76bc8473b9a8bd6e870329e37b8105e3fd72f73ce444a6c1dfd79ff30f2e73b1

Analysis

max time kernel
142s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
Size

6.5MB
MD5

c152bb2f73ba33e8dabd2e0209da9280
SHA1

5af1e25e2bc9751343a78e5af65e53fa7fcb5936
SHA256

76bc8473b9a8bd6e870329e37b8105e3fd72f73ce444a6c1dfd79ff30f2e73b1
SHA512

a02d44d24e48a240ac98d626a4b96b69da3de13f5008de8c64fe7ffbf4c2b3c8e2f0630cd367345bdff324161987ac8c99c5474069f64b0ff0eab6a016156d75
SSDEEP

49152:D+NEfT0HSh8wTwzWn1lioYTDGAfp8a+nTdsb0N00VwmNG2TXEBGhTod6sTJN0Qbi:nnpavoSIqjnTMfHSm

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2772	wmpscfgs.exe
1728	wmpscfgs.exe
2276	wmpscfgs.exe
1252	wmpscfgs.exe

Loads dropped DLL 6 IoCs

pid	Process
2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
2772	wmpscfgs.exe
2772	wmpscfgs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\users\\admin\\appdata\\local\\temp\\\\wmpscfgs.exe"	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\users\\admin\\appdata\\local\\temp\\\\wmpscfgs.exe"	wmpscfgs.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\adobe\acrotray.exe	wmpscfgs.exe
File created	C:\Program Files (x86)\259535868.dat	wmpscfgs.exe
File created	\??\c:\program files (x86)\adobe\acrotray .exe	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
File created	\??\c:\program files (x86)\adobe\acrotray.exe	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
File created	C:\Program Files (x86)\259457477.dat	wmpscfgs.exe
File created	\??\c:\program files (x86)\microsoft office\office14\bcssync.exe	wmpscfgs.exe
File created	\??\c:\program files (x86)\microsoft office\office14\bcssync.exe	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
File created	C:\Program Files (x86)\259457493.dat	wmpscfgs.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrotray .exe	wmpscfgs.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	wmpscfgs.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C7E6800-6BB6-11EE-AEF1-D2B3C10F014B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79FCF181-6BB6-11EE-AEF1-D2B3C10F014B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c1ac35c3ffd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000bf568a97c8e581268172631984e04874ca47a2893c46fe508fbc8a2df4c50c93000000000e8000000002000020000000d1c7bcda0947bdb88b1d3b378d3092a3dc5b481e805b93ce750bc63eb1db73f020000000106c60e7263be84977693c18ed3460772a5ca9338eac720b22d9ea46711c59ba4000000031122e5f85cb599544b37a74a7ec6b5c1d441722dfdcbf96f2fd83d6bf121842fa6ba08d85efae9e7eeac9160b4a43ca4bab6018c45aaf4b007780519a6d3d84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000bfac85e070ceab07772f5782c64e07ba0f4499c14f57760102a25a247aed83e9000000000e800000000200002000000032aa4925016fec726a9e6313eac3bdeee9abf724a96e75c1b6cf4a23d277705990000000f3b4932c28a7337c15dbe7eb9e61926e00a2421fa3531d92f53355eb453c8af2c9c2474fe638c95f413a3a2b289e5f8ac2a1376084d02a295d83c42ef5fda021b595ff2339346ac65d31e60b1212269d17a1dddc2f441492ed2edede943b3307df96f4bf1ed4bec589dbe80ea9500bd61dc15789a0b1ab45ed9697ceb50c4690c36a1673df099023b826fac3f7fdec65400000006ad417a9062fa1bfa90b98f0229c650d484a3fcd25d32d4171d0c5d151bc34e98017930e1ebed69f27843ee162b33c592188dcd5e7d6660a0aa4d6b0b32ac3d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
2772	wmpscfgs.exe
2772	wmpscfgs.exe
1728	wmpscfgs.exe
1728	wmpscfgs.exe
2276	wmpscfgs.exe
1252	wmpscfgs.exe
1252	wmpscfgs.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
Token: SeDebugPrivilege	2772	wmpscfgs.exe
Token: SeDebugPrivilege	1728	wmpscfgs.exe
Token: SeDebugPrivilege	2276	wmpscfgs.exe
Token: SeDebugPrivilege	1252	wmpscfgs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2524	iexplore.exe
996	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2524	iexplore.exe
2524	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
996	iexplore.exe
996	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2772	2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe	28
PID 2012 wrote to memory of 2772	2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe	28
PID 2012 wrote to memory of 2772	2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe	28
PID 2012 wrote to memory of 2772	2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe	28
PID 2012 wrote to memory of 1728	2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe	29
PID 2012 wrote to memory of 1728	2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe	29
PID 2012 wrote to memory of 1728	2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe	29
PID 2012 wrote to memory of 1728	2012	c152bb2f73ba33e8dabd2e0209da9280_exe32.exe	29
PID 2524 wrote to memory of 2796	2524	iexplore.exe	34
PID 2524 wrote to memory of 2796	2524	iexplore.exe	34
PID 2524 wrote to memory of 2796	2524	iexplore.exe	34
PID 2524 wrote to memory of 2796	2524	iexplore.exe	34
PID 2772 wrote to memory of 2276	2772	wmpscfgs.exe	36
PID 2772 wrote to memory of 2276	2772	wmpscfgs.exe	36
PID 2772 wrote to memory of 2276	2772	wmpscfgs.exe	36
PID 2772 wrote to memory of 2276	2772	wmpscfgs.exe	36
PID 2772 wrote to memory of 1252	2772	wmpscfgs.exe	37
PID 2772 wrote to memory of 1252	2772	wmpscfgs.exe	37
PID 2772 wrote to memory of 1252	2772	wmpscfgs.exe	37
PID 2772 wrote to memory of 1252	2772	wmpscfgs.exe	37
PID 996 wrote to memory of 2376	996	iexplore.exe	39
PID 996 wrote to memory of 2376	996	iexplore.exe	39
PID 996 wrote to memory of 2376	996	iexplore.exe	39
PID 996 wrote to memory of 2376	996	iexplore.exe	39

C:\Users\Admin\AppData\Local\Temp\c152bb2f73ba33e8dabd2e0209da9280_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\c152bb2f73ba33e8dabd2e0209da9280_exe32.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
  c:\users\admin\appdata\local\temp\\wmpscfgs.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2772
- - \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
    c:\users\admin\appdata\local\temp\\wmpscfgs.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- - C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
    C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
  C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1728

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\259535868.dat

Filesize
4B

MD5
4352d88a78aa39750bf70cd6f27bcaa5

SHA1
3c585604e87f855973731fea83e21fab9392d2fc

SHA256
67abdd721024f0ff4e0b3f4c2fc13bc5bad42d0b7851d456d88d203d15aaa450

SHA512
edf92e3d4f80fc47d948ea2f17b9bfc742d34e2e785a7a4927f3e261e8bd9d400b648bff2123b8396d24fb28f5869979e08d58b4b5d156e640344a2c0a54675d

Download Submit
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
6.5MB

MD5
a8677d8981338079fa27d0c9ac19a398

SHA1
ce43f43f01a7fcdd1d47696cf218f618da76ce3c

SHA256
61a564f1f4d6f4f9ab0205297a35e2ea098b58759b7497c332e9be75ecc33aec

SHA512
14cba9de2092c67dab7270c90fce73deca95f28fb4244c1f9ae03aed2307094e8a06c125fc8acdbf7c492aa01a94ba0d68c10311e03f3c0e52d66fbf3058cf2d

Download Submit
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
6.5MB

MD5
a8677d8981338079fa27d0c9ac19a398

SHA1
ce43f43f01a7fcdd1d47696cf218f618da76ce3c

SHA256
61a564f1f4d6f4f9ab0205297a35e2ea098b58759b7497c332e9be75ecc33aec

SHA512
14cba9de2092c67dab7270c90fce73deca95f28fb4244c1f9ae03aed2307094e8a06c125fc8acdbf7c492aa01a94ba0d68c10311e03f3c0e52d66fbf3058cf2d

Download Submit
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
6.5MB

MD5
a8677d8981338079fa27d0c9ac19a398

SHA1
ce43f43f01a7fcdd1d47696cf218f618da76ce3c

SHA256
61a564f1f4d6f4f9ab0205297a35e2ea098b58759b7497c332e9be75ecc33aec

SHA512
14cba9de2092c67dab7270c90fce73deca95f28fb4244c1f9ae03aed2307094e8a06c125fc8acdbf7c492aa01a94ba0d68c10311e03f3c0e52d66fbf3058cf2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25233b05cdff1b0dd6b2f57e6e1f7591

SHA1
023d8b18528a31efc15be63cab874c8f336f3bd2

SHA256
d7f78c4946c5225a0138b4bd855609f4df974b0376aae18cd895cfacded3615c

SHA512
9513082be1795eb0f509b0ed2a99a024d326a4858a6debf09c8c7162f9705735da1f2640420c9761edc964f5b8ad76edd8a014d09482d11e7e4fbaf973135189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b012aa79ac3e20bf9f07b2dd483bef5

SHA1
2c2c8a1e34d049ced22fcaaf4016b22d95a075db

SHA256
7120fee97ba1876556d6e4cb0876eaec89b187246a09655bd65fcb51913be860

SHA512
6c9218410bf5b6eb45ac222ff2e556f50f4d0492ebb29f055d479af414bbdff8201216b75b6a9f21d0a7ad7911b07ebdd52ac84ff7a4894d44e02bc2cd8b7bd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64e198ec28b71019e58c54f758a66378

SHA1
dc202db41a4256116961d51717a180f37b527275

SHA256
d30b9558d6a42d32a199744e221a243fc4876407fc4dad200dbd307e9aad0efe

SHA512
50a186ed4d97b55cb49c4fe244578d4f25b01146bd02d928bda2a453084c5703126cd5773c8768761d00011fe2ef06ff10be94848838c2d6e950e2412136dda4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62479d0226151dbaa9ce2d24bb105891

SHA1
455371175a87a817d3886cb269c04143a1002eae

SHA256
f390dc9a48bb3ab202dc9e3381e3e814100c97a65159be7a6de52b43b55c4948

SHA512
029edf9b24a9ef8f0eeb0bca8b265021751c3d255d5499b83df046d6eadc708c598f2364e73682bfb2ca0e98ad7d09c6e8cb2e148a2fbd7e72499d901a5b3b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d22c159ae8d627e607cbd6c86fa6e94

SHA1
e3fcffcc4f49fe055f2d771f33cadd120bbb2dc7

SHA256
de9b4c62c3483e7d41511bc4fa8eb1b7f3532713070961eabf5d44679fb7d998

SHA512
dd366fccfd97586c066ff3a2f85309f5d4ddfc2cb672f2d3befc819d96c5f0249a6566513c5b1ac1a948d34784f92d4f5a481f48a7b8458812d7a3dd0068917f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce03f0fca47544467e98682813c63c58

SHA1
3f52e75019279a4ff2023cf2f83f0dbfa7f53e53

SHA256
bf3a0c871e759f06ac651b7a48a4e9e05c947eb78c4a7415627fd8ca916072ac

SHA512
5b8a7fc9a1870a7c29c8dd1a06a69dd7d486001a0bbbb3d3e692a20fa067370c9d82e7e97393a8ac1c508b4e1a997c65b9fb6044558c0c8e4346871d6ed5624f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bdfa0a794edf023e8cc2c1721405a7a

SHA1
248325255a07d1996185640f5af44d35cdb46ae3

SHA256
10c3dda7a9026fad39bbe6bd9241767d52e764dac011ca67fff4a537b2bb9209

SHA512
c966c38beed15ceba2ec820a5d16ca55fbd26c3a3b2b787bc0f4e5c7aa359afb7bf6a5a5649bb363f6634e0782723b6246bee37d6e4d161dd628d17413c02120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e62a13c2a37d36ededc0aeb91b19253

SHA1
3ddf90b0bd5e55127695aa7c190b83ba6dc88ea1

SHA256
592ad7d11583d8c94637c9352af999e1dd0dff298608c8d72c395b2eeb383e81

SHA512
a2465d707d899bb0fe5f1dddfd06dac7e4e113f7005476f3f3f19c53d85e9b9d21535f54671f5ef1a157babe93c387093e22de1afd773670daa040ec2c42ccce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56561b76d358f2106242437d08a20d0d

SHA1
ec1d651cbcf75615f87b5b1e3dd880903395fb5a

SHA256
db47f9a3aa5cfcc610b76e9440ea2c392065191d82fb30e64e64fca308919145

SHA512
783f19640281732d8ccecba8733f626367c06a092001ab31e43dd4acde8ffce5ff5a2fe0b55157525d75fed35e9311bac85735203f3c9fc44dddd05dd4b19d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e65a02b0f678952dc2a58e72a1cef313

SHA1
16470d9ee05d5267b8660a046e64bc36fef580de

SHA256
f4f0e9a3f3a6e82ebb8b27aa13655fc6702ad6907517ab59cc352221ac0ee985

SHA512
57aa3dbb521e42336fdeaaf84ff2a35793e1b313b58fda45501ee480a6e8addb84e0c144a4f4cf2cc671bc48bc5b517942b37c9a6c6334e9d5b696abbc41e41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e18575a91da8bbea303afbe314584888

SHA1
0556da9aa42fbe358ed15e224206fd1a1a20c832

SHA256
419649e917ec541c534b577ca8adf893a825fd0d705f0c154e5a1da36145fcee

SHA512
d28703d1f4c76cdc7c496729967401465631f8aeee5efa3946986c2803d2e92ce6b19907a3aae1647d4e966470924b52dbc46137948373e7f128297818299290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31e768b8b5bb1d46aebb42c988314013

SHA1
32c2034bd779873432cbf9cc17a530ec00a9d053

SHA256
a38a4d9da92ecc4512e4eb66b011ec3269ff0599bc3644279ae9a848c0007608

SHA512
34cc0a0be478121e441631dbb464f03edb7048512aa96703fdf9daa46fe042422a8812e91f48395304aeb1a733c6fb0bc2c15260f367baabcbd2321361bc6278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
921dccecfad29765422ae2fa18143191

SHA1
6b92be287938c45db269f4ffd18f911a962cbdf6

SHA256
9ad0481d522f150d5387a6decf61a7fd31ce4feccba6c1975aaffdb8080c768d

SHA512
41799cc23bd46125282f64f2e8834cda2c7294767c81b5b0924b2e35e3d225da9605de79a420b127ae6086d188c974c0630c85d8671d779337fa6d6b9a303aa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f21663be8f88c1d53cb21afabe93285c

SHA1
6d52b4b272f5c8d1319d32a82e8e2baf715b3ead

SHA256
12b229fc1e804e7709afffd5254bd6b58425b7f05f5a4d8dbcde1a6b8f784498

SHA512
12c73267cbb315bfb411a9624abd5dfbeda687938df893e7f99ecb0aa2fc7ab5ee9afea6387db484f091b0a3d4377e9c6b5546898961e984ade70dfc5f1eceb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9081b8bd89325378f6d4a070760a050f

SHA1
fce941efa9db916ae46535edcdae21355ebaedf3

SHA256
f56409d3ebe70fbc8a025f21d6f49f36540bc1a3b80596774cfe21740b76e017

SHA512
e2419c386f77dbeceabd13bf485cb90817274359c4cce007cbad1e432448dd7c57c9cdf994cf44278a972474b840b2d61a3af5268cfcda28a37f4360ed6fe499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
960f7ec51a26078902d0a157f27b70d2

SHA1
823390e57cea808c5bd99a992d64059084096649

SHA256
665fca0eba588ee5770699c1b1ecb4aeda028fc8903f8977754fae4a7e0c1a55

SHA512
28875005242c9f515b5f9169375e835acbbe6c69cef4e5e440e87391a1cefd8a9f3b1299e8797249dbfa12042fe91abea08621e4b9104fd6d94cd99270f6d63f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1e7429b8f7c0e98b6c03260c45b37c7

SHA1
943e081cf3f0c1d86d1b87e71fd7c22fad97c65c

SHA256
ada07a72a3bb7d8eefb197a715237c7fe239fb28161d162d7dee9dabbf3bfab6

SHA512
e92e1c83de875a4a8663cea03f98d4518d5e26e4039901c503d3de7b508204532d918f80dded8ef4e5cfb747175767d0ef36b71ab68b8586539efe71ba1c51b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78c9d4bccded00db2686f1432684c026

SHA1
98b80976dab9d9b31ac958f57ed9a5685814e3ac

SHA256
0541b2da367ee5f9818514ac35cd908108adc1419b5b22fc76a36136f837f176

SHA512
9a137ceb822a24fe785996304d314d25aeaed08a08128b6d5b3709a8fcc2555c830a34dd830aa327a02146e42e5b717201031b7d9e14bb0494748f863c51cd89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aff8ddc2723de70cc69acb9af046c46

SHA1
6f6e29aca14b0e5495a73f5543715e88fca9b5e5

SHA256
f200d051c537109a4f68ce31f5d8afc60737a2e9ee0e1bd6ee9f3c40d6dbe249

SHA512
f4c2638c60276778c7474cf2714432e2ddcc6980f14ea55b11f2c4d90d6ff7f5928dea1c6d8788bfb86d3362271ea12336333e30c2539ad4949d77e8905366d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8b7f494533d8cefbb24129aee1f755f

SHA1
3136bdd66657cde58c0c291763bb27056b96a8bb

SHA256
a0455021431cdcb03027c55923241e42b6d2e7aa57405afa8fa2336a5d98d352

SHA512
e977f36c9f785fbdf1f17a943e45fe4ca7676227a2852148adc908a2eca64f612c4d098398d7ef54aee9b6a3528a73f562986dcc0ea3782def64dece5423f8a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55e0c024aaa710beafbaa61febfdd964

SHA1
29b44312407a6a64d9abaa2c191e1badb3059327

SHA256
dc4dba12460645d5bb82681981a6c69840a670508bc27e958336df26f1473a15

SHA512
ebc721c7b824ff9165f4753b28a850c073764c6c8ce6715586ccd2cc09f31706545a3aeb6bcea5361c22a9cf88f1557274f74495268af286a7c3a4c0473c013b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab849D.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar855B.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
6.5MB

MD5
4a7d1736e287973fd501392272e0f5cd

SHA1
fb50241479818a4d9a5fb2ee58abaab469d27b5c

SHA256
5f92ac1e45b060f18590f08ddbc1fc641c9129a90b0c83cd48cc6aaec7c52ae4

SHA512
025fcce5c0d91b5d5ec718b9de6e4b3c33d5d6863d43566cde2603f6fa3dc1a97f32af77bb1397b649e25aadde2f81154fab63726e162fa5252483daf54369ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
6.5MB

MD5
4a7d1736e287973fd501392272e0f5cd

SHA1
fb50241479818a4d9a5fb2ee58abaab469d27b5c

SHA256
5f92ac1e45b060f18590f08ddbc1fc641c9129a90b0c83cd48cc6aaec7c52ae4

SHA512
025fcce5c0d91b5d5ec718b9de6e4b3c33d5d6863d43566cde2603f6fa3dc1a97f32af77bb1397b649e25aadde2f81154fab63726e162fa5252483daf54369ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
6.5MB

MD5
4a7d1736e287973fd501392272e0f5cd

SHA1
fb50241479818a4d9a5fb2ee58abaab469d27b5c

SHA256
5f92ac1e45b060f18590f08ddbc1fc641c9129a90b0c83cd48cc6aaec7c52ae4

SHA512
025fcce5c0d91b5d5ec718b9de6e4b3c33d5d6863d43566cde2603f6fa3dc1a97f32af77bb1397b649e25aadde2f81154fab63726e162fa5252483daf54369ed

Download Submit
\??\c:\program files (x86)\microsoft office\office14\bcssync.exe

Filesize
6.5MB

MD5
fba5f1289521e5fc2412c5a3d0480958

SHA1
b6885f29d17d777b617696f8ff05bdf92ed3fe05

SHA256
b53b6b1b257f901392a6d2381ac53d39164f7ae0005fc73ca7de5fa63def47bb

SHA512
82dfc7df56729e5924b2cbe1ba46c04b021f48f2e5b2c66b8fb23bd25cc4386b2c1ca7324b0ac04e47d0005dfdaaf48352a55eabd531c49c58b3de9bab52a5a9

Download Submit
\??\c:\users\admin\appdata\local\temp\wmpscfgs.exe

Filesize
6.5MB

MD5
4a7d1736e287973fd501392272e0f5cd

SHA1
fb50241479818a4d9a5fb2ee58abaab469d27b5c

SHA256
5f92ac1e45b060f18590f08ddbc1fc641c9129a90b0c83cd48cc6aaec7c52ae4

SHA512
025fcce5c0d91b5d5ec718b9de6e4b3c33d5d6863d43566cde2603f6fa3dc1a97f32af77bb1397b649e25aadde2f81154fab63726e162fa5252483daf54369ed

Download Submit
\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
6.5MB

MD5
a8677d8981338079fa27d0c9ac19a398

SHA1
ce43f43f01a7fcdd1d47696cf218f618da76ce3c

SHA256
61a564f1f4d6f4f9ab0205297a35e2ea098b58759b7497c332e9be75ecc33aec

SHA512
14cba9de2092c67dab7270c90fce73deca95f28fb4244c1f9ae03aed2307094e8a06c125fc8acdbf7c492aa01a94ba0d68c10311e03f3c0e52d66fbf3058cf2d

Download Submit
\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
6.5MB

MD5
a8677d8981338079fa27d0c9ac19a398

SHA1
ce43f43f01a7fcdd1d47696cf218f618da76ce3c

SHA256
61a564f1f4d6f4f9ab0205297a35e2ea098b58759b7497c332e9be75ecc33aec

SHA512
14cba9de2092c67dab7270c90fce73deca95f28fb4244c1f9ae03aed2307094e8a06c125fc8acdbf7c492aa01a94ba0d68c10311e03f3c0e52d66fbf3058cf2d

Download Submit
\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
6.5MB

MD5
a8677d8981338079fa27d0c9ac19a398

SHA1
ce43f43f01a7fcdd1d47696cf218f618da76ce3c

SHA256
61a564f1f4d6f4f9ab0205297a35e2ea098b58759b7497c332e9be75ecc33aec

SHA512
14cba9de2092c67dab7270c90fce73deca95f28fb4244c1f9ae03aed2307094e8a06c125fc8acdbf7c492aa01a94ba0d68c10311e03f3c0e52d66fbf3058cf2d

Download Submit
\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
6.5MB

MD5
4a7d1736e287973fd501392272e0f5cd

SHA1
fb50241479818a4d9a5fb2ee58abaab469d27b5c

SHA256
5f92ac1e45b060f18590f08ddbc1fc641c9129a90b0c83cd48cc6aaec7c52ae4

SHA512
025fcce5c0d91b5d5ec718b9de6e4b3c33d5d6863d43566cde2603f6fa3dc1a97f32af77bb1397b649e25aadde2f81154fab63726e162fa5252483daf54369ed

Download Submit
\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
6.5MB

MD5
4a7d1736e287973fd501392272e0f5cd

SHA1
fb50241479818a4d9a5fb2ee58abaab469d27b5c

SHA256
5f92ac1e45b060f18590f08ddbc1fc641c9129a90b0c83cd48cc6aaec7c52ae4

SHA512
025fcce5c0d91b5d5ec718b9de6e4b3c33d5d6863d43566cde2603f6fa3dc1a97f32af77bb1397b649e25aadde2f81154fab63726e162fa5252483daf54369ed

Download Submit
\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
6.5MB

MD5
4a7d1736e287973fd501392272e0f5cd

SHA1
fb50241479818a4d9a5fb2ee58abaab469d27b5c

SHA256
5f92ac1e45b060f18590f08ddbc1fc641c9129a90b0c83cd48cc6aaec7c52ae4

SHA512
025fcce5c0d91b5d5ec718b9de6e4b3c33d5d6863d43566cde2603f6fa3dc1a97f32af77bb1397b649e25aadde2f81154fab63726e162fa5252483daf54369ed

Download Submit
memory/1252-772-0x0000000000470000-0x0000000000472000-memory.dmp

Filesize
8KB

Download
memory/1728-41-0x00000000002D0000-0x00000000002D2000-memory.dmp

Filesize
8KB

Download
memory/2012-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2772-22-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download