628a967ce663b14de8de074d62c91fa72fb45a37e707fb5c886233d7196539e6

Analysis

max time kernel
5s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2023, 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

easy_Malicious_2eeb35dda97d41ac16e55646011e04be4a0028e674f2201c77b3a22f9a273aaf.dll
Size

63KB
MD5

057c9b463f2ee95e9ee9b41a8fcd79d0
SHA1

1f395c53a8751acc9a4198e288e80364d91077de
SHA256

628a967ce663b14de8de074d62c91fa72fb45a37e707fb5c886233d7196539e6
SHA512

6e296d9c3dffb838e2ff471bc3fe50e779a19b844c547aa6da7a4c0b8b0d7eb8306a8297837663cb589289404752b713ac208cffafd163a4471418efa427d090
SSDEEP

1536:rm0q7WuHEqURxlayH2myxsiRGF69MG8Gmm:r/eHEjuyH2TlG7Gnmm

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	hrl6801.tmp
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	hrl6801.tmp
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	hrl6801.tmp
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\hrl6801.tmp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hrl6801.tmp:*:enabled:@shell32.dll,-1"	hrl6801.tmp

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	hrl6801.tmp

Executes dropped EXE 2 IoCs

pid	Process
768	hrl6801.tmp
4252	fkjvgk.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	hrl6801.tmp
File opened (read-only)	\??\N:	hrl6801.tmp
File opened (read-only)	\??\R:	hrl6801.tmp
File opened (read-only)	\??\V:	hrl6801.tmp
File opened (read-only)	\??\X:	hrl6801.tmp
File opened (read-only)	\??\I:	hrl6801.tmp
File opened (read-only)	\??\S:	hrl6801.tmp
File opened (read-only)	\??\Z:	hrl6801.tmp
File opened (read-only)	\??\O:	hrl6801.tmp
File opened (read-only)	\??\Q:	hrl6801.tmp
File opened (read-only)	\??\T:	hrl6801.tmp
File opened (read-only)	\??\U:	hrl6801.tmp
File opened (read-only)	\??\E:	hrl6801.tmp
File opened (read-only)	\??\G:	hrl6801.tmp
File opened (read-only)	\??\H:	hrl6801.tmp
File opened (read-only)	\??\M:	hrl6801.tmp
File opened (read-only)	\??\W:	hrl6801.tmp
File opened (read-only)	\??\J:	hrl6801.tmp
File opened (read-only)	\??\K:	hrl6801.tmp
File opened (read-only)	\??\L:	hrl6801.tmp
File opened (read-only)	\??\P:	hrl6801.tmp

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fkjvgk.exe	hrl6801.tmp
File opened for modification	C:\Windows\SysWOW64\fkjvgk.exe	hrl6801.tmp

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2696	4252	WerFault.exe	82
4764	768	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
768	hrl6801.tmp
768	hrl6801.tmp
4252	fkjvgk.exe
4252	fkjvgk.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp
768	hrl6801.tmp

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	768	hrl6801.tmp
Token: SeDebugPrivilege	4252	fkjvgk.exe
Token: SeIncBasePriorityPrivilege	768	hrl6801.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 2356	3160	rundll32.exe	80
PID 3160 wrote to memory of 2356	3160	rundll32.exe	80
PID 3160 wrote to memory of 2356	3160	rundll32.exe	80
PID 2356 wrote to memory of 768	2356	rundll32.exe	81
PID 2356 wrote to memory of 768	2356	rundll32.exe	81
PID 2356 wrote to memory of 768	2356	rundll32.exe	81
PID 768 wrote to memory of 616	768	hrl6801.tmp	7
PID 768 wrote to memory of 616	768	hrl6801.tmp	7
PID 768 wrote to memory of 616	768	hrl6801.tmp	7
PID 768 wrote to memory of 616	768	hrl6801.tmp	7
PID 768 wrote to memory of 616	768	hrl6801.tmp	7
PID 768 wrote to memory of 616	768	hrl6801.tmp	7
PID 768 wrote to memory of 700	768	hrl6801.tmp	6
PID 768 wrote to memory of 700	768	hrl6801.tmp	6
PID 768 wrote to memory of 700	768	hrl6801.tmp	6
PID 768 wrote to memory of 700	768	hrl6801.tmp	6
PID 768 wrote to memory of 700	768	hrl6801.tmp	6
PID 768 wrote to memory of 700	768	hrl6801.tmp	6
PID 768 wrote to memory of 796	768	hrl6801.tmp	8
PID 768 wrote to memory of 796	768	hrl6801.tmp	8
PID 768 wrote to memory of 796	768	hrl6801.tmp	8
PID 768 wrote to memory of 796	768	hrl6801.tmp	8
PID 768 wrote to memory of 796	768	hrl6801.tmp	8
PID 768 wrote to memory of 796	768	hrl6801.tmp	8
PID 768 wrote to memory of 808	768	hrl6801.tmp	78
PID 768 wrote to memory of 808	768	hrl6801.tmp	78
PID 768 wrote to memory of 808	768	hrl6801.tmp	78
PID 768 wrote to memory of 808	768	hrl6801.tmp	78
PID 768 wrote to memory of 808	768	hrl6801.tmp	78
PID 768 wrote to memory of 808	768	hrl6801.tmp	78
PID 768 wrote to memory of 816	768	hrl6801.tmp	77
PID 768 wrote to memory of 816	768	hrl6801.tmp	77
PID 768 wrote to memory of 816	768	hrl6801.tmp	77
PID 768 wrote to memory of 816	768	hrl6801.tmp	77
PID 768 wrote to memory of 816	768	hrl6801.tmp	77
PID 768 wrote to memory of 816	768	hrl6801.tmp	77
PID 768 wrote to memory of 920	768	hrl6801.tmp	76
PID 768 wrote to memory of 920	768	hrl6801.tmp	76
PID 768 wrote to memory of 920	768	hrl6801.tmp	76
PID 768 wrote to memory of 920	768	hrl6801.tmp	76
PID 768 wrote to memory of 920	768	hrl6801.tmp	76
PID 768 wrote to memory of 920	768	hrl6801.tmp	76
PID 768 wrote to memory of 968	768	hrl6801.tmp	75
PID 768 wrote to memory of 968	768	hrl6801.tmp	75
PID 768 wrote to memory of 968	768	hrl6801.tmp	75
PID 768 wrote to memory of 968	768	hrl6801.tmp	75
PID 768 wrote to memory of 968	768	hrl6801.tmp	75
PID 768 wrote to memory of 968	768	hrl6801.tmp	75
PID 768 wrote to memory of 392	768	hrl6801.tmp	9
PID 768 wrote to memory of 392	768	hrl6801.tmp	9
PID 768 wrote to memory of 392	768	hrl6801.tmp	9
PID 768 wrote to memory of 392	768	hrl6801.tmp	9
PID 768 wrote to memory of 392	768	hrl6801.tmp	9
PID 768 wrote to memory of 392	768	hrl6801.tmp	9
PID 768 wrote to memory of 540	768	hrl6801.tmp	74
PID 768 wrote to memory of 540	768	hrl6801.tmp	74
PID 768 wrote to memory of 540	768	hrl6801.tmp	74
PID 768 wrote to memory of 540	768	hrl6801.tmp	74
PID 768 wrote to memory of 540	768	hrl6801.tmp	74
PID 768 wrote to memory of 540	768	hrl6801.tmp	74
PID 768 wrote to memory of 912	768	hrl6801.tmp	10
PID 768 wrote to memory of 912	768	hrl6801.tmp	10
PID 768 wrote to memory of 912	768	hrl6801.tmp	10
PID 768 wrote to memory of 912	768	hrl6801.tmp	10

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:700

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:392
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3600
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3896
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3464
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2256
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4676
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:4656
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:508
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3816
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3700
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2056

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1392
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2344

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2596

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2656

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2896
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\easy_Malicious_2eeb35dda97d41ac16e55646011e04be4a0028e674f2201c77b3a22f9a273aaf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\easy_Malicious_2eeb35dda97d41ac16e55646011e04be4a0028e674f2201c77b3a22f9a273aaf.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\hrl6801.tmp
      C:\Users\Admin\AppData\Local\Temp\hrl6801.tmp
      4⤵
      Modifies firewall policy service
      Drops file in Drivers directory
      Executes dropped EXE
      Enumerates connected drives
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:768
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 1396
        5⤵
        Program crash
        
        PID:4764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4696

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:920

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:808

C:\Windows\SysWOW64\fkjvgk.exe
C:\Windows\SysWOW64\fkjvgk.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 440
  2⤵
  - Program crash
  PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4252 -ip 4252
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 768 -ip 768
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hrl6801.tmp

Filesize
55KB

MD5
1090051d63699f8edc52169e07714f77

SHA1
735e59a8e0671191761326ef725b9b4684e7c59d

SHA256
b290e6a66a4b471c8ffae0ecabfad49ee11f6603fa79de9f11f5c22f6f88d351

SHA512
9d6843dc8ed6416b74357dfcc6a1b0f41ff5f0beb45526ef84fa385905b2047c82a64aa6b46c5fb947183445d347b22cda820f02e929edd3b4252c18884db359

Download Submit
C:\Users\Admin\AppData\Local\Temp\hrl6801.tmp

Filesize
55KB

MD5
1090051d63699f8edc52169e07714f77

SHA1
735e59a8e0671191761326ef725b9b4684e7c59d

SHA256
b290e6a66a4b471c8ffae0ecabfad49ee11f6603fa79de9f11f5c22f6f88d351

SHA512
9d6843dc8ed6416b74357dfcc6a1b0f41ff5f0beb45526ef84fa385905b2047c82a64aa6b46c5fb947183445d347b22cda820f02e929edd3b4252c18884db359

Download Submit
C:\Windows\SysWOW64\fkjvgk.exe

Filesize
55KB

MD5
1090051d63699f8edc52169e07714f77

SHA1
735e59a8e0671191761326ef725b9b4684e7c59d

SHA256
b290e6a66a4b471c8ffae0ecabfad49ee11f6603fa79de9f11f5c22f6f88d351

SHA512
9d6843dc8ed6416b74357dfcc6a1b0f41ff5f0beb45526ef84fa385905b2047c82a64aa6b46c5fb947183445d347b22cda820f02e929edd3b4252c18884db359

Download Submit
C:\Windows\SysWOW64\fkjvgk.exe

Filesize
55KB

MD5
1090051d63699f8edc52169e07714f77

SHA1
735e59a8e0671191761326ef725b9b4684e7c59d

SHA256
b290e6a66a4b471c8ffae0ecabfad49ee11f6603fa79de9f11f5c22f6f88d351

SHA512
9d6843dc8ed6416b74357dfcc6a1b0f41ff5f0beb45526ef84fa385905b2047c82a64aa6b46c5fb947183445d347b22cda820f02e929edd3b4252c18884db359

Download Submit
memory/768-137-0x000000007FE40000-0x000000007FE4A000-memory.dmp

Filesize
40KB

Download
memory/768-139-0x000000007FE40000-0x000000007FE4A000-memory.dmp

Filesize
40KB

Download
memory/768-143-0x000000007FE30000-0x000000007FE3A000-memory.dmp

Filesize
40KB

Download
memory/768-145-0x000000007FE30000-0x000000007FE3A000-memory.dmp

Filesize
40KB

Download
memory/768-146-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/768-148-0x000000007FE30000-0x000000007FE3A000-memory.dmp

Filesize
40KB

Download
memory/4252-147-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download