sality | 34fe41ca74cdae8f9184a5ee8a3df679590d800d8efdbbb6dc6e55c68298afc7

Analysis

max time kernel
21s
max time network
16s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.e3910cea311a827995eb06ad21ab8310.exe
Size

732KB
MD5

e3910cea311a827995eb06ad21ab8310
SHA1

b966c402786860721b75e57ee26790bbbe50860c
SHA256

34fe41ca74cdae8f9184a5ee8a3df679590d800d8efdbbb6dc6e55c68298afc7
SHA512

8a9063e619c3d7a04276450b27dcb1cee7eb521cdde9a79b2eb699077529dd8795367be98132c663952facac205df15ca3bbc25fc65ea555d16cf23cedd40e52
SSDEEP

12288:JTyjXW+48qWywrU4kGFezOAVuJ5PIbww7F5DO3HYffWGlUuda4:tIXW/8yw1ez54lI3F5SXYHWG5M4

Score

10^/10

sality backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	NEAS.e3910cea311a827995eb06ad21ab8310.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	rundll32.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.e3910cea311a827995eb06ad21ab8310.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
2708	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2792-4-0x0000000002520000-0x00000000035DA000-memory.dmp	upx
behavioral1/memory/2792-7-0x0000000002520000-0x00000000035DA000-memory.dmp	upx
behavioral1/memory/2792-8-0x0000000002520000-0x00000000035DA000-memory.dmp	upx
behavioral1/memory/2792-12-0x0000000002520000-0x00000000035DA000-memory.dmp	upx
behavioral1/memory/2792-17-0x0000000002520000-0x00000000035DA000-memory.dmp	upx
behavioral1/memory/2792-24-0x0000000002520000-0x00000000035DA000-memory.dmp	upx
behavioral1/memory/2792-27-0x0000000002520000-0x00000000035DA000-memory.dmp	upx
behavioral1/memory/2792-29-0x0000000002520000-0x00000000035DA000-memory.dmp	upx
behavioral1/memory/2792-35-0x0000000002520000-0x00000000035DA000-memory.dmp	upx
behavioral1/memory/2792-34-0x0000000002520000-0x00000000035DA000-memory.dmp	upx
behavioral1/memory/2708-60-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-62-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-63-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-66-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-70-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-79-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-85-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-86-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-88-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-90-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-91-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-92-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx
behavioral1/memory/2708-93-0x0000000003A50000-0x0000000004B0A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe"	NEAS.e3910cea311a827995eb06ad21ab8310.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.e3910cea311a827995eb06ad21ab8310.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\f768797	NEAS.e3910cea311a827995eb06ad21ab8310.exe
File opened for modification	C:\Windows\SYSTEM.INI	NEAS.e3910cea311a827995eb06ad21ab8310.exe
File created	C:\Windows\f76bf2a	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
2708	rundll32.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe
Token: SeDebugPrivilege	2708	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe
2708	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1116	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	12
PID 2792 wrote to memory of 1164	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	19
PID 2792 wrote to memory of 1204	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	18
PID 2792 wrote to memory of 1048	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	16
PID 2792 wrote to memory of 2708	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	28
PID 2792 wrote to memory of 2708	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	28
PID 2792 wrote to memory of 2708	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	28
PID 2792 wrote to memory of 2708	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	28
PID 2792 wrote to memory of 2708	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	28
PID 2792 wrote to memory of 2708	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	28
PID 2792 wrote to memory of 2708	2792	NEAS.e3910cea311a827995eb06ad21ab8310.exe	28
PID 2708 wrote to memory of 1116	2708	rundll32.exe	12
PID 2708 wrote to memory of 1164	2708	rundll32.exe	19
PID 2708 wrote to memory of 1204	2708	rundll32.exe	18

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.e3910cea311a827995eb06ad21ab8310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1116

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1048

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\NEAS.e3910cea311a827995eb06ad21ab8310.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.e3910cea311a827995eb06ad21ab8310.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2792
- - C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
    3⤵
    - Modifies firewall policy service
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2708

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0F7696E3_Rar\rundll32.exe

Filesize
664KB

MD5
8ca8216260b4f5e0d6e1132e49d1d25a

SHA1
c7ce0406001fb3eaaf82c5ad33945f01f0dddc11

SHA256
ddc806307ec3d800851db6c617343cad0a5e9af8dafe867b6dc2f33dd528cf64

SHA512
0644472c924acb7ae9c8f4b3222e5b2d3a95a9346587a104e437ab0d0c832b05fd153d7450e6d5f5f7d685be9b222712c2c6d869c05acd7efc89f63e83e29a33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

Filesize
732KB

MD5
e3910cea311a827995eb06ad21ab8310

SHA1
b966c402786860721b75e57ee26790bbbe50860c

SHA256
34fe41ca74cdae8f9184a5ee8a3df679590d800d8efdbbb6dc6e55c68298afc7

SHA512
8a9063e619c3d7a04276450b27dcb1cee7eb521cdde9a79b2eb699077529dd8795367be98132c663952facac205df15ca3bbc25fc65ea555d16cf23cedd40e52

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

Filesize
732KB

MD5
e3910cea311a827995eb06ad21ab8310

SHA1
b966c402786860721b75e57ee26790bbbe50860c

SHA256
34fe41ca74cdae8f9184a5ee8a3df679590d800d8efdbbb6dc6e55c68298afc7

SHA512
8a9063e619c3d7a04276450b27dcb1cee7eb521cdde9a79b2eb699077529dd8795367be98132c663952facac205df15ca3bbc25fc65ea555d16cf23cedd40e52

Download Submit
C:\Windows\SYSTEM.INI

Filesize
257B

MD5
fa9e0a42493fab1c804c61f4b8674b43

SHA1
9323189d67b0d69a000eb7f01da4e67f365447d1

SHA256
a5a8f7bcb920c9aaa6ad3bb6be7b353837447860a0580c6fa00add727c06bf80

SHA512
a545015813f045e198452462373b1c7d8545a9323b81340e6bea6222ff1e6bc622198b003fc323549ebc2a24cf7f0a646a0194522e06935868ff9c71285828e0

Download Submit
C:\mgbjxx.pif

Filesize
97KB

MD5
f1a8f9a4a760f2a5d52c648f55f37c0f

SHA1
29e0399367d9f2f10e8d8e5733cd943b05273aae

SHA256
2e57720d385ee01ac4948047844cf47b1ddc8ca86112f7edbf5540a2543af696

SHA512
de1770a8792b8658804cf524f7fb2775f99ec2ffe3b207787a13f31a221bca5efe92104c3ca3e075f36fcc11c683d61b1a7bd59381fce5dc4c5bd4ec7c857da2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

Filesize
732KB

MD5
e3910cea311a827995eb06ad21ab8310

SHA1
b966c402786860721b75e57ee26790bbbe50860c

SHA256
34fe41ca74cdae8f9184a5ee8a3df679590d800d8efdbbb6dc6e55c68298afc7

SHA512
8a9063e619c3d7a04276450b27dcb1cee7eb521cdde9a79b2eb699077529dd8795367be98132c663952facac205df15ca3bbc25fc65ea555d16cf23cedd40e52

Download Submit
memory/1116-9-0x0000000001CA0000-0x0000000001CA2000-memory.dmp

Filesize
8KB

Download
memory/2708-84-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2708-79-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-99-0x00000000002D0000-0x00000000002D2000-memory.dmp

Filesize
8KB

Download
memory/2708-93-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-92-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-91-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-90-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-88-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-86-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-85-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-82-0x00000000002D0000-0x00000000002D2000-memory.dmp

Filesize
8KB

Download
memory/2708-53-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2708-70-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-66-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-63-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-62-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2708-60-0x0000000003A50000-0x0000000004B0A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-17-0x0000000002520000-0x00000000035DA000-memory.dmp

Filesize
16.7MB

Download
memory/2792-48-0x00000000080C0000-0x000000000817F000-memory.dmp

Filesize
764KB

Download
memory/2792-42-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/2792-34-0x0000000002520000-0x00000000035DA000-memory.dmp

Filesize
16.7MB

Download
memory/2792-8-0x0000000002520000-0x00000000035DA000-memory.dmp

Filesize
16.7MB

Download
memory/2792-12-0x0000000002520000-0x00000000035DA000-memory.dmp

Filesize
16.7MB

Download
memory/2792-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2792-19-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/2792-7-0x0000000002520000-0x00000000035DA000-memory.dmp

Filesize
16.7MB

Download
memory/2792-58-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2792-35-0x0000000002520000-0x00000000035DA000-memory.dmp

Filesize
16.7MB

Download
memory/2792-22-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2792-29-0x0000000002520000-0x00000000035DA000-memory.dmp

Filesize
16.7MB

Download
memory/2792-27-0x0000000002520000-0x00000000035DA000-memory.dmp

Filesize
16.7MB

Download
memory/2792-26-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/2792-24-0x0000000002520000-0x00000000035DA000-memory.dmp

Filesize
16.7MB

Download
memory/2792-25-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2792-4-0x0000000002520000-0x00000000035DA000-memory.dmp

Filesize
16.7MB

Download