Overview
overview
10Static
static
1000260c390f...f8.exe
windows7-x64
1000260c390f...f8.exe
windows10-2004-x64
1001bf78841b...16.exe
windows7-x64
901bf78841b...16.exe
windows10-2004-x64
90545f842ca...49.exe
windows7-x64
100545f842ca...49.exe
windows10-2004-x64
10068ca3e92c...fd.exe
windows7-x64
10068ca3e92c...fd.exe
windows10-2004-x64
100b856337d9...c9.exe
windows7-x64
100b856337d9...c9.exe
windows10-2004-x64
100d38f8bf83...09.exe
windows7-x64
100d38f8bf83...09.exe
windows10-2004-x64
100e35a681fc...5e.exe
windows7-x64
100e35a681fc...5e.exe
windows10-2004-x64
100f178bc093...35.exe
windows7-x64
100f178bc093...35.exe
windows10-2004-x64
1010306702a1...dd.dll
windows7-x64
1010306702a1...dd.dll
windows10-2004-x64
10160c972897...21.exe
windows7-x64
10160c972897...21.exe
windows10-2004-x64
1019f7d53c4a...a0.exe
windows7-x64
1019f7d53c4a...a0.exe
windows10-2004-x64
101b109db549...18.exe
windows7-x64
101b109db549...18.exe
windows10-2004-x64
101e10e08cda...18.dll
windows7-x64
101e10e08cda...18.dll
windows10-2004-x64
101eb0b48ca7...1d.dll
windows7-x64
11eb0b48ca7...1d.dll
windows10-2004-x64
11f0e4cbc1a...7d.exe
windows7-x64
101f0e4cbc1a...7d.exe
windows10-2004-x64
10239c9969fd...90.exe
windows7-x64
10239c9969fd...90.exe
windows10-2004-x64
10Resubmissions
20-03-2024 09:55
240320-lxzn8sdh94 1020-03-2024 09:53
240320-lwzb3sef3x 1018-03-2024 09:01
240318-ky38dadf6s 10Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-03-2024 09:01
Behavioral task
behavioral1
Sample
00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049.exe
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
0d38f8bf831f1dbbe9a058930127171f24c3df8dae81e6aa66c430a63cbe0509.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
0d38f8bf831f1dbbe9a058930127171f24c3df8dae81e6aa66c430a63cbe0509.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
160c97289764c37afe1a11f72537e95843a9c37a9c5fa02e1046f6b002315021.exe
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
160c97289764c37afe1a11f72537e95843a9c37a9c5fa02e1046f6b002315021.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
1b109db549dd0bf64cadafec575b5895690760c7180a4edbf0c5296766162f18.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
1b109db549dd0bf64cadafec575b5895690760c7180a4edbf0c5296766162f18.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
1eb0b48ca74c119b53d372de7d639f0bcb1337fb526347fb3b22f62214280e1d.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
1eb0b48ca74c119b53d372de7d639f0bcb1337fb526347fb3b22f62214280e1d.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
1f0e4cbc1a4b52b6d7e4188e4a835a904cf783c75db9a066df4201452bd9647d.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
1f0e4cbc1a4b52b6d7e4188e4a835a904cf783c75db9a066df4201452bd9647d.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
239c9969fd07e1701a129cfd033a11a93ee9e88e4df4f79b7c5c0dd5bba86390.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
239c9969fd07e1701a129cfd033a11a93ee9e88e4df4f79b7c5c0dd5bba86390.exe
Resource
win10v2004-20240226-en
General
-
Target
19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe
-
Size
959KB
-
MD5
fec0ba68b3118f490dbee9dc5cc382d4
-
SHA1
c5a76c237314d970fb5acfc118c1f1109d012704
-
SHA256
19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0
-
SHA512
4c202c11503607baa0fccc23223933eaf1ffe052607f46f3d596520ced90359d1bcf1369ce335d4b63de9c221cf137d6354ce88fead6e3164c54903c8e20f81c
-
SSDEEP
24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdMF:Ujrc2So1Ff+B3k796W
Malware Config
Extracted
C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2060 bcdedit.exe 208 bcdedit.exe -
Deletes itself 1 IoCs
pid Process 1208 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7866A3C0-E0E0-3A21-40E3-40AA4E080B68} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe\"" 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\windows\SysWOW64\AE664D.ico 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8E5B.tmp.bmp" 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs
pid Process 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\an01060_.wmf 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\config\modules\org-netbeans-modules-autoupdate-cli.xml 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jre7\lib\zi\asia\riyadh 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jre7\lib\zi\asia\tbilisi 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File created C:\program files\videolan\vlc\locale\hu\lc_messages\Restore-My-Files.txt 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\videolan\vlc\lua\sd\icecast.luac 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\windows sidebar\gadgets\rssfeeds.gadget\de-de\css\flyout.css 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\docked_black_moon-first-quarter.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0152890.wmf 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0287645.jpg 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\news11.poc 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\clock.gadget\drag.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\meta-inf\eclipse_.rsa 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_cn_5.5.0.165303.jar 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File created C:\program files\videolan\vlc\locale\nn\lc_messages\Restore-My-Files.txt 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\classic1.wmf 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\videolan\vlc\lua\meta\art\03_lastfm.luac 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0107090.wmf 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\person.gif 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\stationery\1033\seamarbl.jpg 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\babygirl\flower_trans_matte.wmv 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\zpdir9f.gif 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\pagesize\pgmn089.xml 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\calendar.gadget\fr-fr\css\calendar.css 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\windows sidebar\gadgets\cpu.gadget\images\dial.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\layeredtitles\layers.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\msaccess.dev_f_col.hxk 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\dgzip.dpv 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\pacific\fiji 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\cpu.gadget\logo.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\windows sidebar\gadgets\currency.gadget\images\graph_over.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File created C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue\Restore-My-Files.txt 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-execution.jar 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0239063.wmf 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File created C:\program files (x86)\microsoft office\document themes 14\theme fonts\Restore-My-Files.txt 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File created C:\program files\microsoft games\hearts\en-us\Restore-My-Files.txt 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\windows sidebar\gadgets\calendar.gadget\images\month.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\pe00478_.wmf 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\zpdir4b.gif 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jre7\lib\zi\america\porto_velho 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\windows mail\fr-fr\winmail.exe.mui 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\lines\bd21323_.gif 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\images\daisies.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\resource\typesupport\unicode\mappings\mac\romanian.txt 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\tr00494_.wmf 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\onintl.dll.idx_dll 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\pdir28f.gif 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_earthy.gif 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\windows sidebar\gadgets\calendar.gadget\images\bprev-down.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\pets\scenes_intro_bg.wmv 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jre7\lib\zi\africa\monrovia 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\in00118_.wmf 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formsblankpage.html 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\windows sidebar\gadgets\rssfeeds.gadget\de-de\css\settings.css 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\pdir49b.gif 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\air98.poc 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\weather.gadget\images\120dpi\(120dpi)greenstateicon.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\cloud_thumbnail.bmp 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\na00487_.wmf 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File created C:\program files (x86)\microsoft office\templates\1033\access\datatype\Restore-My-Files.txt 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\circle_selectionsubpicturea.png 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2384 vssadmin.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\WallpaperStyle = "2" 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\TileWallpaper = "0" 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \Registry\Machine\Software\Classes\.lockbit 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\AE664D.ico" 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1548 PING.EXE -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe Token: SeDebugPrivilege 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe Token: SeBackupPrivilege 676 vssvc.exe Token: SeRestorePrivilege 676 vssvc.exe Token: SeAuditPrivilege 676 vssvc.exe Token: SeIncreaseQuotaPrivilege 2544 WMIC.exe Token: SeSecurityPrivilege 2544 WMIC.exe Token: SeTakeOwnershipPrivilege 2544 WMIC.exe Token: SeLoadDriverPrivilege 2544 WMIC.exe Token: SeSystemProfilePrivilege 2544 WMIC.exe Token: SeSystemtimePrivilege 2544 WMIC.exe Token: SeProfSingleProcessPrivilege 2544 WMIC.exe Token: SeIncBasePriorityPrivilege 2544 WMIC.exe Token: SeCreatePagefilePrivilege 2544 WMIC.exe Token: SeBackupPrivilege 2544 WMIC.exe Token: SeRestorePrivilege 2544 WMIC.exe Token: SeShutdownPrivilege 2544 WMIC.exe Token: SeDebugPrivilege 2544 WMIC.exe Token: SeSystemEnvironmentPrivilege 2544 WMIC.exe Token: SeRemoteShutdownPrivilege 2544 WMIC.exe Token: SeUndockPrivilege 2544 WMIC.exe Token: SeManageVolumePrivilege 2544 WMIC.exe Token: 33 2544 WMIC.exe Token: 34 2544 WMIC.exe Token: 35 2544 WMIC.exe Token: SeIncreaseQuotaPrivilege 2544 WMIC.exe Token: SeSecurityPrivilege 2544 WMIC.exe Token: SeTakeOwnershipPrivilege 2544 WMIC.exe Token: SeLoadDriverPrivilege 2544 WMIC.exe Token: SeSystemProfilePrivilege 2544 WMIC.exe Token: SeSystemtimePrivilege 2544 WMIC.exe Token: SeProfSingleProcessPrivilege 2544 WMIC.exe Token: SeIncBasePriorityPrivilege 2544 WMIC.exe Token: SeCreatePagefilePrivilege 2544 WMIC.exe Token: SeBackupPrivilege 2544 WMIC.exe Token: SeRestorePrivilege 2544 WMIC.exe Token: SeShutdownPrivilege 2544 WMIC.exe Token: SeDebugPrivilege 2544 WMIC.exe Token: SeSystemEnvironmentPrivilege 2544 WMIC.exe Token: SeRemoteShutdownPrivilege 2544 WMIC.exe Token: SeUndockPrivilege 2544 WMIC.exe Token: SeManageVolumePrivilege 2544 WMIC.exe Token: 33 2544 WMIC.exe Token: 34 2544 WMIC.exe Token: 35 2544 WMIC.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2904 wrote to memory of 1360 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 28 PID 2904 wrote to memory of 1360 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 28 PID 2904 wrote to memory of 1360 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 28 PID 2904 wrote to memory of 1360 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 28 PID 1360 wrote to memory of 2384 1360 cmd.exe 31 PID 1360 wrote to memory of 2384 1360 cmd.exe 31 PID 1360 wrote to memory of 2384 1360 cmd.exe 31 PID 1360 wrote to memory of 2544 1360 cmd.exe 34 PID 1360 wrote to memory of 2544 1360 cmd.exe 34 PID 1360 wrote to memory of 2544 1360 cmd.exe 34 PID 1360 wrote to memory of 2060 1360 cmd.exe 36 PID 1360 wrote to memory of 2060 1360 cmd.exe 36 PID 1360 wrote to memory of 2060 1360 cmd.exe 36 PID 1360 wrote to memory of 208 1360 cmd.exe 37 PID 1360 wrote to memory of 208 1360 cmd.exe 37 PID 1360 wrote to memory of 208 1360 cmd.exe 37 PID 2904 wrote to memory of 1208 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 39 PID 2904 wrote to memory of 1208 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 39 PID 2904 wrote to memory of 1208 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 39 PID 2904 wrote to memory of 1208 2904 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe 39 PID 1208 wrote to memory of 1548 1208 cmd.exe 41 PID 1208 wrote to memory of 1548 1208 cmd.exe 41 PID 1208 wrote to memory of 1548 1208 cmd.exe 41 PID 1208 wrote to memory of 1548 1208 cmd.exe 41 PID 1208 wrote to memory of 2208 1208 cmd.exe 42 PID 1208 wrote to memory of 2208 1208 cmd.exe 42 PID 1208 wrote to memory of 2208 1208 cmd.exe 42 PID 1208 wrote to memory of 2208 1208 cmd.exe 42 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe"C:\Users\Admin\AppData\Local\Temp\19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2384
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2060
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:208
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:1548
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe"3⤵PID:2208
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:676
Network
- No results found
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
-
52 B 1
-
-
52 B 1
-
52 B 1
-
-
52 B 1
-
-
-
52 B 1
-
-
52 B 1
-
52 B 1
-
-
52 B 1
-
-
-
52 B 1
-
-
-
52 B 1
-
-
-
-
-
52 B 1
-
-
-
-
52 B 1
-
-
-
52 B 1
-
-
-
-
-
52 B 1
-
-
-
52 B 1
-
-
-
-
-
52 B 1
-
-
-
52 B 1
-
-
-
-
-
52 B 1
-
-
-
52 B 1
-
-
-
-
-
52 B 1
-
-
-
52 B 1
-
-
-
-
-
52 B 1
-
-
-
52 B 1
-
-
-
-
-
52 B 1
-
-
-
52 B 1
-
-
-
-
-
52 B 1
-
-
-
52 B 1
-
-
-
-
-
-
-
52 B 1
-
-
-
52 B 1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5da3f97b33455966c7ac26af50fab124d
SHA1f89890a857f9fbca692d21e4d2ffc65be9ad6d0c
SHA2563e520be0f94253ed330351bd9eca4653bf9dcf9617d57155ae11de1d23def591
SHA5124c6b0f26dd8b7027dc60ef82023093a1aa3b35b1af5df02fd7bf44d4ff4e8ab7b2ff7741cc489f717423760d31c2d8c4badade9127993ee901238f84455e4769