege	1524	msiexec.exe
Token: SeTcbPrivilege	1524	msiexec.exe
Token: SeSecurityPrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeLoadDriverPrivilege	1524	msiexec.exe
Token: SeSystemProfilePrivilege	1524	msiexec.exe
Token: SeSystemtimePrivilege	1524	msiexec.exe
Token: SeProfSingleProcessPrivilege	1524	msiexec.exe
Token: SeIncBasePriorityPrivilege	1524	msiexec.exe
Token: SeCreatePagefilePrivilege	1524	msiexec.exe
Token: SeCreatePermanentPrivilege	1524	msiexec.exe
Token: SeBackupPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeShutdownPrivilege	1524	msiexec.exe
Token: SeDebugPrivilege	1524	msiexec.exe
Token: SeAuditPrivilege	1524	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1524	msiexec.exe
Token: SeChangeNotifyPrivilege	1524	msiexec.exe
Token: SeRemoteShutdownPrivilege	1524	msiexec.exe
Token: SeUndockPrivilege	1524	msiexec.exe
Token: SeSyncAgentPrivilege	1524	msiexec.exe
Token: SeEnableDelegationPrivilege	1524	msiexec.exe
Token: SeManageVolumePrivilege	1524	msiexec.exe
Token: SeImpersonatePrivilege	1524	msiexec.exe
Token: SeCreateGlobalPrivilege	1524	msiexec.exe
Token: SeBackupPrivilege	340	vssvc.exe
Token: SeRestorePrivilege	340	vssvc.exe
Token: SeAuditPrivilege	340	vssvc.exe
Token: SeBackupPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeRestorePrivilege	940	DrvInst.exe
Token: SeRestorePrivilege	940	DrvInst.exe
Token: SeRestorePrivilege	940	DrvInst.exe
Token: SeRestorePrivilege	940	DrvInst.exe
Token: SeRestorePrivilege	940	DrvInst.exe
Token: SeRestorePrivilege	940	DrvInst.exe
Token: SeRestorePrivilege	940	DrvInst.exe
Token: SeLoadDriverPrivilege	940	DrvInst.exe
Token: SeLoadDriverPrivilege	940	DrvInst.exe
Token: SeLoadDriverPrivilege	940	DrvInst.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeDebugPrivilege	1496	Bpznb.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1524	msiexec.exe
1524	msiexec.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 804	868	msiexec.exe	31
PID 868 wrote to memory of 804	868	msiexec.exe	31
PID 868 wrote to memory of 804	868	msiexec.exe	31
PID 868 wrote to memory of 804	868	msiexec.exe	31
PID 868 wrote to memory of 804	868	msiexec.exe	31
PID 868 wrote to memory of 804	868	msiexec.exe	31
PID 868 wrote to memory of 804	868	msiexec.exe	31
PID 804 wrote to memory of 928	804	MsiExec.exe	32
PID 804 wrote to memory of 928	804	MsiExec.exe	32
PID 804 wrote to memory of 928	804	MsiExec.exe	32
PID 804 wrote to memory of 928	804	MsiExec.exe	32
PID 804 wrote to memory of 1148	804	MsiExec.exe	34
PID 804 wrote to memory of 1148	804	MsiExec.exe	34
PID 804 wrote to memory of 1148	804	MsiExec.exe	34
PID 804 wrote to memory of 1148	804	MsiExec.exe	34
PID 804 wrote to memory of 1496	804	MsiExec.exe	36
PID 804 wrote to memory of 1496	804	MsiExec.exe	36
PID 804 wrote to memory of 1496	804	MsiExec.exe	36
PID 804 wrote to memory of 1496	804	MsiExec.exe	36
PID 804 wrote to memory of 1496	804	MsiExec.exe	36
PID 804 wrote to memory of 1496	804	MsiExec.exe	36
PID 804 wrote to memory of 1496	804	MsiExec.exe	36
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 1496 wrote to memory of 1280	1496	Bpznb.exe	37
PID 804 wrote to memory of 1572	804	MsiExec.exe	39
PID 804 wrote to memory of 1572	804	MsiExec.exe	39
PID 804 wrote to memory of 1572	804	MsiExec.exe	39
PID 804 wrote to memory of 1572	804	MsiExec.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Other.Malware-gen.25698.21095.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1524

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 275E8551333C0E24C0960FDB1286DC46
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:928
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:1148
- - C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe
      C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:1280
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HDAFBGIJKE.exe"
        5⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\HDAFBGIJKE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HDAFBGIJKE.exe"
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        7⤵
        
        PID:1460
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:1572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:340

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000498" "00000000000004A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mntemp

Filesize
16B

MD5
8a2d9b289c19e05fd0379b82f2919a21

SHA1
97440fb16a4b8c0ede2d527141749aab76a7a252

SHA256
158fa2d1f60e6330072d181063c9b6d2c2c19fd92b5400f382f7d95bfaec1fec

SHA512
cd553fea1140ebb0231c1ecb618793e6a4746a35129bc7a7c96e066cd17edf0f1fec65ee483784add1c296b06637e4f0ddf1e13c6e9231ec54ee2fc458acd015

Download Submit
C:\Users\Admin\AppData\Local\Temp\HDAFBGIJKE.exe

Filesize
10.5MB

MD5
d75c660c2584891aa2072643e345c941

SHA1
cc3ed51870ecd89963428c4d3638c8a99d0ea991

SHA256
11b80af6cb8bffedc46b7586644a29e9854ec440421926d7acd40e80b5ba08be

SHA512
8a9ab5f164b7268ff56529c35bf97dccedff20f822e2a4daabc97e0af7cfd9f31593df440a337e6b9d84db60e5ed0be6f238545f367dada3012c54f4c61bd7d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\HDAFBGIJKE.exe

Filesize
10.5MB

MD5
d75c660c2584891aa2072643e345c941

SHA1
cc3ed51870ecd89963428c4d3638c8a99d0ea991

SHA256
11b80af6cb8bffedc46b7586644a29e9854ec440421926d7acd40e80b5ba08be

SHA512
8a9ab5f164b7268ff56529c35bf97dccedff20f822e2a4daabc97e0af7cfd9f31593df440a337e6b9d84db60e5ed0be6f238545f367dada3012c54f4c61bd7d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files.cab

Filesize
3.2MB

MD5
d48e27fd09c1b7d7efc29939323126fb

SHA1
321f957363671d8f0f87eb7a8efac23e5e7252e0

SHA256
a74cd4380aa8bdca4391c1a76073bf8ca20c6b605f93d359f46638e994a9d3ce

SHA512
3e89a71527a6488b43b19462cbdd00da3650905ae198c94d977dd9140261dfb3d7598da0dd64c197d2629a212498ff65bb29898009d5c757e35465df1b087565

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe

Filesize
183.5MB

MD5
6b912f7598c8a16898f35fa0aa271bd2

SHA1
6cd1871fe336c39405980e2797d6d1892fe12285

SHA256
57d0cb516b8a7d7ea25cc17dbc7d2eaeb5056620312dde8caf6b0cc54d3544a6

SHA512
0bddc3177db427d9d5832517e29d4f2f1ab6a3981d6161b8f998d025a12ac95605def5f156e11e5f79215233654382b92d95a843b8f567adb391a184cbcf6829

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe

Filesize
164.5MB

MD5
d96719b64b3b29cda90ef332e86b1764

SHA1
80fed4cd350c03d9d3eadbbcbd5014a48d77e9d5

SHA256
ee77e7477afda2e19d958b83894e313b59910808240a8559aff8e8452ece3836

SHA512
c8ea526fa9aca64779d1b168fe7ca2d4e40fb504bc9489e6bdc6b01c9052e0248cef7a4527d163ce83621929c7d372a4117d133dfa913de21f77216400c14c96

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe

Filesize
111.6MB

MD5
4366f5a88fe5c1bf5dd70c8a40d3d4ce

SHA1
0c69151cf1d3d97f50a7c820a7a5eddba15140fe

SHA256
43f2d640c5756d9bad356b669ccdd390e83a6a529ad869f9f257a457ba344c6c

SHA512
f1d1f98e3ce4e2326fa48a05bdab43093a3d79a6f7c096d4dceccba0473f637c0084bf49f05eb7df8cd5ee5ba77c9f99943abc61878efa7e5e4954d0023e874c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\msiwrapper.ini

Filesize
1KB

MD5
a9c0ac9c550062917ab0927bc90867f7

SHA1
e7de69b5bfbe2a3fc5b8aca37185f298ded5f292

SHA256
c0d76ca099e0d9b08e4d48982291c77c0f9965ffa8652812fa417ea71bf1f94c

SHA512
787499c2fd29a982cc8508a0d41e8edc789c5156d10249de95e99588483bb40e4f28331594edda8559ffc8d22487c543d128c4c0c160abe7c6fc2820ec61e116

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\msiwrapper.ini

Filesize
1KB

MD5
a9c0ac9c550062917ab0927bc90867f7

SHA1
e7de69b5bfbe2a3fc5b8aca37185f298ded5f292

SHA256
c0d76ca099e0d9b08e4d48982291c77c0f9965ffa8652812fa417ea71bf1f94c

SHA512
787499c2fd29a982cc8508a0d41e8edc789c5156d10249de95e99588483bb40e4f28331594edda8559ffc8d22487c543d128c4c0c160abe7c6fc2820ec61e116

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\msiwrapper.ini

Filesize
1KB

MD5
e3e606cd76f0c4cc99a81d9e1d6a454e

SHA1
56b02a1a7a502da43f22e8f26808b43ed3f047b6

SHA256
a6a076d74d71fb21aa1504f3fee53267b762eb8e559144f52b0466273611b2fb

SHA512
e4614bb9a98fc584b496d8e3c4df25ec6fde28bc296d115fdb1b796fcff8ea646e4cd1a5a7461b42e6ca88886ad19090b8f8f9e275376b18327099acfdc02f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\msiwrapper.ini

Filesize
344B

MD5
6a196a753814912ec09f13b836b6d071

SHA1
8fb3fbc0d412de2f58960e7b417d0041b227aa2e

SHA256
9fc9c7d93042a0aa2766c38703954c2a37c6b57aa16e36e7e773880c20f74e31

SHA512
36e96c29cf064e228c7882992dc818cd647b67a98ff0f63b7754ca39bd9d982f6ddce39c96768cbb559e9976f0c61530bf703fb4ba93245242a9e2e2d56a7c7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\msiwrapper.ini

Filesize
1024B

MD5
47c7a7ac75abfcb0f7597a5e602af828

SHA1
7aabb4651da469c627977aaf6f434adf5d405646

SHA256
fdf2b62f632a468f583e1e019036e413a470bbde00d709ed180de89c71d36fdf

SHA512
ba6fd4b141adba0d9aeafcc0ebc274b0de4daf3dbbab314f9ca0d84030f8b4da3c5536c4af229caa54f61ba60984f9bb6535f4e418dcbf56f2997dec0aebbc7d

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
14.4MB

MD5
8510ff7df3f7d131984d189351027fe4

SHA1
26b6e83708fd0b8beb4dfdaf2fae0823d56bd265

SHA256
04c24c03f1b91096585a858a9450834364a17b382a3ec05f2a55b16d774b2f8b

SHA512
52bab813b9e4688e64096900e229ebb98372132aac0dd4e21aa1849005b618ab2489150a30e92d14e13e644f57c883b5bcb1d2d3903be21e5ec4fb95c674ced6

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
14.3MB

MD5
14c0f5119a0fb4412cff2d3d03646a6a

SHA1
93c4eeff11ba03f49a3b6cce03d1186b714d3c1f

SHA256
fcf276662bef5b1d869e766c99c58deb280f84816d56e25441f87e16a02b6df8

SHA512
ff4b0913ef7c80aadd9db08b818144e4ec60e9690dbc8f44d033f3dd31ac6d4f59e74b95af32775dcf3531132eb09993ccf773969144507e7774114a86167e38

Download Submit
C:\Windows\Installer\MSI6700.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSIAB5D.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\HDAFBGIJKE.exe

Filesize
10.5MB

MD5
d75c660c2584891aa2072643e345c941

SHA1
cc3ed51870ecd89963428c4d3638c8a99d0ea991

SHA256
11b80af6cb8bffedc46b7586644a29e9854ec440421926d7acd40e80b5ba08be

SHA512
8a9ab5f164b7268ff56529c35bf97dccedff20f822e2a4daabc97e0af7cfd9f31593df440a337e6b9d84db60e5ed0be6f238545f367dada3012c54f4c61bd7d6

Download Submit
\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe

Filesize
168.8MB

MD5
f82331d0966a0d872e1b2d0951420f95

SHA1
eb3ee4b131a477172c4d30d35765b578b3fec4b2

SHA256
f181e1a68cf0c4c29664669facb126485496eeff93e5bc3b57de8b6a8886199c

SHA512
042d6164f76d78ae85bbc2ecebff3b2153107d95a6b748b2db5b082b356682058bf01c9237c2576c68874a90fb5bb6bce51c76a602a937216a4b701609f45b48

Download Submit
\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe

Filesize
165.1MB

MD5
8c0ae465a9aab35c71d89e045306524a

SHA1
a6fe1a4b89c6b930f3d0ef7ef866e6f19083e924

SHA256
582f9cbb0390ebb719bafe8c58c9fb986e275b8867bc748ef5b83f0fa47c17a9

SHA512
3af726c4b2186ec2bd6876f197960aacb8805d35b84c449c9110789faa62e9d9ef6502fca04fdf9b53746eba46e605f907aea284aaae7a987ba1c3791170c390

Download Submit
\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe

Filesize
172.3MB

MD5
6450da073f0ca15108be9b129ebf2637

SHA1
baa84d4fa1a60fd7baec66e6942d59fde3294204

SHA256
61ca059594375f69887290264c270888d74bd082a6f8ea6480409d87dfb98fc6

SHA512
ab665e2750a1098f98467bf02b26fa0e7baaf8f76ae37e6cd44623b9d1f811c24e99e1a8da459c7fc207e2e71c9a76a64b80e84d2ce52921ab493d285ed311a3

Download Submit
\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe

Filesize
163.1MB

MD5
be0542f66503ea6451527a5158b736ae

SHA1
e823f6b746153276201b49862f5963fa64150fb1

SHA256
07fc412840feb32abb3c0d716d5c129d5fa76a7a604af42e8acc8555fee4031c

SHA512
42754092f0e21655f14f0de93a8be00fd78c81e7a02b6ea485db9be43d69980a754d7e3859521aeeaf3eb6ec7ac42b26fb1e6364a272e5ef6c7bc44f04830bec

Download Submit
\Users\Admin\AppData\Local\Temp\MW-32cc4e23-7634-4478-8397-4346a08eb223\files\Bpznb.exe

Filesize
109.8MB

MD5
06c906eec5282de1f0a562b9359dfe19

SHA1
2dc58021b5821f96db5891fc41e4f99d4f70ea67

SHA256
89b2dd8dd3576e7bd3e079a18644d257e1a867d61b0c5bc17d2393aa5cc20b3d

SHA512
8eecc55f28bd4b49adb028b0ca72e0ab5f04e4bbe98711b09c65899fbac8d92fb2e64ea4d16ea5173f6ae3cbd19071fbae0b66de76a4dec85b5d88d0ca36fbd0

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
14.5MB

MD5
9971b72ba74a11e78a360711060ee634

SHA1
a026e93d6cf3e8a11b776625336e424f2579e343

SHA256
7a404263578942d6584a918a09ee26b6c2e03a2c118be66f9faba73cdc750d55

SHA512
e5879c302771fcf97030f3772dbb9333a6b3f550bd5dc8c7e2b4ee2dfb82c3ea0c054d05521d3347c18210ec7dc88429ed21d80e0ccaeaf95dd32f699e7477a2

Download Submit
\Windows\Installer\MSI6700.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\Windows\Installer\MSIAB5D.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
memory/1280-161-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1280-142-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1280-145-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1280-144-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1280-156-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1280-147-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1280-143-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1280-146-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1280-219-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1280-150-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1460-254-0x0000000001080000-0x00000000021A7000-memory.dmp

Filesize
17.2MB

Download
memory/1460-255-0x0000000001080000-0x00000000021A7000-memory.dmp

Filesize
17.2MB

Download
memory/1460-257-0x0000000001080000-0x00000000021A7000-memory.dmp

Filesize
17.2MB

Download
memory/1460-252-0x0000000001080000-0x00000000021A7000-memory.dmp

Filesize
17.2MB

Download
memory/1496-129-0x00000000050A0000-0x0000000005260000-memory.dmp

Filesize
1.8MB

Download
memory/1496-140-0x0000000002280000-0x0000000002312000-memory.dmp

Filesize
584KB

Download
memory/1496-127-0x0000000000BB0000-0x0000000000E78000-memory.dmp

Filesize
2.8MB

Download
memory/1496-128-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download
memory/1496-130-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download
memory/1496-139-0x00000000056A0000-0x00000000057F2000-memory.dmp

Filesize
1.3MB

Download
memory/1600-238-0x00000000037E0000-0x0000000003BE3000-memory.dmp

Filesize
4.0MB

Download
memory/1600-240-0x0000000000230000-0x0000000001357000-memory.dmp

Filesize
17.2MB

Download
memory/1600-226-0x0000000000230000-0x0000000001357000-memory.dmp

Filesize
17.2MB

Download
memory/1600-246-0x00000000037E0000-0x0000000003BE3000-memory.dmp

Filesize
4.0MB

Download
memory/1600-225-0x0000000000230000-0x0000000001357000-memory.dmp

Filesize
17.2MB

Download
memory/1600-223-0x0000000000230000-0x0000000001357000-memory.dmp

Filesize
17.2MB

Download
memory/1600-251-0x0000000034640000-0x0000000035767000-memory.dmp

Filesize
17.2MB

Download
memory/1600-239-0x00000000037E0000-0x0000000003BE3000-memory.dmp

Filesize
4.0MB

Download
memory/1600-227-0x0000000000230000-0x0000000001357000-memory.dmp

Filesize
17.2MB

Download
memory/1600-237-0x00000000037E0000-0x0000000003BE3000-memory.dmp

Filesize
4.0MB

Download
memory/1600-236-0x00000000037E0000-0x0000000003BE3000-memory.dmp

Filesize
4.0MB

Download
memory/1600-230-0x00000000037E0000-0x0000000003BE3000-memory.dmp

Filesize
4.0MB

Download