Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/01/2024, 01:20
Static task
static1
Behavioral task
behavioral1
Sample
Zenith.msi
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Zenith.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
Zenith.msi
-
Size
4.8MB
-
MD5
db46881cd32a09fa8c8c4a39d647f3d0
-
SHA1
56354ab0953ab57ab6c681d0bb4c1078cbfea4ad
-
SHA256
0e3039b46cb8212e4787ca372d313cfc70a830cacbd54c80444574daeb26c77c
-
SHA512
bbe6a41f4e507e2137227fb7ff91c3c3791a1436ea1d6498d81310037536fc4716f58cf3db43d7443eeed6b212cff9140773893eb1d31afe9195530484b7ca38
-
SSDEEP
98304:IZ6HW4qRS1LAib59iUPhYCFZCJLyDcbt0hpkvmZOQL07rjA:IZ6xkeLJiUPhdZCccbMOX
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 2820 MsiExec.exe 2264 msiexec.exe 2264 msiexec.exe 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Zenith\tools\tools.exe msiexec.exe File created C:\Program Files\Zenith\Uninstall Zenith.lnk msiexec.exe File opened for modification C:\Program Files\Zenith\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Program Files\Zenith\Zenith.exe msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f76a1cb.msi msiexec.exe File created C:\Windows\Installer\f76a1cc.ipi msiexec.exe File created C:\Windows\Installer\{AD23F5BA-7F48-4D0C-8300-A8C6047FF826}\ProductIcon msiexec.exe File created C:\Windows\Installer\f76a1ce.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f76a1cb.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIA44B.tmp msiexec.exe File opened for modification C:\Windows\Installer\{AD23F5BA-7F48-4D0C-8300-A8C6047FF826}\ProductIcon msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe -
Modifies registry class 26 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6026C4D9990AAED56BC6585BAA593042\AB5F32DA84F7C0D438008A6C40F78F62 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AB5F32DA84F7C0D438008A6C40F78F62\External msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\SourceList\PackageName = "Zenith.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6026C4D9990AAED56BC6585BAA593042 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AB5F32DA84F7C0D438008A6C40F78F62\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\ProductIcon = "C:\\Windows\\Installer\\{AD23F5BA-7F48-4D0C-8300-A8C6047FF826}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AB5F32DA84F7C0D438008A6C40F78F62 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\PackageCode = "B6CD81C1D29F27E4299402AA442FDE9E" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\InstanceType = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\ProductName = "Zenith" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\Version = "131072" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AB5F32DA84F7C0D438008A6C40F78F62\Environment = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB5F32DA84F7C0D438008A6C40F78F62\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AB5F32DA84F7C0D438008A6C40F78F62\ShortcutsFeature = "MainProgram" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2264 msiexec.exe 2264 msiexec.exe 1356 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1856 msiexec.exe Token: SeIncreaseQuotaPrivilege 1856 msiexec.exe Token: SeRestorePrivilege 2264 msiexec.exe Token: SeTakeOwnershipPrivilege 2264 msiexec.exe Token: SeSecurityPrivilege 2264 msiexec.exe Token: SeCreateTokenPrivilege 1856 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1856 msiexec.exe Token: SeLockMemoryPrivilege 1856 msiexec.exe Token: SeIncreaseQuotaPrivilege 1856 msiexec.exe Token: SeMachineAccountPrivilege 1856 msiexec.exe Token: SeTcbPrivilege 1856 msiexec.exe Token: SeSecurityPrivilege 1856 msiexec.exe Token: SeTakeOwnershipPrivilege 1856 msiexec.exe Token: SeLoadDriverPrivilege 1856 msiexec.exe Token: SeSystemProfilePrivilege 1856 msiexec.exe Token: SeSystemtimePrivilege 1856 msiexec.exe Token: SeProfSingleProcessPrivilege 1856 msiexec.exe Token: SeIncBasePriorityPrivilege 1856 msiexec.exe Token: SeCreatePagefilePrivilege 1856 msiexec.exe Token: SeCreatePermanentPrivilege 1856 msiexec.exe Token: SeBackupPrivilege 1856 msiexec.exe Token: SeRestorePrivilege 1856 msiexec.exe Token: SeShutdownPrivilege 1856 msiexec.exe Token: SeDebugPrivilege 1856 msiexec.exe Token: SeAuditPrivilege 1856 msiexec.exe Token: SeSystemEnvironmentPrivilege 1856 msiexec.exe Token: SeChangeNotifyPrivilege 1856 msiexec.exe Token: SeRemoteShutdownPrivilege 1856 msiexec.exe Token: SeUndockPrivilege 1856 msiexec.exe Token: SeSyncAgentPrivilege 1856 msiexec.exe Token: SeEnableDelegationPrivilege 1856 msiexec.exe Token: SeManageVolumePrivilege 1856 msiexec.exe Token: SeImpersonatePrivilege 1856 msiexec.exe Token: SeCreateGlobalPrivilege 1856 msiexec.exe Token: SeCreateTokenPrivilege 1856 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1856 msiexec.exe Token: SeLockMemoryPrivilege 1856 msiexec.exe Token: SeIncreaseQuotaPrivilege 1856 msiexec.exe Token: SeMachineAccountPrivilege 1856 msiexec.exe Token: SeTcbPrivilege 1856 msiexec.exe Token: SeSecurityPrivilege 1856 msiexec.exe Token: SeTakeOwnershipPrivilege 1856 msiexec.exe Token: SeLoadDriverPrivilege 1856 msiexec.exe Token: SeSystemProfilePrivilege 1856 msiexec.exe Token: SeSystemtimePrivilege 1856 msiexec.exe Token: SeProfSingleProcessPrivilege 1856 msiexec.exe Token: SeIncBasePriorityPrivilege 1856 msiexec.exe Token: SeCreatePagefilePrivilege 1856 msiexec.exe Token: SeCreatePermanentPrivilege 1856 msiexec.exe Token: SeBackupPrivilege 1856 msiexec.exe Token: SeRestorePrivilege 1856 msiexec.exe Token: SeShutdownPrivilege 1856 msiexec.exe Token: SeDebugPrivilege 1856 msiexec.exe Token: SeAuditPrivilege 1856 msiexec.exe Token: SeSystemEnvironmentPrivilege 1856 msiexec.exe Token: SeChangeNotifyPrivilege 1856 msiexec.exe Token: SeRemoteShutdownPrivilege 1856 msiexec.exe Token: SeUndockPrivilege 1856 msiexec.exe Token: SeSyncAgentPrivilege 1856 msiexec.exe Token: SeEnableDelegationPrivilege 1856 msiexec.exe Token: SeManageVolumePrivilege 1856 msiexec.exe Token: SeImpersonatePrivilege 1856 msiexec.exe Token: SeCreateGlobalPrivilege 1856 msiexec.exe Token: SeCreateTokenPrivilege 1856 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1856 msiexec.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2820 2264 msiexec.exe 29 PID 2264 wrote to memory of 2820 2264 msiexec.exe 29 PID 2264 wrote to memory of 2820 2264 msiexec.exe 29 PID 2264 wrote to memory of 2820 2264 msiexec.exe 29 PID 2264 wrote to memory of 2820 2264 msiexec.exe 29 PID 2264 wrote to memory of 2820 2264 msiexec.exe 29 PID 2264 wrote to memory of 2820 2264 msiexec.exe 29 PID 2264 wrote to memory of 1356 2264 msiexec.exe 34 PID 2264 wrote to memory of 1356 2264 msiexec.exe 34 PID 2264 wrote to memory of 1356 2264 msiexec.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Zenith.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1856
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71AAA429C0DFAD741734B2CE394327C2 C2⤵
- Loads dropped DLL
PID:2820
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1356
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2908
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A8" "00000000000005C8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
325KB
MD5481a52ee2baa90d6335e7c64a4017d2f
SHA1298f8934dc6437452839a1adaff2a5c222526210
SHA2569808dcf9e0eeeb70e44f893a7e36334b04ed359d3d87be20f9bbfb8b095d145b
SHA512a1c8614cc8ddcc0e5251b4298d25a793eee57a684b00b3c821d5a05ba78e75936238cec1679c695a213b70ec31c151d842623767c5c992947b63414822166ae5
-
Filesize
1KB
MD5c1af8709bc3d5782b26d622a2dd2b80f
SHA18bacc63b9d8e6bf9e2c0e521f168eeb1edb61acc
SHA25644b88376bf1f96ebf0171d6b1d409d863ed6a76c7f92aa1d21fe18f1c40ffd4d
SHA5128b6cdeca9856a718443bc060b29e136b5ea7cc639f72a652de466e69c3ea7612735904a92b63486c85ca14119062ec6be21966e80c9424ee3c832427bb42753e
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
878KB
MD5602d2d46c5fbe82d316a2629a48274a4
SHA1e637c785dfc5f921f9fab5d897b0f190d42a4a42
SHA2568d050cdcdb117c327c8c12741ea2554cb57a096e5edd80ec22b4b5ab15a65df4
SHA512c56f9e1113a0ecf44f099489acfbc2c9742ac688599227842fb19e13a6449e8321c68d3e9dc69527711e060823cc1d0fca7467486348b28f11adffd708ee3729
-
Filesize
701KB
MD59afe8964d29981f942fc5c29d36ebf34
SHA192f6ed58caa9040462226aa1aff71e136aaa1e1a
SHA256c02ab469a0955c1807d3837c52305139c37dc024040fe36c25ba351877606d05
SHA512ef23c8f5cf2bc4b236955bec3d374389985037a55bbb9f9f3429efb26893b8d7cc690162641aa41d2958f450dba55daf50314d9f370d92ef1a7f446c7ff624b5
-
Filesize
287KB
MD5e60bc94e85b47c6bfcf72f332b65286f
SHA1c360e889d732ca4a9be214c932cecae2607c3e1b
SHA2563e9f78963b5a521529c33ec91494329ebcd377ab3e5b2a5f4ccb9f88554d90bb
SHA5125988cc510ba7bcc53e295f579c6be26cf6e201bde61bdd935a6eeeb7b24bd302a05341e0822e9ac33622cf5a0c3a829e65d7b0c23c3dae53bb8bf259db80bdd2
-
Filesize
374KB
MD5ac6bf9089be3f24bacfac8cc8708b3fa
SHA113f6e3610bbc88cab3b6c8ee5fa0518265f04946
SHA256c61016f691f08fb0e155dd1b58b77ca1758e5c74093b06daa91c0ab8e0c07168
SHA512df8711b83496de7cb498fd31e948c9906783ae5e9a56bd5962eee6a48d057d8b2031a2cc1a535fd1659dd1299fbd19acb300741e1eebab80325bf0c9b340016c
-
Filesize
289KB
MD563aae5b30467464ffb4039d3a2dcd21e
SHA1887332f7da014f91fd42ce2c8b09cae150623af7
SHA25625936159683b0c114093a8df40b08618c3132ecc8baaab0e2451819d809e2c1e
SHA5120b630bb53cca5625d8cf98febbcb24fd30c609428319319453801881a93b7a14ecdad24f9587bdcccf5332ea3bfa7b5d9b2a4572ef0bfc5d4ce10288d168412e
-
Filesize
169KB
MD594718da1f81a3ba47a7646e9d9801f45
SHA1a6785986e8e674a0dee1a32a626cb5614f90be86
SHA25691a1d9086b071f19bfb274ed7412946f9ae61377062941ac403380ea7f2dd13e
SHA51270881122b3d7b04b3a5f47f333e6594696710fdd9a0a0af6b425c30cf5146c37aaa250b8e5f07dff89b50af56eb25ed5e0fbca25b1cb628486401de2c328296d