9890ae69f0a31a5656dbebce11384a70820ac49cabe9b244dfb8a5ed22617ff5

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-04-2023 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AdobePDFReader (7).msi
Size

2.2MB
MD5

fadc9824c68402143239f764c99bb82d
SHA1

7eb72321c2c1e25b11c9d44229af22a179e27ce8
SHA256

9890ae69f0a31a5656dbebce11384a70820ac49cabe9b244dfb8a5ed22617ff5
SHA512

916b9b9836d5003193cf4f52c501a90ba16f18ca13a05325f9e11a6ee9d05b927013c09524757f33efd153c0e1d25648233e79f9a8eaa81fd69ed79282268ef6
SSDEEP

49152:NMU9FgsN+TXYr+LrUcdEL9MklhGUWhe8u/g1PQNPEUI:6gFPgYrordG9t0lepg1P2XI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2016	readerdc64.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI699D.tmp	msiexec.exe
File created	C:\Windows\Installer\6c671d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c671d.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6c671e.ipi	msiexec.exe
File created	C:\Windows\Installer\6c6720.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c671e.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	readerdc64.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	readerdc64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	readerdc64.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1308	msiexec.exe
1308	msiexec.exe
1764	powershell.exe
1764	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1976	msiexec.exe
Token: SeRestorePrivilege	1308	msiexec.exe
Token: SeTakeOwnershipPrivilege	1308	msiexec.exe
Token: SeSecurityPrivilege	1308	msiexec.exe
Token: SeCreateTokenPrivilege	1976	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1976	msiexec.exe
Token: SeLockMemoryPrivilege	1976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1976	msiexec.exe
Token: SeMachineAccountPrivilege	1976	msiexec.exe
Token: SeTcbPrivilege	1976	msiexec.exe
Token: SeSecurityPrivilege	1976	msiexec.exe
Token: SeTakeOwnershipPrivilege	1976	msiexec.exe
Token: SeLoadDriverPrivilege	1976	msiexec.exe
Token: SeSystemProfilePrivilege	1976	msiexec.exe
Token: SeSystemtimePrivilege	1976	msiexec.exe
Token: SeProfSingleProcessPrivilege	1976	msiexec.exe
Token: SeIncBasePriorityPrivilege	1976	msiexec.exe
Token: SeCreatePagefilePrivilege	1976	msiexec.exe
Token: SeCreatePermanentPrivilege	1976	msiexec.exe
Token: SeBackupPrivilege	1976	msiexec.exe
Token: SeRestorePrivilege	1976	msiexec.exe
Token: SeShutdownPrivilege	1976	msiexec.exe
Token: SeDebugPrivilege	1976	msiexec.exe
Token: SeAuditPrivilege	1976	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1976	msiexec.exe
Token: SeChangeNotifyPrivilege	1976	msiexec.exe
Token: SeRemoteShutdownPrivilege	1976	msiexec.exe
Token: SeUndockPrivilege	1976	msiexec.exe
Token: SeSyncAgentPrivilege	1976	msiexec.exe
Token: SeEnableDelegationPrivilege	1976	msiexec.exe
Token: SeManageVolumePrivilege	1976	msiexec.exe
Token: SeImpersonatePrivilege	1976	msiexec.exe
Token: SeCreateGlobalPrivilege	1976	msiexec.exe
Token: SeBackupPrivilege	792	vssvc.exe
Token: SeRestorePrivilege	792	vssvc.exe
Token: SeAuditPrivilege	792	vssvc.exe
Token: SeBackupPrivilege	1308	msiexec.exe
Token: SeRestorePrivilege	1308	msiexec.exe
Token: SeRestorePrivilege	1784	DrvInst.exe
Token: SeRestorePrivilege	1784	DrvInst.exe
Token: SeRestorePrivilege	1784	DrvInst.exe
Token: SeRestorePrivilege	1784	DrvInst.exe
Token: SeRestorePrivilege	1784	DrvInst.exe
Token: SeRestorePrivilege	1784	DrvInst.exe
Token: SeRestorePrivilege	1784	DrvInst.exe
Token: SeLoadDriverPrivilege	1784	DrvInst.exe
Token: SeLoadDriverPrivilege	1784	DrvInst.exe
Token: SeLoadDriverPrivilege	1784	DrvInst.exe
Token: SeRestorePrivilege	1308	msiexec.exe
Token: SeTakeOwnershipPrivilege	1308	msiexec.exe
Token: SeRestorePrivilege	1308	msiexec.exe
Token: SeTakeOwnershipPrivilege	1308	msiexec.exe
Token: SeRestorePrivilege	1308	msiexec.exe
Token: SeTakeOwnershipPrivilege	1308	msiexec.exe
Token: SeRestorePrivilege	1308	msiexec.exe
Token: SeTakeOwnershipPrivilege	1308	msiexec.exe
Token: SeRestorePrivilege	1308	msiexec.exe
Token: SeTakeOwnershipPrivilege	1308	msiexec.exe
Token: SeRestorePrivilege	1308	msiexec.exe
Token: SeTakeOwnershipPrivilege	1308	msiexec.exe
Token: SeRestorePrivilege	1308	msiexec.exe
Token: SeTakeOwnershipPrivilege	1308	msiexec.exe
Token: SeRestorePrivilege	1308	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1976	msiexec.exe
1976	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2016	readerdc64.exe
2016	readerdc64.exe
2016	readerdc64.exe
2016	readerdc64.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1764	1308	msiexec.exe	32
PID 1308 wrote to memory of 1764	1308	msiexec.exe	32
PID 1308 wrote to memory of 1764	1308	msiexec.exe	32
PID 1308 wrote to memory of 2016	1308	msiexec.exe	34
PID 1308 wrote to memory of 2016	1308	msiexec.exe	34
PID 1308 wrote to memory of 2016	1308	msiexec.exe	34
PID 1308 wrote to memory of 2016	1308	msiexec.exe	34
PID 1764 wrote to memory of 1012	1764	powershell.exe	35
PID 1764 wrote to memory of 1012	1764	powershell.exe	35
PID 1764 wrote to memory of 1012	1764	powershell.exe	35
PID 1012 wrote to memory of 680	1012	csc.exe	37
PID 1012 wrote to memory of 680	1012	csc.exe	37
PID 1012 wrote to memory of 680	1012	csc.exe	37

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\AdobePDFReader (7).msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1976

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ad.ps1"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6pnsbxhe.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES73DA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC73D9.tmp"
      4⤵
      PID:680
- C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe
  "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  PID:2016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004B0" "00000000000002F8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6c671f.rbs

Filesize
7KB

MD5
a03207f80453bc76b8bad8dc697ccdba

SHA1
24bb0d4faa81f6375ab1636b9d6ed96fd30b81fc

SHA256
2ac2d72386df3dd678b8f2c9806ce8d3ffc1ff072baf410df4b2864ec0332fa8

SHA512
b7e8c40ad60b79ec01c52fe35c760e7bb5b9634dc3d8088f82ebf669daf5210d2247a2a3a53cedfac79984ae8a0ee4f1ca1947eace630ac77e93b386c3953825

Download Submit
C:\Users\Admin\AppData\Local\Temp\6pnsbxhe.dll

Filesize
3KB

MD5
a23a39f82a4bf37ec123c403c35dbaec

SHA1
547b6e7c5e7fd16d1f746c8cb1fc3607877cb082

SHA256
b594e6f79a683f6dde4daede82cc795dd81a86a258dc8d52d54b775904848086

SHA512
a169112aeca7ed755174fa3a933c467537ec16c8e477bf130795407c7601b1857ad2fafd9145b68eca3010d4f996e8dcd48e4a0447d40e0d5854046088fd4f07

Download Submit
C:\Users\Admin\AppData\Local\Temp\6pnsbxhe.pdb

Filesize
7KB

MD5
efd7bc4c0c41388055976adb321610e6

SHA1
e0acb4808ebb25d4794461106a7385d1bce57b4b

SHA256
691e8002f927e457defcc08850586caa4385644c67666daef7d152a9472a0d8b

SHA512
9628265a29309d215d3291b356567f6504aac632d3df57a67258709c57f022753c9fdbef0a5c904b2378c189c99d5f4843dfa73954ebfa8431e08fa7c04d87f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ad.ps1

Filesize
2.2MB

MD5
4e0e85a590f4972732f1f0de81aa5507

SHA1
8e1bcab1ac25c59c1203d808f04b53b1db5fd7eb

SHA256
bde15453821fff0d2ed08a8c10885c9ab4ec1ccc6b4b23a41e9e324e4e80a195

SHA512
2b874cf59cdc7298b7fcf6712db3ec4013fcd87b7c7bb44400a789821b35bc57e3ff4e98ccfe93bc4cb420d25b2d3e6967eab2e98abf43bb16543f454cef8953

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe

Filesize
1.2MB

MD5
eb17c8572700a9b7bbfb6c1142ad443e

SHA1
74022bd63cf919ac44af0dcbe0e4c14756c34b2e

SHA256
302b598ae57ca91ba4b4b59e926f2e07a073ab9afcb98eccde02f5e84cdfef52

SHA512
e7660219d815bc40741fd6737c092c8f442ebbec4f18981fbf261a269c4e2e162dc0349f76eb7b03a78529021fdab9b84322de7683685ab5d512ac7b4a5a63b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe

Filesize
1.2MB

MD5
eb17c8572700a9b7bbfb6c1142ad443e

SHA1
74022bd63cf919ac44af0dcbe0e4c14756c34b2e

SHA256
302b598ae57ca91ba4b4b59e926f2e07a073ab9afcb98eccde02f5e84cdfef52

SHA512
e7660219d815bc40741fd6737c092c8f442ebbec4f18981fbf261a269c4e2e162dc0349f76eb7b03a78529021fdab9b84322de7683685ab5d512ac7b4a5a63b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES73DA.tmp

Filesize
1KB

MD5
29359261d52f1892cdfd95781564424e

SHA1
a67c7d16f2d44fe89cf0ecdc8ee1eaab958d800e

SHA256
647af60e97ef98d362fa497bdbb4843ca02b4c56fefa6a33f70cba4663bfe245

SHA512
44fc13f81dacdd2a1bb560eb66a9dc67cb81447e328e7fa8b7767c53701e9092ac3d0efabe5c382285eb052dffff30d322ef11b90d5f7ffcc9b41e70dad660a0

Download Submit
C:\Windows\Installer\6c671d.msi

Filesize
2.2MB

MD5
fadc9824c68402143239f764c99bb82d

SHA1
7eb72321c2c1e25b11c9d44229af22a179e27ce8

SHA256
9890ae69f0a31a5656dbebce11384a70820ac49cabe9b244dfb8a5ed22617ff5

SHA512
916b9b9836d5003193cf4f52c501a90ba16f18ca13a05325f9e11a6ee9d05b927013c09524757f33efd153c0e1d25648233e79f9a8eaa81fd69ed79282268ef6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\6pnsbxhe.0.cs

Filesize
203B

MD5
b611be9282deb44eed731f72bcbb2b82

SHA1
cc1d606d853bbabd5fef87255356a0d54381c289

SHA256
ee09fdd61a05266e4e09f418fc6a452f1205d9f29afba6b8a1579333dc3ff3b6

SHA512
63b5ad7b65fd4866fb8841e4eee567e4f1e7888bb9fda8dd5c8dca3461d084d3f80ce920ae321609e4ff32ba13a55b7320282ce7201bb74a793d4700240360a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\6pnsbxhe.cmdline

Filesize
309B

MD5
d54a989e74bc5b594db7530b5d68be8b

SHA1
a74b536587536282fdbf3f7e95617a1da7640172

SHA256
c14d6f010152b94afe0008d72615761d84f64265297d60edc3a31a20d60e17fc

SHA512
72acc192d7ef1471afaeabda30440d1a80d684ed64f296ce1c53dfa5bd667c7e732e5a9e006611085d6ce2e6c462d9876868c9db627f526adeedd59229ca95f4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC73D9.tmp

Filesize
652B

MD5
3e39d8bdc5d35b1dd07f3ce49370762c

SHA1
4af52b78569235ae0e4f4d9e49baee322232a963

SHA256
cde11cb157f4f278f6acf3e2b9411f663c7e0e4b67dc63bbf551d4345b316765

SHA512
fda60479033992cae91eb157eb765bc2274da6adc0130208f689bd69145901cd2a76b4bcbe0b3421bd9edff9c5c4f01b58f453a4ebedafa40547d12524a7b2c0

Download Submit
memory/1764-87-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/1764-84-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/1764-83-0x000000001B220000-0x000000001B502000-memory.dmp

Filesize
2.9MB

Download
memory/1764-106-0x0000000002680000-0x0000000002688000-memory.dmp

Filesize
32KB

Download
memory/1764-110-0x000000000291B000-0x0000000002952000-memory.dmp

Filesize
220KB

Download
memory/1764-111-0x0000000002914000-0x0000000002917000-memory.dmp

Filesize
12KB

Download
memory/2016-86-0x0000000000100000-0x0000000000103000-memory.dmp

Filesize
12KB

Download
memory/2016-85-0x00000000010C0000-0x00000000014F9000-memory.dmp

Filesize
4.2MB

Download