7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2

Analysis

max time kernel
117s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe
Size

137KB
MD5

65d64ee3cf2ade19767c7b4a43002b28
SHA1

788a134efcef34397677caee41d5980733699195
SHA256

7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2
SHA512

0aac95a3b29771b721f173e4009d03eb4fec20946f2ad80ea7a9b5dd7bfe3874545ee5b82d1bd4ea1371978a74e1da797e60d18c388dd9b0620890f4040cc9d9
SSDEEP

3072:b1i/NU8bOMYcYYcmy5d048g3nan3vx9kGSYng7+s5YmMOMYcYY51i/NU81:5i/NjO5x0Xg+UGSYnuy3Oai/Nd

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	sys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "file:\\\\C:\\sys.exe"	sys.exe

Deletes itself 1 IoCs

pid	Process
2516	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2728	sys.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	sys.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	sys.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\sys.exe	sys.exe
File opened for modification	C:\WINDOWS\sys.exe	attrib.exe
File created	C:\WINDOWS\sys.exe	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe
File opened for modification	C:\WINDOWS\sys.exe	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe
File created	C:\WINDOWS\sys.exe	sys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
2952	taskkill.exe
2672	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	sys.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416360702"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f198f8c46490941dcb21429506d22e3e43c18151377da085329b9058891f6baa000000000e8000000002000020000000efe9bb49eaed6bb8ab210486f722b8009ca23034426a38d12109f81bfbd80b9490000000c8f206bc6cef23b29b7ae727b31aeb7360495e647f4efb87b6b8577992f6eaf62a6c0131793fa47693f35f52ce9a04a18812db6c3cf10c7b0773943d2e6386e6a87d58f76ffdd007ffff798b4fc64379f0d6bb506404bd3dbc52b3479977913e93753ceccc947e41d1630afc5597c85e19acc4bd2f57ea8557baca3175fcc56b2c97262b216fde49be6b5c2462258abd4000000033d00c0a85f573e7d086bd552c199a3b9b4f34ea39b3da6f06b387103d93911c24049897e314e510d33defe2145b10fba915ba4803dbe6a6e1b077fc1a4fef5f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a168d60974da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01305A11-DFFD-11EE-9667-569FD5A164C1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ef09c0d44d253552b2a205f4777c6789738f87ff44e1a3fe83c37498840d9a0b000000000e8000000002000020000000011fe3f74131a94eb70c7964f50c84a7a500297ea879ae5874bb53fe3618599e20000000b04faf670190a44d4cd91f363a9c7dd126f33fb712ca99e4a9dea39f9876dc4d40000000044714eea6bffa43fea5118928d0e7ed72b3c732de75229611283ee6de7e933be56a5458fecf76a1c161648fad58781bdf446636c3fb94538c0e55791fc6fc89	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	sys.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2728	sys.exe
2728	sys.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2952	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1152	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe
2728	sys.exe
1152	iexplore.exe
1152	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2952	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	28
PID 2772 wrote to memory of 2952	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	28
PID 2772 wrote to memory of 2952	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	28
PID 2772 wrote to memory of 2952	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	28
PID 2772 wrote to memory of 2728	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	30
PID 2772 wrote to memory of 2728	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	30
PID 2772 wrote to memory of 2728	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	30
PID 2772 wrote to memory of 2728	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	30
PID 2772 wrote to memory of 2516	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	31
PID 2772 wrote to memory of 2516	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	31
PID 2772 wrote to memory of 2516	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	31
PID 2772 wrote to memory of 2516	2772	7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe	31
PID 2728 wrote to memory of 2672	2728	sys.exe	33
PID 2728 wrote to memory of 2672	2728	sys.exe	33
PID 2728 wrote to memory of 2672	2728	sys.exe	33
PID 2728 wrote to memory of 2672	2728	sys.exe	33
PID 2728 wrote to memory of 1152	2728	sys.exe	35
PID 2728 wrote to memory of 1152	2728	sys.exe	35
PID 2728 wrote to memory of 1152	2728	sys.exe	35
PID 2728 wrote to memory of 1152	2728	sys.exe	35
PID 1152 wrote to memory of 2228	1152	iexplore.exe	37
PID 1152 wrote to memory of 2228	1152	iexplore.exe	37
PID 1152 wrote to memory of 2228	1152	iexplore.exe	37
PID 1152 wrote to memory of 2228	1152	iexplore.exe	37
PID 2728 wrote to memory of 2868	2728	sys.exe	38
PID 2728 wrote to memory of 2868	2728	sys.exe	38
PID 2728 wrote to memory of 2868	2728	sys.exe	38
PID 2728 wrote to memory of 2868	2728	sys.exe	38
PID 2868 wrote to memory of 704	2868	cmd.exe	40
PID 2868 wrote to memory of 704	2868	cmd.exe	40
PID 2868 wrote to memory of 704	2868	cmd.exe	40
PID 2868 wrote to memory of 704	2868	cmd.exe	40
PID 2728 wrote to memory of 1628	2728	sys.exe	41
PID 2728 wrote to memory of 1628	2728	sys.exe	41
PID 2728 wrote to memory of 1628	2728	sys.exe	41
PID 2728 wrote to memory of 1628	2728	sys.exe	41
PID 1628 wrote to memory of 1792	1628	cmd.exe	43
PID 1628 wrote to memory of 1792	1628	cmd.exe	43
PID 1628 wrote to memory of 1792	1628	cmd.exe	43
PID 1628 wrote to memory of 1792	1628	cmd.exe	43
PID 2728 wrote to memory of 1876	2728	sys.exe	44
PID 2728 wrote to memory of 1876	2728	sys.exe	44
PID 2728 wrote to memory of 1876	2728	sys.exe	44
PID 2728 wrote to memory of 1876	2728	sys.exe	44
PID 1876 wrote to memory of 1840	1876	cmd.exe	46
PID 1876 wrote to memory of 1840	1876	cmd.exe	46
PID 1876 wrote to memory of 1840	1876	cmd.exe	46
PID 1876 wrote to memory of 1840	1876	cmd.exe	46
PID 2728 wrote to memory of 836	2728	sys.exe	47
PID 2728 wrote to memory of 836	2728	sys.exe	47
PID 2728 wrote to memory of 836	2728	sys.exe	47
PID 2728 wrote to memory of 836	2728	sys.exe	47
PID 836 wrote to memory of 2628	836	cmd.exe	49
PID 836 wrote to memory of 2628	836	cmd.exe	49
PID 836 wrote to memory of 2628	836	cmd.exe	49
PID 836 wrote to memory of 2628	836	cmd.exe	49
PID 2728 wrote to memory of 1996	2728	sys.exe	50
PID 2728 wrote to memory of 1996	2728	sys.exe	50
PID 2728 wrote to memory of 1996	2728	sys.exe	50
PID 2728 wrote to memory of 1996	2728	sys.exe	50
PID 1996 wrote to memory of 1332	1996	cmd.exe	52
PID 1996 wrote to memory of 1332	1996	cmd.exe	52
PID 1996 wrote to memory of 1332	1996	cmd.exe	52
PID 1996 wrote to memory of 1332	1996	cmd.exe	52

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1840	attrib.exe
2628	attrib.exe
1332	attrib.exe
1780	attrib.exe
604	attrib.exe
704	attrib.exe
1792	attrib.exe

C:\Users\Admin\AppData\Local\Temp\7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe
"C:\Users\Admin\AppData\Local\Temp\7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /im KSafeTray.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\WINDOWS\sys.exe
  "C:\WINDOWS\sys.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /im KSafeTray.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2228
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
      4⤵
      Views/modifies file attributes
      PID:704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
      4⤵
      Views/modifies file attributes
      PID:1792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
      4⤵
      Views/modifies file attributes
      PID:1840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
      4⤵
      Views/modifies file attributes
      PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
      4⤵
      Views/modifies file attributes
      PID:1332
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\sys.exe"
    3⤵
    PID:1732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\WINDOWS\sys.exe"
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "c:\sys.exe"
    3⤵
    PID:2368
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "c:\sys.exe"
      4⤵
      Views/modifies file attributes
      PID:604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del 7bd5aa00c27eba37e63df475c367e5c066f81cbdaf77b78e8925d848471d17b2.exe
  2⤵
  - Deletes itself
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
475ae480caa07c14c6ac19c3069acb5a

SHA1
e8c54eae0f509c40f545fb01fe733ff67e70b7d4

SHA256
adfc846f7325e3030bd49ae8194b0ce964b805f086f15167f9f2d24a11180bc0

SHA512
8a32647504c48dad90183e3ee290bca36055a7354ca7c3311fc0c75c368eb5707a6b0bd076285fe6f168f1eea9281b1c7e3c434b3af2f81e322db469b33d5c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1570bba879fec179cebaf6593c8f6371

SHA1
a74a82572cfc8684d932b155c6a23d1dff38429d

SHA256
0f5d61c3bd7a2364a9d598b341e071793ccb5e8a97bfae05bd8028926753d385

SHA512
d10481af34e402c66084ce914ca6311a88e28a1ddb9f33f1c436f2e28242913404567e7fb877dc2204c30d75eff7b0d481556d99cc791f6d711dbd12e3126e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e4d68f07dbc5d44a0121cdd28a2cc97

SHA1
b105b4c6c018179087c601c11ee70510837e358c

SHA256
841c7b18e1b56c25495627fb848aff48bb4c6d226575eb02db76b6e557a70f74

SHA512
0521c9a44723946a7577a3c3bdf96e215e2eb5272348d3b29589c6579a2d096a3b7293c97cc00870a31e6152c5f021384ad228bcb43174e631d6481d784b58f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f0b19e4c0714ebb9248a4c0ac0fa9af

SHA1
2511537bbf004f937c68efcb731b48ee85ef3b68

SHA256
e535adb072be7e044402dcfc10022e64956dc07b51ee8b738d0a41c433b22fba

SHA512
8e462f9f5baacccd76f518a8b15a20505b65f2799d14ee685c4cf96bccb94e38c68b8040efcae442460069348b2b2978868d08d00cb60e5c67321e99161542ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a227b483a2df1b1e5904e3c5b6305d93

SHA1
08d1b8efe888ad2e53930c4c447f1224383e2207

SHA256
e5fe760a2510de9713d13b8109f54d630df1e27b6555179d1535128320d6d293

SHA512
881db58750013682b6aa3c99b224e16593743fbe8631eef1151c01cfab244dcd7f5c5a28a2174e34e5d6559b2498e1f8028dae3c265edfa305f35476486a78a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b40233dbbe2c038976ec86b4945083ac

SHA1
f9dee15979f2fc7a2eb2e88d134bb56fcf45884b

SHA256
8f2ce3dbb9dc57f90cb9b671c32f7003f4dc04aedadfe15ba3273039d7293fa7

SHA512
a66789f1dc9744c7abb2fb153b274bfadb19ca555fafce9b28b55f57af649b3341da0276f411473d8898f916718673fc4f5332adb9db467c79c7d3b6dd37a11f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c82b761ee52da30f0902c90c1cf82bc6

SHA1
97ffe1a98a22467817d8dc055a9d765c59a7fdcf

SHA256
878759cbee4e0f3bec41344283b2330a595af13bcc1f69a2a9236950c52375e8

SHA512
d391d065ef2f21390ca6f7a0f7f8a36c34553e0faa37bbc22c9d28fce8e7b8c04dc36529afedc948630605cf8ef38c7dbb6314af3097e7e46a01184afdf88fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba148e72d93ca5e9880e29cd337aa07d

SHA1
bbf2b0b7dd91d7c5c5378cd48b3517670f4036b1

SHA256
9a30b9a5df9f7ea015d4585b9f10a1a4d69e9fe21bc9ba7cebdea74b292b1fd5

SHA512
ee2803b72ce6445d4e2dd39a13c068dea81e73942f95f474bd7b18e8d783b3d106ca4fdddf4b3d818f47a6788ab7bd31c5deb6ba9b9fcf083e19ea5557d67ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
418f4842262d6e90002ba59e3f0c2fa0

SHA1
6bc0ff187b57d66302a9ea7f781a95d1e4c1793d

SHA256
789ba839ba70e012336a3fa420a631264889f96cddf248cf02bf749bd184f77a

SHA512
611f3c4dc1df718e7623b4cbaf4c62a4add6b82e2455689e7c17143ce96fe5e7cee5cfa15fe09bb7591c825797d1ce15abbf0fe4492128bcd84d42a12abe2d07

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA749.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA915.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Windows\sys.exe

Filesize
137KB

MD5
9fbe6b717261552fbaf47f49388b3697

SHA1
3c94326ff7e81fd76849892ce0e2c8ca7db1e182

SHA256
d5d39915785eafdf46cd512f2ee361cda712b079064c1c096fa49f281e8200f8

SHA512
0d52537b4faa171b6e8d5f4558432075356026ddaed3a7ef95ecc3421c80e0977c7e6ba5207f59823599087db23e39fa23c2c52db3843aeaa338ea10a908c21e

Download Submit
\??\c:\sys.exe

Filesize
137KB

MD5
8a101f4798871eed8f1d926f20fdb854

SHA1
504f97d6c496adce34d24a4ffb1c4db8bab6ba0f

SHA256
8fd2319ecc837e42d2440831849e7f68935b68767bfa73aa52d9058c19508b3f

SHA512
72ee1ad729eb1ed24e273a8fb535db775d49011772768cfb460e4f1fb9f560383b6483f154258e04e0097c9dc97fb6374de346df47c6664e1e63fb326a254091

Download Submit