5c92f0738c290eac319d4ac3006b5725f1d2163fbfe68dbb2047e07920f4d5e8

Analysis

max time kernel
137s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FiddlerSetup (1).exe
Size

6.5MB
MD5

7fd1119b5f29e4094228dabf57e65a9d
SHA1

1a4e248bfe07f8c65ce68b4f29013442be6ef7c7
SHA256

5c92f0738c290eac319d4ac3006b5725f1d2163fbfe68dbb2047e07920f4d5e8
SHA512

20d22e16f5c285bd6ffdf3620762c340ffb97cc51c5080717b87442f29a14271644351b082392d9fb2fd1ce40a1fe56a4e6592a290d67f5c587e8e9eb2f33787
SSDEEP

196608:Q962sDwuahkk8ZaQd9NCMbw4fO0ADH6Op:Q5uAkk8ZBCuXfjADH6s

Score

9^/10

discovery evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

1684 netsh.exe
604 netsh.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 2 IoCs

Processes:

FiddlerSetup.exeSetupHelper

pid process

2668 FiddlerSetup.exe
1640 SetupHelper
Loads dropped DLL 5 IoCs

Processes:

FiddlerSetup (1).exeFiddlerSetup.exe

pid process

2908 FiddlerSetup (1).exe
2668 FiddlerSetup.exe
2668 FiddlerSetup.exe
2668 FiddlerSetup.exe
2668 FiddlerSetup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1684	netsh.exe
604	netsh.exe

pid	process
2668	FiddlerSetup.exe
1640	SetupHelper

pid	process
2908	FiddlerSetup (1).exe
2668	FiddlerSetup.exe
2668	FiddlerSetup.exe
2668	FiddlerSetup.exe
2668	FiddlerSetup.exe

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsj6FE4.tmp\FiddlerSetup.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\nsj6FE4.tmp\FiddlerSetup.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsj6FE4.tmp\FiddlerSetup.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsj6FE4.tmp\FiddlerSetup.exe	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeFiddlerSetup.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "9999"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000003ebb545415a53613cdba42c72f7ae8406cae0b6ffb3b1b7e21cc774c83986eed000000000e8000000002000020000000639de677ae4164e76b50d8aafc8e4b8d4bdd0ec0f7955dcc8b59a8515495f0a3200000007c4667d89ffa7be50620e02128d5c9c41fb03bd0b94869207fcaa8d66f233c8a40000000f7e4a278263ba324fb6aa55c7943feeed0a7d8bfe2f2bcb3090f92d643f9dcc07854914e799fd3308410d78e3d893138c5fec88bc1eb82169262a92d39cefe79	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	FiddlerSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Fiddler.exe = "0"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF8598C1-E0B0-11EE-9CE4-6A83D32C515E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416437978"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e0bfc8bd74da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000546388c6044670ecd641500a1d5611250b6cd7fd73a2e1808f6810dd5bd8712d000000000e8000000002000020000000dfa697cfcfa3fc790ae28cae82252e42c8cf99d638b5e67013bddb7d817a763c90000000955b49c8a2fdf8cd5d84f91954646a7d3ed1ad110da6d15739d7788043b0c8acd96554506c8e0c4b8bc533fa85361fb2b3dab7b166875fcbe0e9ce0fbf74dcf19f9e6b9140b360c66ea0699b5e8a1406dfb0a5da58c44b94f44bf98106e5c76eaa94dea55643bf9b11d44f19c3fb8b74f94dbc68c30cf7ccd47be7255c6b22b272dcb1476b2f3d98b2f018f920f0259440000000715bb7e469045c13ae8d41c1df928f94fec86690229e2ed1d8c343778a999cdd1a7e295d3c9a94c7b57ff7d4e40d0450ff83daea3379b927728e36839f3a350b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MAIN	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies registry class 15 IoCs

Processes:

FiddlerSetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\Shell	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\PerceivedType = "compressed"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open &in Viewer\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -viewer \"%1\""	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\Content Type = "application/vnd.telerik-fiddler.SessionArchive"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe\" -noattach \"%1\""	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.saz	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.saz\ = "Fiddler.ArchiveZip"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\ = "Fiddler Session Archive"	FiddlerSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Fiddler\\SAZ.ico"	FiddlerSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Fiddler.ArchiveZip\Shell\Open\command	FiddlerSetup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

912 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

912 iexplore.exe
912 iexplore.exe
1320 IEXPLORE.EXE
1320 IEXPLORE.EXE
1320 IEXPLORE.EXE
1320 IEXPLORE.EXE

pid	process
912	iexplore.exe

pid	process
912	iexplore.exe
912	iexplore.exe
1320	IEXPLORE.EXE
1320	IEXPLORE.EXE
1320	IEXPLORE.EXE
1320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

FiddlerSetup (1).exeFiddlerSetup.exeiexplore.exe

description	pid	process	target process
PID 2908 wrote to memory of 2668	2908	FiddlerSetup (1).exe	FiddlerSetup.exe
PID 2908 wrote to memory of 2668	2908	FiddlerSetup (1).exe	FiddlerSetup.exe
PID 2908 wrote to memory of 2668	2908	FiddlerSetup (1).exe	FiddlerSetup.exe
PID 2908 wrote to memory of 2668	2908	FiddlerSetup (1).exe	FiddlerSetup.exe
PID 2908 wrote to memory of 2668	2908	FiddlerSetup (1).exe	FiddlerSetup.exe
PID 2908 wrote to memory of 2668	2908	FiddlerSetup (1).exe	FiddlerSetup.exe
PID 2908 wrote to memory of 2668	2908	FiddlerSetup (1).exe	FiddlerSetup.exe
PID 2668 wrote to memory of 1684	2668	FiddlerSetup.exe	netsh.exe
PID 2668 wrote to memory of 1684	2668	FiddlerSetup.exe	netsh.exe
PID 2668 wrote to memory of 1684	2668	FiddlerSetup.exe	netsh.exe
PID 2668 wrote to memory of 1684	2668	FiddlerSetup.exe	netsh.exe
PID 2668 wrote to memory of 604	2668	FiddlerSetup.exe	netsh.exe
PID 2668 wrote to memory of 604	2668	FiddlerSetup.exe	netsh.exe
PID 2668 wrote to memory of 604	2668	FiddlerSetup.exe	netsh.exe
PID 2668 wrote to memory of 604	2668	FiddlerSetup.exe	netsh.exe
PID 2668 wrote to memory of 1780	2668	FiddlerSetup.exe	ngen.exe
PID 2668 wrote to memory of 1780	2668	FiddlerSetup.exe	ngen.exe
PID 2668 wrote to memory of 1780	2668	FiddlerSetup.exe	ngen.exe
PID 2668 wrote to memory of 1780	2668	FiddlerSetup.exe	ngen.exe
PID 2668 wrote to memory of 2688	2668	FiddlerSetup.exe	ngen.exe
PID 2668 wrote to memory of 2688	2668	FiddlerSetup.exe	ngen.exe
PID 2668 wrote to memory of 2688	2668	FiddlerSetup.exe	ngen.exe
PID 2668 wrote to memory of 2688	2668	FiddlerSetup.exe	ngen.exe
PID 2668 wrote to memory of 1640	2668	FiddlerSetup.exe	SetupHelper
PID 2668 wrote to memory of 1640	2668	FiddlerSetup.exe	SetupHelper
PID 2668 wrote to memory of 1640	2668	FiddlerSetup.exe	SetupHelper
PID 2668 wrote to memory of 1640	2668	FiddlerSetup.exe	SetupHelper
PID 2668 wrote to memory of 912	2668	FiddlerSetup.exe	iexplore.exe
PID 2668 wrote to memory of 912	2668	FiddlerSetup.exe	iexplore.exe
PID 2668 wrote to memory of 912	2668	FiddlerSetup.exe	iexplore.exe
PID 2668 wrote to memory of 912	2668	FiddlerSetup.exe	iexplore.exe
PID 912 wrote to memory of 1320	912	iexplore.exe	IEXPLORE.EXE
PID 912 wrote to memory of 1320	912	iexplore.exe	IEXPLORE.EXE
PID 912 wrote to memory of 1320	912	iexplore.exe	IEXPLORE.EXE
PID 912 wrote to memory of 1320	912	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\FiddlerSetup (1).exe
"C:\Users\Admin\AppData\Local\Temp\FiddlerSetup (1).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\nsj6FE4.tmp\FiddlerSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\nsj6FE4.tmp\FiddlerSetup.exe" /D=
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
    3⤵
    - Modifies Windows Firewall
    PID:1684
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
    3⤵
    - Modifies Windows Firewall
    PID:604
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
    3⤵
    PID:1780
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess f4 -Pipe 100 -Comment "NGen Worker Process"
      4⤵
      PID:1940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
    3⤵
    PID:2688
- - C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
    "C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
    3⤵
    - Executes dropped EXE
    PID:1640
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://fiddler2.com/r/?Fiddler2FirstRun
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ee1e776d725a84bbca244082f925666

SHA1
167e4ab5a6e3a2331d606dba42f778182b12ee2e

SHA256
3b60795c0e843c5c12e2d5eb2853c5a898964c6f55398a8aecce8769c96f96d1

SHA512
2f83bcb9361376c61ff88707b7315ebdafa97e8bf9f2d685bb0acc7d6111d7576a63e32bb51db83d943ae61a95e98a53c8fd0cc612954ed803a12bebbb728e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68144c41182e35a44950205213486daa

SHA1
e67da67aa964e76ce1d1b9e0c93f2d01781ec943

SHA256
90a2f6000ab69bb48d085575510c82b899edb6a77fbc4303b4d6c3c03b11a913

SHA512
dc09d46f8f34f03a0892d806f94a7ca7b4b2c86d16f6fe99cf1dc92a53bd1ba702277bcfa4176655ae7a37c8360e3c8551159c035af8d6ed58bd4210c9d5fd63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68d04fc489fe220e9977c415a7d8c932

SHA1
b3058bc472983b87fb133101e94d25850b73446f

SHA256
4db54e3023cd6492ed0a85601f97c584042bbf5879caf464947e7b615ca7426a

SHA512
c987a9b4192bb05894fa4859b131d9108a5de1e7d3b05aa40dca48f650a17501be870957204408e9a364c834088c5a26fcdf43200be3def7f31f2d81a8179b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9596566098c48287ac115eeb52e132c7

SHA1
b1df25f829c8b93491b026c47bf0ea35c46ff418

SHA256
0d74127632c3337207d69e631e8fe172e46570a5665e3cdf152c675ad991bbab

SHA512
856a6aa23a8ab72bb0c6eb08c4668fbd349a5f0352c81702e338e171d06da00b4b67374894d8850c4e0d561fc2cfa5981d3b76383ace346b5ae4433e8ade0058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d544ace5ebc32e0c2de0fe4bbe8abddd

SHA1
ec7f43e9176aa9318b7ab5d72c0dc0319b33009b

SHA256
36f431b89bfeabe60243e232e7c46cf534c90bec0fb29338d983e561eec423e1

SHA512
9b67d8f2deeeb16e2c0a4527a5c1b330bfa5ee8812aaa6408242a7f13b3425bad5c2a09b5219c878df463aa04dc5c0c5547fe73276c5ec54bd59609d2542e961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d60f98368644ccbdfe39566b8191e93d

SHA1
dfcf4c5d7ccd67c83793a62538585c06a80d11b8

SHA256
b002a3edb062f54d4ec6fe56760b7d99cdcc09ac062edcd757ac0f11f340e48f

SHA512
697b3ba1fe7d672e5e33b3ae77b611e77a4417d1a64714913f088816c8156d1df8f5d2392cd4ef64f3d3c318fac1cd609aafff9e770c17157e4b969e3aef3b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abadf828bed38c0d3112b78b4f9565f2

SHA1
f326282023a4858354a32e4722ab50097bd2fede

SHA256
2b2c7ee2408a01abb1534bc8b0c10ababeefa8598e7b676375a40fa6b22439d5

SHA512
c0a98196e71c58914c1a03f3c9754bea19ec82a02ee011362c9ac80a087d887fbf88b4d954cda8c00a8c4167ee268f54b291982b6e8e2ab819411b7804884973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f397f56623a2322242247c6dcc02ed16

SHA1
072f5c171b0889f538a7c235de7ce03c96d90293

SHA256
49eb31dd432d57135f0c6255f58605fe1470e4448d8b0aac1aaaa4bd945149ff

SHA512
eefee2d101fc85d65b1113dfea9a8bfbf6c5f5bd56f02cdc4bdcbdd447d52bf34bf1563af9ea13e855955a6b1d69e5d84ea1db0e341c5bffac04e5bbd37417a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1901ebd0067b62c2c65315ab7443f5bb

SHA1
1e65dcd77d1a711c6925838dc7e61e26bb70e510

SHA256
3c1b2953ab9b7c3b159057528f4c4a0bd4439887b0abea0ddd0a40ece03763fa

SHA512
451a0095aa50ff0b4badff32daaeedd7b2f4cf4dfdcbedfa6254229abb5525529cf4e9681ce9a288f631df292e54357b243089bc1f0805a3320dd1fd3f624e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46a4a0968724ca1fdb52f7bad316ab12

SHA1
9c310c483b4086d7eb7e6820a74e45715a884b5e

SHA256
bddce6c21dd7942c06b57dbf49cc16db6f1775c0b02aa1bbe18f0efca1925930

SHA512
974a5fb72bdd945b04b02b1ccd5e60f3316c5ff1fb3afc7fa7b0ca889a93f2a8f890f217035ce65ef484ac5909a60999c4622026f235a221a74ca9e0581b52a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3a1925c04f5d0ded79a8abddc6b29e6

SHA1
b09d1bf05f8998cd7dfdafdbd68a590e938430e8

SHA256
13fa8716fb1219c5e71279f19c9f922126ebb0ba721091a533c66a0a218c73e6

SHA512
77fd158e3874dbb90b97391fe93f0c2ccf3b3740809e140bcfe09b6ba8a89e88d1dfd5fe4cd0c1178ce0483de7fb4a90437e3015db3f2958d3290363b05ac1ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a423bc89a0c4287470ad64b7b47de06

SHA1
84b9099374124d41eb74b03a6d837a8a90ed2d52

SHA256
f72e45c35b4dd47dc7bac4cf7dc5672caa6d2e03dd0d2577ab44078ecf1ab14a

SHA512
3ee061d42b376f18050105ce494df3011e90849f1192601c04728bfbbd530818881e1c095ec6cc42d4b5ae4535b22b860e728780ab899a2def981d33113bc770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df472bf14acafb1b331f5a985230a2c5

SHA1
d39ec0f6cc83f566e1c30f335e026cd1cd591a97

SHA256
af733f239bddf0768b25b477bf3b24a07ac44602091f9024a87f59eede00f2ec

SHA512
b06fe7b733b997256c62ad65d9576d680b20a578453a28e5f9ea61bbe5eddd54a9d59c6cb4a9e027196b98602fe07d021cab405b6307bbbaf82ddea7b9bfea5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6cdb35217586f94a3f156d04e738429

SHA1
b736921cda8841ad7e680d94569170363b74bebd

SHA256
dc613028fd0e801e169ec21ccc623aae36cc11c2b95e31353490d88484d09047

SHA512
f578e32a76b841f6f935c84d661d1bde4413fe5a8098b569f4e1e731879ac5da3ea1094848080a0d64c27edad006b9b435e594f37a59a022cb76cec53e9d46bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70dd45803c0383ebe730af12b5b3a4cf

SHA1
5c85d1b29a28c682fa03aef477f34c8f2529e226

SHA256
e5ee10ba1843d463e2d47d4cbfa634831ef6598a4f373451643f74b879aaa0e7

SHA512
9a886866935eec6614e89ddda767eaa70c802e902b577d8b16c267af03c1d63a31ef704bb7e1b9a524b16fec99183927c2f1ae95e5e873935c56365fc3bb392e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc7945b3e8e9b20205db33b35111ebe

SHA1
ffb8f40c40b5900104a2749d4d44cf4f7f2e3620

SHA256
af412688339f4920c6029bdd9928cf413467d46932d8086d9c30d0c1b54d19fa

SHA512
8f950ae32e587b9ca8e3346c2ac7f8285b653915dc8ffcc8542440ec93d49ccd63229f14249a4e3ccd6062063a0bc612d25d5273a65ab9f63324d5b02d6751c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9c0ace06c3a68b007cbe37d17c30952

SHA1
87259feba06d3db59d4a87dd86595f68539f2802

SHA256
af55835d6760551823a644ed3dfb599b399120ba8814f152fcdcdfc2438d6783

SHA512
22daac9914c9d3e69cda0cf19ea174c4c550812d19e33b708efce32a716c86ae99888870fce8aff4d450ea27cb15a0fef75bde9fb94a181f53f1ad81becad9f5

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
960KB

MD5
6562f292b05323f2434958afe1debcf6

SHA1
4099c271a1257954fc8c50aac1b1aac542b9c194

SHA256
04261d09baecb6b076e4bee477151f7110c68e3ddbbe7eff484956a4c1dc8ec8

SHA512
2cef7a5ed209ba5e1b0b067932ef6d104dcb4a8c41431837687f5b0c17b5e8012f934b79568c96b4c611c44671a5a2a901fdb22007a316a9be867482284a1c2d

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll

Filesize
192KB

MD5
ac80e3ca5ec3ed77ef7f1a5648fd605a

SHA1
593077c0d921df0819d48b627d4a140967a6b9e0

SHA256
93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

SHA512
3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll

Filesize
816KB

MD5
eaa268802c633f27fcfc90fd0f986e10

SHA1
21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

SHA256
fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

SHA512
c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

Download Submit
C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll

Filesize
228KB

MD5
3be64186e6e8ad19dc3559ee3c307070

SHA1
2f9e70e04189f6c736a3b9d0642f46208c60380a

SHA256
79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

SHA512
7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar765F.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj6FE4.tmp\FiddlerSetup.exe

Filesize
2.5MB

MD5
e095f6f87287455ee6ed3d4b636d345d

SHA1
5e0808fbeca126bc653bb2a3531e5fc1f2f643e8

SHA256
96ccfaefed79c1698a88e7e151dacaa1ef1beae8c88fe8a9ca2409edac307b23

SHA512
250637d91a1a45f26bb6c742e7245757a2d505f409d1ddac3b6f8b216955ad9ea333b1413e83f573dda051321f05e7521ff8b398ce63e6e30b48cbfc03874ba3

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe

Filesize
1.5MB

MD5
a5b8c0f51898e9d55e4b3aa7904adf32

SHA1
5eaff276409670f3e8ce4cbb17086f1362d18868

SHA256
5e3006a575d4acce2e5e3cec684d7e9a1fbc3efbb73f06f5c4604faebf014ad3

SHA512
6abf01f09c8c6e430118de27322f4d67bf25018633544556630c47bfa9adc2c1fd186c94119a0b9be6c2d8dead9bbb46a8b1185fe02da2085601b0e9613ad427

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\FSE2.exe

Filesize
50KB

MD5
44f37783cd2889a9eb8232c263339e68

SHA1
cd186e0bc8ecb3e063e68d5923bd5e7b165e3532

SHA256
d43b4fa2b5b61429905f707959657430fc67a2a23351757b09af15c680e6efbf

SHA512
65880a8ee81a67e866babc71988f6af31084e690b6e172cfb14c51315accef92a26a73cedac9846ba4348a01b328400d942131b5704a8f91f7c804ae1100d2fd

Download Submit
\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper

Filesize
31KB

MD5
45a29924b29cd5881da857104c5554fe

SHA1
75716bfcb46aa02adc1e74369ec60f1c27e309b9

SHA256
b31d4c6a86bad9eaffaa543476261aaa95705fffaaf367a6ab67133c6af5fcfe

SHA512
0ee65dc21bfb5be949a8d96f0d5c04dba70c83988ddf460e9ce18e32eeb27fcb350e85b1ed5951ec2b5b2ad6506fa117fbe5495eabf58756fc66111f52b1b631

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6FE4.tmp\FiddlerSetup.exe

Filesize
3.2MB

MD5
092879b4ec0b7a59be6273035da99e27

SHA1
282f2602469017d4d8401e84e248a6c138b7de97

SHA256
87d5fd5bfadffa31f6b72923be4d4a46335b3e32a4f6e306f90d04d4aed49c50

SHA512
dde4050f6a26dc0feecb7a7f2563f33db5615c15c0dd1f3e6bf8ff8aa3a4ced68a53ae66c179f56dda5a50185b5053460e63c5a0489b141d11372aacfcea4cf9

Download Submit
\Users\Admin\AppData\Local\Temp\nso59B6.tmp\System.dll

Filesize
11KB

MD5
b8992e497d57001ddf100f9c397fcef5

SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd

SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

Download Submit
memory/1640-113-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/1640-109-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/1640-108-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

Filesize
32KB

Download
memory/1940-112-0x000000001B2F0000-0x000000001B46E000-memory.dmp

Filesize
1.5MB

Download
memory/1940-728-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/1940-110-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download