33b042aca1c7afcaef629963aaf80a941de73f93add2241208c4ab38a1e58117

Analysis

max time kernel
151s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb1567bbc9b9d42878e43a049d7b39b0.exe
Size

270KB
MD5

cb1567bbc9b9d42878e43a049d7b39b0
SHA1

b240ada576a7be83ef209b8a2fd884fe41b96abb
SHA256

33b042aca1c7afcaef629963aaf80a941de73f93add2241208c4ab38a1e58117
SHA512

27d512551df31b6462e3aa0f42d9210c87334bbe9f65d7ce0ad1c432564485c2cb0adb1c6cdfe39e88fa475048f4595303190d4462f674f620e75f4068b3d87a
SSDEEP

3072:ZYUb5QoJ4g+Ri+Zj6Iz1ZdW4SrO7FSVp8Ji7a:ZY7xh6SZI4z7FSVpj2

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2736	cmd.exe

Executes dropped EXE 23 IoCs

pid	Process
2988	wwwttsyb.exe
2560	wifnd.exe
276	wrmymrkt.exe
2408	wbrjm.exe
1404	wryymrdym.exe
1532	wska.exe
3044	wgjfepse.exe
1448	wtfrmh.exe
2752	wxfgqolrl.exe
1872	wndpijqre.exe
1084	wamg.exe
1384	wjqcngui.exe
1536	wbkuxk.exe
1200	wmdxydbjt.exe
2060	wbbonl.exe
2452	wlkrper.exe
2588	wkymnp.exe
1624	wcklvet.exe
2784	wjplocsi.exe
1028	wxuvfmt.exe
108	wfmtlun.exe
2272	wjirb.exe
2756	wlfmodin.exe

Loads dropped DLL 64 IoCs

pid	Process
2224	cb1567bbc9b9d42878e43a049d7b39b0.exe
2224	cb1567bbc9b9d42878e43a049d7b39b0.exe
2224	cb1567bbc9b9d42878e43a049d7b39b0.exe
2224	cb1567bbc9b9d42878e43a049d7b39b0.exe
2988	wwwttsyb.exe
2988	wwwttsyb.exe
2988	wwwttsyb.exe
2988	wwwttsyb.exe
2560	wifnd.exe
2560	wifnd.exe
2560	wifnd.exe
2560	wifnd.exe
276	wrmymrkt.exe
276	wrmymrkt.exe
276	wrmymrkt.exe
276	wrmymrkt.exe
2408	wbrjm.exe
2408	wbrjm.exe
2408	wbrjm.exe
2408	wbrjm.exe
1404	wryymrdym.exe
1404	wryymrdym.exe
1404	wryymrdym.exe
1404	wryymrdym.exe
1532	wska.exe
1532	wska.exe
1532	wska.exe
1532	wska.exe
3044	wgjfepse.exe
3044	wgjfepse.exe
3044	wgjfepse.exe
3044	wgjfepse.exe
1448	wtfrmh.exe
1448	wtfrmh.exe
1448	wtfrmh.exe
1448	wtfrmh.exe
2752	wxfgqolrl.exe
2752	wxfgqolrl.exe
2752	wxfgqolrl.exe
2752	wxfgqolrl.exe
1872	wndpijqre.exe
1872	wndpijqre.exe
1872	wndpijqre.exe
1872	wndpijqre.exe
1084	wamg.exe
1084	wamg.exe
1084	wamg.exe
1084	wamg.exe
1384	wjqcngui.exe
1384	wjqcngui.exe
1384	wjqcngui.exe
1384	wjqcngui.exe
1536	wbkuxk.exe
1536	wbkuxk.exe
1536	wbkuxk.exe
1536	wbkuxk.exe
1200	wmdxydbjt.exe
1200	wmdxydbjt.exe
1200	wmdxydbjt.exe
1200	wmdxydbjt.exe
2060	wbbonl.exe
2060	wbbonl.exe
2060	wbbonl.exe
2060	wbbonl.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wbrjm.exe	wrmymrkt.exe
File created	C:\Windows\SysWOW64\wndpijqre.exe	wxfgqolrl.exe
File created	C:\Windows\SysWOW64\wbkuxk.exe	wjqcngui.exe
File opened for modification	C:\Windows\SysWOW64\wbbonl.exe	wmdxydbjt.exe
File opened for modification	C:\Windows\SysWOW64\wlkrper.exe	wbbonl.exe
File created	C:\Windows\SysWOW64\wjplocsi.exe	wcklvet.exe
File opened for modification	C:\Windows\SysWOW64\wlfmodin.exe	wjirb.exe
File opened for modification	C:\Windows\SysWOW64\wifnd.exe	wwwttsyb.exe
File opened for modification	C:\Windows\SysWOW64\wtfrmh.exe	wgjfepse.exe
File created	C:\Windows\SysWOW64\wjqcngui.exe	wamg.exe
File opened for modification	C:\Windows\SysWOW64\wjplocsi.exe	wcklvet.exe
File created	C:\Windows\SysWOW64\wfmtlun.exe	wxuvfmt.exe
File opened for modification	C:\Windows\SysWOW64\wjirb.exe	wfmtlun.exe
File created	C:\Windows\SysWOW64\wska.exe	wryymrdym.exe
File created	C:\Windows\SysWOW64\wgjfepse.exe	wska.exe
File created	C:\Windows\SysWOW64\wlfmodin.exe	wjirb.exe
File opened for modification	C:\Windows\SysWOW64\wbrjm.exe	wrmymrkt.exe
File opened for modification	C:\Windows\SysWOW64\wgjfepse.exe	wska.exe
File created	C:\Windows\SysWOW64\wlkrper.exe	wbbonl.exe
File created	C:\Windows\SysWOW64\wkymnp.exe	wlkrper.exe
File opened for modification	C:\Windows\SysWOW64\wkymnp.exe	wlkrper.exe
File created	C:\Windows\SysWOW64\wcklvet.exe	wkymnp.exe
File created	C:\Windows\SysWOW64\wxuvfmt.exe	wjplocsi.exe
File created	C:\Windows\SysWOW64\wsuybhe.exe	wlfmodin.exe
File opened for modification	C:\Windows\SysWOW64\wska.exe	wryymrdym.exe
File created	C:\Windows\SysWOW64\wmdxydbjt.exe	wbkuxk.exe
File opened for modification	C:\Windows\SysWOW64\wmdxydbjt.exe	wbkuxk.exe
File created	C:\Windows\SysWOW64\wjirb.exe	wfmtlun.exe
File opened for modification	C:\Windows\SysWOW64\wxfgqolrl.exe	wtfrmh.exe
File created	C:\Windows\SysWOW64\wrmymrkt.exe	wifnd.exe
File created	C:\Windows\SysWOW64\wamg.exe	wndpijqre.exe
File opened for modification	C:\Windows\SysWOW64\wamg.exe	wndpijqre.exe
File created	C:\Windows\SysWOW64\wifnd.exe	wwwttsyb.exe
File opened for modification	C:\Windows\SysWOW64\wrmymrkt.exe	wifnd.exe
File created	C:\Windows\SysWOW64\wryymrdym.exe	wbrjm.exe
File opened for modification	C:\Windows\SysWOW64\wryymrdym.exe	wbrjm.exe
File created	C:\Windows\SysWOW64\wtfrmh.exe	wgjfepse.exe
File created	C:\Windows\SysWOW64\wxfgqolrl.exe	wtfrmh.exe
File opened for modification	C:\Windows\SysWOW64\wndpijqre.exe	wxfgqolrl.exe
File opened for modification	C:\Windows\SysWOW64\wjqcngui.exe	wamg.exe
File created	C:\Windows\SysWOW64\wwwttsyb.exe	cb1567bbc9b9d42878e43a049d7b39b0.exe
File opened for modification	C:\Windows\SysWOW64\wfmtlun.exe	wxuvfmt.exe
File opened for modification	C:\Windows\SysWOW64\wcklvet.exe	wkymnp.exe
File opened for modification	C:\Windows\SysWOW64\wbkuxk.exe	wjqcngui.exe
File created	C:\Windows\SysWOW64\wbbonl.exe	wmdxydbjt.exe
File opened for modification	C:\Windows\SysWOW64\wxuvfmt.exe	wjplocsi.exe
File opened for modification	C:\Windows\SysWOW64\wwwttsyb.exe	cb1567bbc9b9d42878e43a049d7b39b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2988	2224	cb1567bbc9b9d42878e43a049d7b39b0.exe	29
PID 2224 wrote to memory of 2988	2224	cb1567bbc9b9d42878e43a049d7b39b0.exe	29
PID 2224 wrote to memory of 2988	2224	cb1567bbc9b9d42878e43a049d7b39b0.exe	29
PID 2224 wrote to memory of 2988	2224	cb1567bbc9b9d42878e43a049d7b39b0.exe	29
PID 2224 wrote to memory of 2736	2224	cb1567bbc9b9d42878e43a049d7b39b0.exe	30
PID 2224 wrote to memory of 2736	2224	cb1567bbc9b9d42878e43a049d7b39b0.exe	30
PID 2224 wrote to memory of 2736	2224	cb1567bbc9b9d42878e43a049d7b39b0.exe	30
PID 2224 wrote to memory of 2736	2224	cb1567bbc9b9d42878e43a049d7b39b0.exe	30
PID 2988 wrote to memory of 2560	2988	wwwttsyb.exe	32
PID 2988 wrote to memory of 2560	2988	wwwttsyb.exe	32
PID 2988 wrote to memory of 2560	2988	wwwttsyb.exe	32
PID 2988 wrote to memory of 2560	2988	wwwttsyb.exe	32
PID 2988 wrote to memory of 2500	2988	wwwttsyb.exe	33
PID 2988 wrote to memory of 2500	2988	wwwttsyb.exe	33
PID 2988 wrote to memory of 2500	2988	wwwttsyb.exe	33
PID 2988 wrote to memory of 2500	2988	wwwttsyb.exe	33
PID 2560 wrote to memory of 276	2560	wifnd.exe	36
PID 2560 wrote to memory of 276	2560	wifnd.exe	36
PID 2560 wrote to memory of 276	2560	wifnd.exe	36
PID 2560 wrote to memory of 276	2560	wifnd.exe	36
PID 2560 wrote to memory of 592	2560	wifnd.exe	37
PID 2560 wrote to memory of 592	2560	wifnd.exe	37
PID 2560 wrote to memory of 592	2560	wifnd.exe	37
PID 2560 wrote to memory of 592	2560	wifnd.exe	37
PID 276 wrote to memory of 2408	276	wrmymrkt.exe	39
PID 276 wrote to memory of 2408	276	wrmymrkt.exe	39
PID 276 wrote to memory of 2408	276	wrmymrkt.exe	39
PID 276 wrote to memory of 2408	276	wrmymrkt.exe	39
PID 276 wrote to memory of 2364	276	wrmymrkt.exe	40
PID 276 wrote to memory of 2364	276	wrmymrkt.exe	40
PID 276 wrote to memory of 2364	276	wrmymrkt.exe	40
PID 276 wrote to memory of 2364	276	wrmymrkt.exe	40
PID 2408 wrote to memory of 1404	2408	wbrjm.exe	43
PID 2408 wrote to memory of 1404	2408	wbrjm.exe	43
PID 2408 wrote to memory of 1404	2408	wbrjm.exe	43
PID 2408 wrote to memory of 1404	2408	wbrjm.exe	43
PID 2408 wrote to memory of 1768	2408	wbrjm.exe	44
PID 2408 wrote to memory of 1768	2408	wbrjm.exe	44
PID 2408 wrote to memory of 1768	2408	wbrjm.exe	44
PID 2408 wrote to memory of 1768	2408	wbrjm.exe	44
PID 1404 wrote to memory of 1532	1404	wryymrdym.exe	46
PID 1404 wrote to memory of 1532	1404	wryymrdym.exe	46
PID 1404 wrote to memory of 1532	1404	wryymrdym.exe	46
PID 1404 wrote to memory of 1532	1404	wryymrdym.exe	46
PID 1404 wrote to memory of 1360	1404	wryymrdym.exe	47
PID 1404 wrote to memory of 1360	1404	wryymrdym.exe	47
PID 1404 wrote to memory of 1360	1404	wryymrdym.exe	47
PID 1404 wrote to memory of 1360	1404	wryymrdym.exe	47
PID 1532 wrote to memory of 3044	1532	wska.exe	49
PID 1532 wrote to memory of 3044	1532	wska.exe	49
PID 1532 wrote to memory of 3044	1532	wska.exe	49
PID 1532 wrote to memory of 3044	1532	wska.exe	49
PID 1532 wrote to memory of 2180	1532	wska.exe	50
PID 1532 wrote to memory of 2180	1532	wska.exe	50
PID 1532 wrote to memory of 2180	1532	wska.exe	50
PID 1532 wrote to memory of 2180	1532	wska.exe	50
PID 3044 wrote to memory of 1448	3044	wgjfepse.exe	52
PID 3044 wrote to memory of 1448	3044	wgjfepse.exe	52
PID 3044 wrote to memory of 1448	3044	wgjfepse.exe	52
PID 3044 wrote to memory of 1448	3044	wgjfepse.exe	52
PID 3044 wrote to memory of 2628	3044	wgjfepse.exe	53
PID 3044 wrote to memory of 2628	3044	wgjfepse.exe	53
PID 3044 wrote to memory of 2628	3044	wgjfepse.exe	53
PID 3044 wrote to memory of 2628	3044	wgjfepse.exe	53

C:\Users\Admin\AppData\Local\Temp\cb1567bbc9b9d42878e43a049d7b39b0.exe
"C:\Users\Admin\AppData\Local\Temp\cb1567bbc9b9d42878e43a049d7b39b0.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\wwwttsyb.exe
  "C:\Windows\system32\wwwttsyb.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\wifnd.exe
    "C:\Windows\system32\wifnd.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\SysWOW64\wrmymrkt.exe
      "C:\Windows\system32\wrmymrkt.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:276
    - - C:\Windows\SysWOW64\wbrjm.exe
        
        "C:\Windows\system32\wbrjm.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Windows\SysWOW64\wryymrdym.exe
        
        "C:\Windows\system32\wryymrdym.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\SysWOW64\wska.exe
        
        "C:\Windows\system32\wska.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\wgjfepse.exe
        
        "C:\Windows\system32\wgjfepse.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\SysWOW64\wtfrmh.exe
        
        "C:\Windows\system32\wtfrmh.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1448
        
        C:\Windows\SysWOW64\wxfgqolrl.exe
        
        "C:\Windows\system32\wxfgqolrl.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2752
        
        C:\Windows\SysWOW64\wndpijqre.exe
        
        "C:\Windows\system32\wndpijqre.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1872
        
        C:\Windows\SysWOW64\wamg.exe
        
        "C:\Windows\system32\wamg.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1084
        
        C:\Windows\SysWOW64\wjqcngui.exe
        
        "C:\Windows\system32\wjqcngui.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1384
        
        C:\Windows\SysWOW64\wbkuxk.exe
        
        "C:\Windows\system32\wbkuxk.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1536
        
        C:\Windows\SysWOW64\wmdxydbjt.exe
        
        "C:\Windows\system32\wmdxydbjt.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1200
        
        C:\Windows\SysWOW64\wbbonl.exe
        
        "C:\Windows\system32\wbbonl.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2060
        
        C:\Windows\SysWOW64\wlkrper.exe
        
        "C:\Windows\system32\wlkrper.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SysWOW64\wkymnp.exe
        
        "C:\Windows\system32\wkymnp.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2588
        
        C:\Windows\SysWOW64\wcklvet.exe
        
        "C:\Windows\system32\wcklvet.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1624
        
        C:\Windows\SysWOW64\wjplocsi.exe
        
        "C:\Windows\system32\wjplocsi.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2784
        
        C:\Windows\SysWOW64\wxuvfmt.exe
        
        "C:\Windows\system32\wxuvfmt.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1028
        
        C:\Windows\SysWOW64\wfmtlun.exe
        
        "C:\Windows\system32\wfmtlun.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:108
        
        C:\Windows\SysWOW64\wjirb.exe
        
        "C:\Windows\system32\wjirb.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2272
        
        C:\Windows\SysWOW64\wlfmodin.exe
        
        "C:\Windows\system32\wlfmodin.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjirb.exe"
        24⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfmtlun.exe"
        23⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxuvfmt.exe"
        22⤵
        
        PID:968
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjplocsi.exe"
        21⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcklvet.exe"
        20⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkymnp.exe"
        19⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlkrper.exe"
        18⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbbonl.exe"
        17⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmdxydbjt.exe"
        16⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbkuxk.exe"
        15⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjqcngui.exe"
        14⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wamg.exe"
        13⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wndpijqre.exe"
        12⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxfgqolrl.exe"
        11⤵
        
        PID:812
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtfrmh.exe"
        10⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgjfepse.exe"
        9⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wska.exe"
        8⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wryymrdym.exe"
        7⤵
        
        PID:1360
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbrjm.exe"
        6⤵
        
        PID:1768
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrmymrkt.exe"
        5⤵
        
        PID:2364
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wifnd.exe"
      4⤵
      PID:592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwwttsyb.exe"
    3⤵
    PID:2500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\cb1567bbc9b9d42878e43a049d7b39b0.exe"
  2⤵
  - Deletes itself
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Y6H848M0.txt

Filesize
97B

MD5
059e641f6ab3f3866fccfb9678943cca

SHA1
f70e491437cb2aacabbf09bba8a677881e69ee53

SHA256
7b1ee8ef2cb8d2ec6bc88717d38a8f5e58198253d26192b8b5ccec0dd3696995

SHA512
706feeee00e9b9f3f858e672274ed351ce6799c6abc6809605387628e19cd903271632f3853afd2b65d7b498f220b7983ed4698f1e3511973038e11e3b972c77

Download Submit
\Windows\SysWOW64\wamg.exe

Filesize
270KB

MD5
18314b9f2eb2531720d21b9bb8580f80

SHA1
58abefe981c730271611bdec6d1228dbe922c71a

SHA256
cfda31c539e4372cb9b260c29d53f266885d6160bd81a5291eb9177c2fdb8925

SHA512
3f6156f4708c2a76f70ba16b46478fc45b535ee43826961d417b2a4b1aba5225568dbc1badf6ae1441cbfff4974231a5db993b66cd8ee2c75150c00c669149fa

Download Submit
\Windows\SysWOW64\wbrjm.exe

Filesize
270KB

MD5
3f48beab95029778c948dc2b495480bf

SHA1
4d7d1809507f83f234c385f37fe2cd04933fbadd

SHA256
05b0ee2193c5727666dc3865ce8cb4e4262855478b6969cfd10a842c11a08aa1

SHA512
b31bc57a9aab400bf45ba01915fa2d322386a33212378d1a15d85d54900cb69c54b01f4f3fa57dd905a60d51f7f63e3fbec41cc9aa380fd8f496d4a4b4c6691a

Download Submit
\Windows\SysWOW64\wgjfepse.exe

Filesize
270KB

MD5
2568fe48ab8d041786e384e4ec424b22

SHA1
b81c07755c0910c64fe21d903d2acbae5d81fa34

SHA256
edf858077c487ef379f32899021a9af79d91baad44898df7e16e76ff1f8014fb

SHA512
d3b139ba96333bb651a050ff6bcd53bab620c1085ad7b2a4b0919b6042d72d5c9e05b3dc48eb4658272f5f2e17092b73c4661155cedbf6bc6c2a2e87db244815

Download Submit
\Windows\SysWOW64\wifnd.exe

Filesize
270KB

MD5
6b4ea64740f42a7f842f34f721f39da1

SHA1
76fd11bbe12cc74957bd28fd381cc8af7cf52791

SHA256
e9fe2d68d84c8806b8cdf6a018334b4f28d0a02433c7209329f18835047fa5fc

SHA512
3bd3540f1cd4958a18c9424aff47c297f1418ffd2ce1e94696dc5db4be92afc313df4939e3a8d9d7296d2df729f3d23fd359d0639ff40a18e670a6fb9ef9d403

Download Submit
\Windows\SysWOW64\wndpijqre.exe

Filesize
270KB

MD5
b4a249777e1e03c5218606b97407e6ba

SHA1
84e9c2c90f665526ae148e45f691dd35b720683b

SHA256
62e1f86b72212b143cf165c6ae60dcc76fcdf5a9451bc86311d1e69576015356

SHA512
bbf935cf01c313982070d0d4756845f00743b4325cf17c135c6ccb7c3c28eabfcf40538045e6ab87253003054e7a0a7741d67b5340cb85ff2249c5cbe7379f0b

Download Submit
\Windows\SysWOW64\wrmymrkt.exe

Filesize
270KB

MD5
ee06636b3f3ca952cb765758ebcdacfc

SHA1
3c0c06f6bc598f19c043fee164463c2a0b5da7ed

SHA256
39d40fbf6172c85ba6fca70b5a126ec5a32575df3074d7b4a1ee3d334f5d602d

SHA512
77da5f4e15e5600fa0c03e9ee60740ba6e955bdcfe84049a0c0cc84e2af0c3580b93a978be94dcac4e01568536daf1fd4fd0c9166c02988daedb19ba964ce41c

Download Submit
\Windows\SysWOW64\wryymrdym.exe

Filesize
270KB

MD5
6e0a8cc265a0a7ed8c5f73578874d081

SHA1
8379b63ab6f2fc263b6c6070c868ac4f89a4d4c7

SHA256
0b1cfe7f0aa1594c0926d3527315470c822c604bceff8d4e4377a6f49518a308

SHA512
20cbe663b642cd3b3f74e0ca8e6951ce417a82cb995dfab6ab49a0b82b6ba957f7797cfa0385ac5c91221c1fad09de03af6a0cd713e81b1b1b0b9aaf49cbc663

Download Submit
\Windows\SysWOW64\wska.exe

Filesize
270KB

MD5
dadb1a1f99d5a150b8457a86c93d2a36

SHA1
957a6cc396e1714d8fe88902aebbf45d501ab50b

SHA256
4d72b353a3880d7af44f49de4678130d1bf717ed7dba23e7f2b62ef2408f303e

SHA512
69831b84450fbbc4fb83cf673b201371680d4f3535c1994e0c3ad42a143b1fdab5e48d23cb57c49583d4a4bc19f5116ebb1ac225a85791ddbef6efd16d503466

Download Submit
\Windows\SysWOW64\wtfrmh.exe

Filesize
270KB

MD5
e483c8887bab83789b07552953f17267

SHA1
10c3f7a2dd243832a0be41b3dec669f72b8505c7

SHA256
9643bea4417af1e2b8070836be43a1ad6031a0179b099af8424df5f2c6ff893b

SHA512
7d5fb375f7d8ba809c1ee44f54e462f53af300dcc751baa27ba0c7823ebede4c7a79575054004871e706817beb6df2dc53485c633a7fedb430e166d0774e0055

Download Submit
\Windows\SysWOW64\wwwttsyb.exe

Filesize
270KB

MD5
a4dfa0cb20de93974221a56131ffd8c8

SHA1
c797317ed4b766c50c999d7f59467e11dfe43b3a

SHA256
d75ebce69b77fc3c6f6b865cf9cc8bffc366488ee06b12bcdc817164a1fca74b

SHA512
8f54da740e785f6b627de0b3802a2e82335356f32e4518c9596d148802684ac0f877b368456b48b0e9ab273f8de86ccebaab5a03acfc58c6852dc3be68e445d6

Download Submit
\Windows\SysWOW64\wxfgqolrl.exe

Filesize
270KB

MD5
d7a0443bd4df76bcc9bdc6d6a5ab29bc

SHA1
45c2e9f720b498f1023c504450367c043110f6d6

SHA256
46586c9b19287ec84a254863d47190852cfbe7f8323f6871f68d6729631d6298

SHA512
92854a5f18c26c342bce16c1660246e5535789c0290b7548794a4b23122e91dcb2f7d4a648c536709b2c09b0be6e4e14e37aba87b00100eaa0059fab2f6e44c6

Download Submit
memory/276-141-0x0000000003870000-0x0000000003887000-memory.dmp

Filesize
92KB

Download
memory/276-82-0x0000000003870000-0x0000000003887000-memory.dmp

Filesize
92KB

Download
memory/276-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/276-78-0x0000000003860000-0x0000000003877000-memory.dmp

Filesize
92KB

Download
memory/276-81-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/276-80-0x0000000003870000-0x0000000003887000-memory.dmp

Filesize
92KB

Download
memory/1084-243-0x0000000003670000-0x0000000003687000-memory.dmp

Filesize
92KB

Download
memory/1084-244-0x0000000003670000-0x0000000003687000-memory.dmp

Filesize
92KB

Download
memory/1084-230-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1084-242-0x0000000003670000-0x0000000003687000-memory.dmp

Filesize
92KB

Download
memory/1084-245-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1200-293-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1200-292-0x0000000003C80000-0x0000000003C97000-memory.dmp

Filesize
92KB

Download
memory/1200-280-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1384-264-0x0000000003DA0000-0x0000000003DB7000-memory.dmp

Filesize
92KB

Download
memory/1384-246-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1384-259-0x0000000003EB0000-0x0000000003EC7000-memory.dmp

Filesize
92KB

Download
memory/1384-263-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1384-260-0x0000000003EB0000-0x0000000003EC7000-memory.dmp

Filesize
92KB

Download
memory/1384-251-0x0000000003DA0000-0x0000000003DB7000-memory.dmp

Filesize
92KB

Download
memory/1404-123-0x0000000003C60000-0x0000000003C77000-memory.dmp

Filesize
92KB

Download
memory/1404-122-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1404-120-0x0000000003C60000-0x0000000003C77000-memory.dmp

Filesize
92KB

Download
memory/1404-103-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1404-169-0x0000000003C60000-0x0000000003C77000-memory.dmp

Filesize
92KB

Download
memory/1448-185-0x0000000003C20000-0x0000000003C37000-memory.dmp

Filesize
92KB

Download
memory/1448-189-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1448-188-0x0000000003C30000-0x0000000003C47000-memory.dmp

Filesize
92KB

Download
memory/1448-167-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1448-186-0x0000000003C30000-0x0000000003C47000-memory.dmp

Filesize
92KB

Download
memory/1532-145-0x0000000003350000-0x0000000003367000-memory.dmp

Filesize
92KB

Download
memory/1532-143-0x0000000003350000-0x0000000003367000-memory.dmp

Filesize
92KB

Download
memory/1532-124-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1532-144-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1536-278-0x0000000003D70000-0x0000000003D87000-memory.dmp

Filesize
92KB

Download
memory/1536-276-0x0000000003D70000-0x0000000003D87000-memory.dmp

Filesize
92KB

Download
memory/1536-279-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1536-277-0x0000000003D70000-0x0000000003D87000-memory.dmp

Filesize
92KB

Download
memory/1536-261-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1872-211-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1872-229-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1872-228-0x0000000003400000-0x0000000003417000-memory.dmp

Filesize
92KB

Download
memory/1872-227-0x0000000003400000-0x0000000003417000-memory.dmp

Filesize
92KB

Download
memory/2224-11-0x00000000035A0000-0x00000000035B7000-memory.dmp

Filesize
92KB

Download
memory/2224-20-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2224-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2408-102-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2408-83-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2408-100-0x00000000031F0000-0x0000000003207000-memory.dmp

Filesize
92KB

Download
memory/2560-47-0x00000000033D0000-0x00000000033E7000-memory.dmp

Filesize
92KB

Download
memory/2560-60-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2560-58-0x0000000003730000-0x0000000003747000-memory.dmp

Filesize
92KB

Download
memory/2560-39-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2752-207-0x0000000003710000-0x0000000003727000-memory.dmp

Filesize
92KB

Download
memory/2752-190-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2752-262-0x0000000003710000-0x0000000003727000-memory.dmp

Filesize
92KB

Download
memory/2752-208-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2988-40-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2988-37-0x0000000003D60000-0x0000000003D77000-memory.dmp

Filesize
92KB

Download
memory/3044-210-0x0000000003B30000-0x0000000003B47000-memory.dmp

Filesize
92KB

Download
memory/3044-165-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3044-166-0x0000000003B30000-0x0000000003B47000-memory.dmp

Filesize
92KB

Download
memory/3044-146-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3044-163-0x0000000003B20000-0x0000000003B37000-memory.dmp

Filesize
92KB

Download