7214765ed06c2750d089c5ac36f868155ac34e38c4c741e26ee998d85ca9322e

Analysis

max time kernel
1s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5acf740d15c50aa170de2c46aa31985e.exe
Size

512KB
MD5

5acf740d15c50aa170de2c46aa31985e
SHA1

2259a108545ef0f783f5f813a35585a7b62a0026
SHA256

7214765ed06c2750d089c5ac36f868155ac34e38c4c741e26ee998d85ca9322e
SHA512

61be62ad01893210bd63035cbbccb21b76d3f2d56241b85031b8fa6c015fed212c751860ea931b5a825f14fc557df2b6924a4d89905131665af787efca3a02db
SSDEEP

6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	qbcvqnqpkd.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qbcvqnqpkd.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	qbcvqnqpkd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	qbcvqnqpkd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	qbcvqnqpkd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	qbcvqnqpkd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	qbcvqnqpkd.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	qbcvqnqpkd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	5acf740d15c50aa170de2c46aa31985e.exe

Executes dropped EXE 5 IoCs

pid	Process
640	qbcvqnqpkd.exe
4704	tqptmosvomjifkk.exe
1668	zduiszqn.exe
2784	ncjiqdpkhaauf.exe
2028	zduiszqn.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	qbcvqnqpkd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	qbcvqnqpkd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	qbcvqnqpkd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	qbcvqnqpkd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	qbcvqnqpkd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	qbcvqnqpkd.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bvyixmnm = "tqptmosvomjifkk.exe"	tqptmosvomjifkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ncjiqdpkhaauf.exe"	tqptmosvomjifkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mbbxyjmm = "qbcvqnqpkd.exe"	tqptmosvomjifkk.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	qbcvqnqpkd.exe
File opened (read-only)	\??\k:	zduiszqn.exe
File opened (read-only)	\??\l:	zduiszqn.exe
File opened (read-only)	\??\q:	zduiszqn.exe
File opened (read-only)	\??\s:	zduiszqn.exe
File opened (read-only)	\??\x:	zduiszqn.exe
File opened (read-only)	\??\w:	qbcvqnqpkd.exe
File opened (read-only)	\??\h:	qbcvqnqpkd.exe
File opened (read-only)	\??\k:	qbcvqnqpkd.exe
File opened (read-only)	\??\a:	zduiszqn.exe
File opened (read-only)	\??\i:	zduiszqn.exe
File opened (read-only)	\??\m:	zduiszqn.exe
File opened (read-only)	\??\r:	zduiszqn.exe
File opened (read-only)	\??\b:	qbcvqnqpkd.exe
File opened (read-only)	\??\e:	qbcvqnqpkd.exe
File opened (read-only)	\??\o:	qbcvqnqpkd.exe
File opened (read-only)	\??\q:	qbcvqnqpkd.exe
File opened (read-only)	\??\v:	qbcvqnqpkd.exe
File opened (read-only)	\??\z:	qbcvqnqpkd.exe
File opened (read-only)	\??\b:	zduiszqn.exe
File opened (read-only)	\??\e:	zduiszqn.exe
File opened (read-only)	\??\s:	qbcvqnqpkd.exe
File opened (read-only)	\??\j:	zduiszqn.exe
File opened (read-only)	\??\v:	zduiszqn.exe
File opened (read-only)	\??\y:	zduiszqn.exe
File opened (read-only)	\??\z:	zduiszqn.exe
File opened (read-only)	\??\a:	qbcvqnqpkd.exe
File opened (read-only)	\??\i:	qbcvqnqpkd.exe
File opened (read-only)	\??\u:	qbcvqnqpkd.exe
File opened (read-only)	\??\n:	zduiszqn.exe
File opened (read-only)	\??\m:	qbcvqnqpkd.exe
File opened (read-only)	\??\t:	qbcvqnqpkd.exe
File opened (read-only)	\??\p:	qbcvqnqpkd.exe
File opened (read-only)	\??\r:	qbcvqnqpkd.exe
File opened (read-only)	\??\h:	zduiszqn.exe
File opened (read-only)	\??\o:	zduiszqn.exe
File opened (read-only)	\??\t:	zduiszqn.exe
File opened (read-only)	\??\u:	zduiszqn.exe
File opened (read-only)	\??\g:	qbcvqnqpkd.exe
File opened (read-only)	\??\l:	qbcvqnqpkd.exe
File opened (read-only)	\??\g:	zduiszqn.exe
File opened (read-only)	\??\p:	zduiszqn.exe
File opened (read-only)	\??\w:	zduiszqn.exe
File opened (read-only)	\??\j:	qbcvqnqpkd.exe
File opened (read-only)	\??\n:	qbcvqnqpkd.exe
File opened (read-only)	\??\y:	qbcvqnqpkd.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	qbcvqnqpkd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	qbcvqnqpkd.exe

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3264-0-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
behavioral2/files/0x0006000000023234-29.dat	autoit_exe
behavioral2/files/0x0006000000023234-28.dat	autoit_exe
behavioral2/files/0x000700000002322d-19.dat	autoit_exe
behavioral2/files/0x0007000000023230-5.dat	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zduiszqn.exe	5acf740d15c50aa170de2c46aa31985e.exe
File opened for modification	C:\Windows\SysWOW64\zduiszqn.exe	5acf740d15c50aa170de2c46aa31985e.exe
File created	C:\Windows\SysWOW64\ncjiqdpkhaauf.exe	5acf740d15c50aa170de2c46aa31985e.exe
File opened for modification	C:\Windows\SysWOW64\tqptmosvomjifkk.exe	5acf740d15c50aa170de2c46aa31985e.exe
File opened for modification	C:\Windows\SysWOW64\qbcvqnqpkd.exe	5acf740d15c50aa170de2c46aa31985e.exe
File created	C:\Windows\SysWOW64\tqptmosvomjifkk.exe	5acf740d15c50aa170de2c46aa31985e.exe
File opened for modification	C:\Windows\SysWOW64\ncjiqdpkhaauf.exe	5acf740d15c50aa170de2c46aa31985e.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	qbcvqnqpkd.exe
File created	C:\Windows\SysWOW64\qbcvqnqpkd.exe	5acf740d15c50aa170de2c46aa31985e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	5acf740d15c50aa170de2c46aa31985e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	5acf740d15c50aa170de2c46aa31985e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	qbcvqnqpkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	qbcvqnqpkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	qbcvqnqpkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC8F9CCFE14F2E2837D3B3781983E97B08002F94362034BE1C842EB08A1"	5acf740d15c50aa170de2c46aa31985e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7FC6BB7FE6622D0D179D0A48A749167"	5acf740d15c50aa170de2c46aa31985e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	qbcvqnqpkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	qbcvqnqpkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	qbcvqnqpkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	qbcvqnqpkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	qbcvqnqpkd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	5acf740d15c50aa170de2c46aa31985e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC1B12E449239EB52CDB9A733EDD7C8"	5acf740d15c50aa170de2c46aa31985e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFFFFFF482A85189040D7587E95BDE6E143594667466244D7E9"	5acf740d15c50aa170de2c46aa31985e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	qbcvqnqpkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	qbcvqnqpkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32422C7A9C5182596D4676A577272DDE7D8564DD"	5acf740d15c50aa170de2c46aa31985e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1839C70C1490DAB2B9CC7CE9ED9034BD"	5acf740d15c50aa170de2c46aa31985e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	qbcvqnqpkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	qbcvqnqpkd.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
4704	tqptmosvomjifkk.exe
4704	tqptmosvomjifkk.exe
4704	tqptmosvomjifkk.exe
4704	tqptmosvomjifkk.exe
4704	tqptmosvomjifkk.exe
4704	tqptmosvomjifkk.exe
4704	tqptmosvomjifkk.exe
4704	tqptmosvomjifkk.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
2784	ncjiqdpkhaauf.exe
1668	zduiszqn.exe
1668	zduiszqn.exe
1668	zduiszqn.exe
1668	zduiszqn.exe
1668	zduiszqn.exe
1668	zduiszqn.exe
1668	zduiszqn.exe
1668	zduiszqn.exe
640	qbcvqnqpkd.exe
640	qbcvqnqpkd.exe
640	qbcvqnqpkd.exe
640	qbcvqnqpkd.exe
640	qbcvqnqpkd.exe
640	qbcvqnqpkd.exe
4704	tqptmosvomjifkk.exe
4704	tqptmosvomjifkk.exe
640	qbcvqnqpkd.exe
640	qbcvqnqpkd.exe
640	qbcvqnqpkd.exe
640	qbcvqnqpkd.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
640	qbcvqnqpkd.exe
4704	tqptmosvomjifkk.exe
2784	ncjiqdpkhaauf.exe
640	qbcvqnqpkd.exe
640	qbcvqnqpkd.exe
1668	zduiszqn.exe
4704	tqptmosvomjifkk.exe
2784	ncjiqdpkhaauf.exe
1668	zduiszqn.exe
4704	tqptmosvomjifkk.exe
2784	ncjiqdpkhaauf.exe
1668	zduiszqn.exe
2028	zduiszqn.exe
2028	zduiszqn.exe
2028	zduiszqn.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
3264	5acf740d15c50aa170de2c46aa31985e.exe
640	qbcvqnqpkd.exe
4704	tqptmosvomjifkk.exe
640	qbcvqnqpkd.exe
2784	ncjiqdpkhaauf.exe
640	qbcvqnqpkd.exe
1668	zduiszqn.exe
4704	tqptmosvomjifkk.exe
2784	ncjiqdpkhaauf.exe
1668	zduiszqn.exe
4704	tqptmosvomjifkk.exe
2784	ncjiqdpkhaauf.exe
1668	zduiszqn.exe
2028	zduiszqn.exe
2028	zduiszqn.exe
2028	zduiszqn.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 640	3264	5acf740d15c50aa170de2c46aa31985e.exe	30
PID 3264 wrote to memory of 640	3264	5acf740d15c50aa170de2c46aa31985e.exe	30
PID 3264 wrote to memory of 640	3264	5acf740d15c50aa170de2c46aa31985e.exe	30
PID 3264 wrote to memory of 4704	3264	5acf740d15c50aa170de2c46aa31985e.exe	29
PID 3264 wrote to memory of 4704	3264	5acf740d15c50aa170de2c46aa31985e.exe	29
PID 3264 wrote to memory of 4704	3264	5acf740d15c50aa170de2c46aa31985e.exe	29
PID 3264 wrote to memory of 1668	3264	5acf740d15c50aa170de2c46aa31985e.exe	28
PID 3264 wrote to memory of 1668	3264	5acf740d15c50aa170de2c46aa31985e.exe	28
PID 3264 wrote to memory of 1668	3264	5acf740d15c50aa170de2c46aa31985e.exe	28
PID 3264 wrote to memory of 2784	3264	5acf740d15c50aa170de2c46aa31985e.exe	27
PID 3264 wrote to memory of 2784	3264	5acf740d15c50aa170de2c46aa31985e.exe	27
PID 3264 wrote to memory of 2784	3264	5acf740d15c50aa170de2c46aa31985e.exe	27
PID 3264 wrote to memory of 2156	3264	5acf740d15c50aa170de2c46aa31985e.exe	25
PID 3264 wrote to memory of 2156	3264	5acf740d15c50aa170de2c46aa31985e.exe	25
PID 640 wrote to memory of 2028	640	qbcvqnqpkd.exe	22
PID 640 wrote to memory of 2028	640	qbcvqnqpkd.exe	22
PID 640 wrote to memory of 2028	640	qbcvqnqpkd.exe	22

C:\Users\Admin\AppData\Local\Temp\5acf740d15c50aa170de2c46aa31985e.exe
"C:\Users\Admin\AppData\Local\Temp\5acf740d15c50aa170de2c46aa31985e.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
  2⤵
  PID:2156
- C:\Windows\SysWOW64\ncjiqdpkhaauf.exe
  ncjiqdpkhaauf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2784
- C:\Windows\SysWOW64\zduiszqn.exe
  zduiszqn.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1668
- C:\Windows\SysWOW64\tqptmosvomjifkk.exe
  tqptmosvomjifkk.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4704
- C:\Windows\SysWOW64\qbcvqnqpkd.exe
  qbcvqnqpkd.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:640

C:\Windows\SysWOW64\zduiszqn.exe
C:\Windows\system32\zduiszqn.exe
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\qbcvqnqpkd.exe

Filesize
512KB

MD5
fc15a21ef8ad6977294621b270e8080b

SHA1
cac2821cc69326f287ba1687458b0cd58b14032c

SHA256
0bd521c1983c90764485a49246506717d54270c41789b412bc1fc8a39d054562

SHA512
8907a564fe76b3ef502a055e60e9e04f99d72564710e9e1f1645caf61eb3e7843ee99f0621546b955c098bca9f2f5d635364eb28270ac8714e5290789e55d81f

Download Submit
C:\Windows\SysWOW64\tqptmosvomjifkk.exe

Filesize
512KB

MD5
5a375b933abf3b0d851b73b8574cdec9

SHA1
a974e550bd28a3ce43f3ac5ec64230688e5f345a

SHA256
1381bb4abe8978c5f8ccd2fee697e47efdb4e79426e23e7e3af4a8ea0d5c92d3

SHA512
2f54a7a6720f667a54186f7e453b9dfdbf0b9d80360e702d994d56f32a83ca6c025f2d88343bf794eb413086a8754d70918f92c66e255a4b66cb67be3717bfd6

Download Submit
C:\Windows\SysWOW64\zduiszqn.exe

Filesize
512KB

MD5
f4699a735875de031542028d63240320

SHA1
461492c9a89fb23199b4d3f0233e6424e5702030

SHA256
b1a19bad6611aab3089d7f029a4066bbce2f2527c1f81e68e692041a8ada7325

SHA512
6d6bed6a50e08601b06f40801ef71b16dbeba1f34d95f901099e154d6d2ca7b3764625d99881df2224c64b4c7212b300064a69968f3eb5e25599d82fe7c78fd8

Download Submit
C:\Windows\SysWOW64\zduiszqn.exe

Filesize
158KB

MD5
6836f01136ca7bdb05a3421b955fc174

SHA1
6b1dacf6e9620d6115438661eecdf77986e02b2a

SHA256
45aa0c9f27aeaa8277f058b6e17c5ecfa8e2d502e72521c2972fa1c7b80d70fd

SHA512
e53e2d7c5beed7ac9cb82b19800f7c3778c94c6610521114cb94022c599558f2d194126a28eb5e65b19dfb9d81ce4525a0aaec62498220bedd3ddbd79903454d

Download Submit
memory/2156-57-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-40-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp

Filesize
64KB

Download
memory/2156-51-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-53-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-56-0x00007FFB8E090000-0x00007FFB8E0A0000-memory.dmp

Filesize
64KB

Download
memory/2156-138-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp

Filesize
64KB

Download
memory/2156-59-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-58-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-55-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-54-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-52-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-49-0x00007FFB8E090000-0x00007FFB8E0A0000-memory.dmp

Filesize
64KB

Download
memory/2156-50-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-48-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-43-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-42-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp

Filesize
64KB

Download
memory/2156-41-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-47-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-36-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp

Filesize
64KB

Download
memory/2156-35-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp

Filesize
64KB

Download
memory/2156-44-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-39-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-37-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp

Filesize
64KB

Download
memory/2156-38-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-116-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-139-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp

Filesize
64KB

Download
memory/2156-140-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp

Filesize
64KB

Download
memory/2156-145-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-144-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-143-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/2156-142-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp

Filesize
64KB

Download
memory/2156-141-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp

Filesize
2.0MB

Download
memory/3264-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download