af10d21b78b037e5da09c0ad45a8adfc99cc48dfe6b4918c0bd50f8d1ae1da4d

Analysis

max time kernel
88s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2023, 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af10d21b78b037e5da09c0ad45a8adfc99cc48dfe6b4918c0bd50f8d1ae1da4d.exe
Size

2.2MB
MD5

c63c31c00fd154c51586b4530dd3288d
SHA1

8002b2068741c516bdacc95691b6054da55ade04
SHA256

af10d21b78b037e5da09c0ad45a8adfc99cc48dfe6b4918c0bd50f8d1ae1da4d
SHA512

79ef2dac0746d2775a7c9f42cadb1e92cffcf07b38835100430996053f8dcfa8dc691c44a9aee37505ca30fce53a7e41bd2acd0b66b4f84ef1a3aa847d4e5c0a
SSDEEP

24576:l1nGcQqkAzoeFrM0lKRTb6Ux8FRiWs5SVP6YqX3QsnjDX6zmkSpTi6i:HGDqroI7iX4R05SVI/D37P

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ProgramStarter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	af10d21b78b037e5da09c0ad45a8adfc99cc48dfe6b4918c0bd50f8d1ae1da4d.exe

Executes dropped EXE 1 IoCs

pid	Process
220	ProgramStarter.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
43	api.ipify.org
44	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3472	schtasks.exe
1456	schtasks.exe
656	schtasks.exe
884	schtasks.exe
2100	schtasks.exe
4400	schtasks.exe
640	schtasks.exe
4656	schtasks.exe
3832	schtasks.exe
1808	schtasks.exe
2580	schtasks.exe
624	schtasks.exe
1888	schtasks.exe
2672	schtasks.exe
1420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
220	ProgramStarter.exe
964	powershell.exe
964	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	220	ProgramStarter.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeShutdownPrivilege	3200	powercfg.exe
Token: SeCreatePagefilePrivilege	3200	powercfg.exe
Token: SeShutdownPrivilege	2168	powercfg.exe
Token: SeCreatePagefilePrivilege	2168	powercfg.exe
Token: SeShutdownPrivilege	3836	powercfg.exe
Token: SeCreatePagefilePrivilege	3836	powercfg.exe
Token: SeShutdownPrivilege	2224	powercfg.exe
Token: SeCreatePagefilePrivilege	2224	powercfg.exe
Token: SeShutdownPrivilege	2292	powercfg.exe
Token: SeCreatePagefilePrivilege	2292	powercfg.exe
Token: SeShutdownPrivilege	2292	powercfg.exe
Token: SeCreatePagefilePrivilege	2292	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 220	644	af10d21b78b037e5da09c0ad45a8adfc99cc48dfe6b4918c0bd50f8d1ae1da4d.exe	87
PID 644 wrote to memory of 220	644	af10d21b78b037e5da09c0ad45a8adfc99cc48dfe6b4918c0bd50f8d1ae1da4d.exe	87
PID 644 wrote to memory of 220	644	af10d21b78b037e5da09c0ad45a8adfc99cc48dfe6b4918c0bd50f8d1ae1da4d.exe	87
PID 220 wrote to memory of 5108	220	ProgramStarter.exe	91
PID 220 wrote to memory of 5108	220	ProgramStarter.exe	91
PID 220 wrote to memory of 5108	220	ProgramStarter.exe	91
PID 5108 wrote to memory of 964	5108	cmd.exe	93
PID 5108 wrote to memory of 964	5108	cmd.exe	93
PID 5108 wrote to memory of 964	5108	cmd.exe	93
PID 220 wrote to memory of 2368	220	ProgramStarter.exe	95
PID 220 wrote to memory of 2368	220	ProgramStarter.exe	95
PID 220 wrote to memory of 2368	220	ProgramStarter.exe	95
PID 220 wrote to memory of 2588	220	ProgramStarter.exe	97
PID 220 wrote to memory of 2588	220	ProgramStarter.exe	97
PID 220 wrote to memory of 2588	220	ProgramStarter.exe	97
PID 220 wrote to memory of 60	220	ProgramStarter.exe	123
PID 220 wrote to memory of 60	220	ProgramStarter.exe	123
PID 220 wrote to memory of 60	220	ProgramStarter.exe	123
PID 220 wrote to memory of 4984	220	ProgramStarter.exe	122
PID 220 wrote to memory of 4984	220	ProgramStarter.exe	122
PID 220 wrote to memory of 4984	220	ProgramStarter.exe	122
PID 220 wrote to memory of 1696	220	ProgramStarter.exe	121
PID 220 wrote to memory of 1696	220	ProgramStarter.exe	121
PID 220 wrote to memory of 1696	220	ProgramStarter.exe	121
PID 220 wrote to memory of 4788	220	ProgramStarter.exe	98
PID 220 wrote to memory of 4788	220	ProgramStarter.exe	98
PID 220 wrote to memory of 4788	220	ProgramStarter.exe	98
PID 220 wrote to memory of 2044	220	ProgramStarter.exe	119
PID 220 wrote to memory of 2044	220	ProgramStarter.exe	119
PID 220 wrote to memory of 2044	220	ProgramStarter.exe	119
PID 220 wrote to memory of 3608	220	ProgramStarter.exe	116
PID 220 wrote to memory of 3608	220	ProgramStarter.exe	116
PID 220 wrote to memory of 3608	220	ProgramStarter.exe	116
PID 220 wrote to memory of 2964	220	ProgramStarter.exe	99
PID 220 wrote to memory of 2964	220	ProgramStarter.exe	99
PID 220 wrote to memory of 2964	220	ProgramStarter.exe	99
PID 220 wrote to memory of 2524	220	ProgramStarter.exe	115
PID 220 wrote to memory of 2524	220	ProgramStarter.exe	115
PID 220 wrote to memory of 2524	220	ProgramStarter.exe	115
PID 220 wrote to memory of 3724	220	ProgramStarter.exe	100
PID 220 wrote to memory of 3724	220	ProgramStarter.exe	100
PID 220 wrote to memory of 3724	220	ProgramStarter.exe	100
PID 220 wrote to memory of 3648	220	ProgramStarter.exe	113
PID 220 wrote to memory of 3648	220	ProgramStarter.exe	113
PID 220 wrote to memory of 3648	220	ProgramStarter.exe	113
PID 220 wrote to memory of 3548	220	ProgramStarter.exe	101
PID 220 wrote to memory of 3548	220	ProgramStarter.exe	101
PID 220 wrote to memory of 3548	220	ProgramStarter.exe	101
PID 220 wrote to memory of 3148	220	ProgramStarter.exe	110
PID 220 wrote to memory of 3148	220	ProgramStarter.exe	110
PID 220 wrote to memory of 3148	220	ProgramStarter.exe	110
PID 220 wrote to memory of 3780	220	ProgramStarter.exe	107
PID 220 wrote to memory of 3780	220	ProgramStarter.exe	107
PID 220 wrote to memory of 3780	220	ProgramStarter.exe	107
PID 2368 wrote to memory of 3472	2368	cmd.exe	125
PID 2368 wrote to memory of 3472	2368	cmd.exe	125
PID 2368 wrote to memory of 3472	2368	cmd.exe	125
PID 4984 wrote to memory of 624	4984	cmd.exe	126
PID 4984 wrote to memory of 624	4984	cmd.exe	126
PID 4984 wrote to memory of 624	4984	cmd.exe	126
PID 1696 wrote to memory of 4400	1696	cmd.exe	127
PID 1696 wrote to memory of 4400	1696	cmd.exe	127
PID 1696 wrote to memory of 4400	1696	cmd.exe	127
PID 2588 wrote to memory of 1456	2588	cmd.exe	132

C:\Users\Admin\AppData\Local\Temp\af10d21b78b037e5da09c0ad45a8adfc99cc48dfe6b4918c0bd50f8d1ae1da4d.exe
"C:\Users\Admin\AppData\Local\Temp\af10d21b78b037e5da09c0ad45a8adfc99cc48dfe6b4918c0bd50f8d1ae1da4d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\ProgramStarter.exe
  "C:\Users\Admin\AppData\Local\Temp\ProgramStarter.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C powershell -EncodedCommand "PAAjAHYAbgBrAEcAdgBTAEIAdwBYAEEAVwBqAHoAawBsAE8ARwBFAEEAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBYAEIAcQBZAGEASQBOAGIATQBvACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBCAHgAYgByAG0AdABEAFkATABqAGgAIwA+ACAAQAAoACAAPAAjAHMASgB6AE0AVABlAEQAdABVAEsAYQAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAVwBVAHUAZgBSAGUAVAB1AFgAdQBpAFQAIwA+ACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQApACAAPAAjAHkAcwBwAHAAcQBrAEkASgBCAE4AbABXAHcAeABTAFEASgBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAbwBhAGMAcwB5AHgAVQBIAGoAbAB0AFkAcwAjAD4A"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "PAAjAHYAbgBrAEcAdgBTAEIAdwBYAEEAVwBqAHoAawBsAE8ARwBFAEEAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBYAEIAcQBZAGEASQBOAGIATQBvACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBCAHgAYgByAG0AdABEAFkATABqAGgAIwA+ACAAQAAoACAAPAAjAHMASgB6AE0AVABlAEQAdABVAEsAYQAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAVwBVAHUAZgBSAGUAVAB1AFgAdQBpAFQAIwA+ACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQApACAAPAAjAHkAcwBwAHAAcQBrAEkASgBCAE4AbABXAHcAeABTAFEASgBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAbwBhAGMAcwB5AHgAVQBIAGoAbAB0AFkAcwAjAD4A"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:964
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    PID:4788
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:640
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk438" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    PID:2964
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk438" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:656
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk664" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    PID:3724
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk664" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:884
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk798" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    PID:3548
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk798" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
    3⤵
    PID:3780
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:3832
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off & SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    PID:3148
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3200
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2168
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3836
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2224
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /hibernate off
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2292
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk483" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    PID:3648
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk483" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk892" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    PID:2524
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk892" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1888
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    PID:3608
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2100
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    PID:2044
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:624
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
    3⤵
    PID:60
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ProgramStarter.exe

Filesize
452KB

MD5
8968a853030759bffee4c0a22d764661

SHA1
85997edc5bba7584be08a73b46b9b3ebdc17da10

SHA256
15ffc62b61eff8abc943bac74849cbc16d6314b03e7851714797b76447a46d76

SHA512
8da3529932bf62b80670138cdc13396fd872d75d19d8981a378cd8dcd571d260017d5d3caf73f9c118bae4f66facc5a686d4aca19162f652c4f44bac1ec95749

Download Submit
C:\Users\Admin\AppData\Local\Temp\ProgramStarter.exe

Filesize
452KB

MD5
8968a853030759bffee4c0a22d764661

SHA1
85997edc5bba7584be08a73b46b9b3ebdc17da10

SHA256
15ffc62b61eff8abc943bac74849cbc16d6314b03e7851714797b76447a46d76

SHA512
8da3529932bf62b80670138cdc13396fd872d75d19d8981a378cd8dcd571d260017d5d3caf73f9c118bae4f66facc5a686d4aca19162f652c4f44bac1ec95749

Download Submit
C:\Users\Admin\AppData\Local\Temp\ProgramStarter.exe

Filesize
452KB

MD5
8968a853030759bffee4c0a22d764661

SHA1
85997edc5bba7584be08a73b46b9b3ebdc17da10

SHA256
15ffc62b61eff8abc943bac74849cbc16d6314b03e7851714797b76447a46d76

SHA512
8da3529932bf62b80670138cdc13396fd872d75d19d8981a378cd8dcd571d260017d5d3caf73f9c118bae4f66facc5a686d4aca19162f652c4f44bac1ec95749

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p0yz2oh1.avf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/220-150-0x0000000007650000-0x0000000007660000-memory.dmp

Filesize
64KB

Download
memory/220-193-0x0000000007650000-0x0000000007660000-memory.dmp

Filesize
64KB

Download
memory/220-151-0x0000000009360000-0x00000000093C6000-memory.dmp

Filesize
408KB

Download
memory/220-148-0x00000000006A0000-0x0000000000718000-memory.dmp

Filesize
480KB

Download
memory/644-149-0x0000000008290000-0x000000000829A000-memory.dmp

Filesize
40KB

Download
memory/644-135-0x0000000007340000-0x00000000073D2000-memory.dmp

Filesize
584KB

Download
memory/644-137-0x00000000075D0000-0x00000000075E0000-memory.dmp

Filesize
64KB

Download
memory/644-134-0x0000000007810000-0x0000000007DB4000-memory.dmp

Filesize
5.6MB

Download
memory/644-133-0x0000000000260000-0x00000000004A2000-memory.dmp

Filesize
2.3MB

Download
memory/964-174-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/964-187-0x0000000006A30000-0x0000000006A4E000-memory.dmp

Filesize
120KB

Download
memory/964-157-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/964-155-0x00000000054C0000-0x00000000054E2000-memory.dmp

Filesize
136KB

Download
memory/964-158-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Filesize
408KB

Download
memory/964-168-0x0000000006470000-0x000000000648E000-memory.dmp

Filesize
120KB

Download
memory/964-154-0x00000000055A0000-0x0000000005BC8000-memory.dmp

Filesize
6.2MB

Download
memory/964-175-0x0000000006A50000-0x0000000006A82000-memory.dmp

Filesize
200KB

Download
memory/964-177-0x000000006FF80000-0x000000006FFCC000-memory.dmp

Filesize
304KB

Download
memory/964-156-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/964-188-0x0000000007DD0000-0x000000000844A000-memory.dmp

Filesize
6.5MB

Download
memory/964-189-0x0000000007790000-0x00000000077AA000-memory.dmp

Filesize
104KB

Download
memory/964-190-0x000000007F1C0000-0x000000007F1D0000-memory.dmp

Filesize
64KB

Download
memory/964-191-0x0000000007800000-0x000000000780A000-memory.dmp

Filesize
40KB

Download
memory/964-192-0x0000000007A20000-0x0000000007AB6000-memory.dmp

Filesize
600KB

Download
memory/964-153-0x0000000002B60000-0x0000000002B96000-memory.dmp

Filesize
216KB

Download
memory/964-194-0x00000000079D0000-0x00000000079DE000-memory.dmp

Filesize
56KB

Download
memory/964-195-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

Filesize
104KB

Download
memory/964-196-0x0000000007A10000-0x0000000007A18000-memory.dmp

Filesize
32KB

Download