zgrat | 1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702

Analysis

max time kernel
150s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe
Size

1.9MB
MD5

2f12651489989cc02775433ade30799c
SHA1

e07f6c5cddc29edce812fa42724f07f565a7728f
SHA256

1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702
SHA512

ac42fbdf5425a4cfe37af4931a0fcb3733f74e7869b45fff7ba1bf1e8b33ffa8fe2b93980fc0a0d5b3b59e38e33a7cbc597fc28a22b9aa5afac7e29b14f2cd49
SSDEEP

49152:IBJunqwC2ZpjeWCeemRYiEtOCTpdBAeeAY:yOGqdeWx6iMOCTpded

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023bb6-10.dat	family_zgrat_v1
behavioral2/memory/2820-12-0x00000000005C0000-0x00000000007CC000-memory.dmp	family_zgrat_v1

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	2652	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	2652	schtasks.exe	91

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Detects executables packed with unregistered version of .NET Reactor 2 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023bb6-10.dat	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/memory/2820-12-0x00000000005C0000-0x00000000007CC000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	mscom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	mscom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	mscom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	mscom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	mscom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
2820	mscom.exe
1940	mscom.exe
1592	mscom.exe
4572	mscom.exe
1608	mscom.exe
768	mscom.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe	mscom.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\7e8dd1779e9b7a	mscom.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe	mscom.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\5b884080fd4f94	mscom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2884	schtasks.exe
4164	schtasks.exe
1760	schtasks.exe
4060	schtasks.exe
4896	schtasks.exe
2244	schtasks.exe
3364	schtasks.exe
4236	schtasks.exe
2332	schtasks.exe
3376	schtasks.exe
4176	schtasks.exe
748	schtasks.exe
2800	schtasks.exe
1624	schtasks.exe
3200	schtasks.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	mscom.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	mscom.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	mscom.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	mscom.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	mscom.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
4356	PING.EXE
4568	PING.EXE
1180	PING.EXE
2892	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe
2820	mscom.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	mscom.exe
Token: SeDebugPrivilege	1940	mscom.exe
Token: SeDebugPrivilege	1592	mscom.exe
Token: SeDebugPrivilege	4572	mscom.exe
Token: SeDebugPrivilege	1608	mscom.exe
Token: SeDebugPrivilege	768	mscom.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4468	4440	1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe	84
PID 4440 wrote to memory of 4468	4440	1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe	84
PID 4440 wrote to memory of 4468	4440	1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe	84
PID 4468 wrote to memory of 3068	4468	WScript.exe	88
PID 4468 wrote to memory of 3068	4468	WScript.exe	88
PID 4468 wrote to memory of 3068	4468	WScript.exe	88
PID 3068 wrote to memory of 2820	3068	cmd.exe	90
PID 3068 wrote to memory of 2820	3068	cmd.exe	90
PID 2820 wrote to memory of 1600	2820	mscom.exe	107
PID 2820 wrote to memory of 1600	2820	mscom.exe	107
PID 1600 wrote to memory of 3232	1600	cmd.exe	109
PID 1600 wrote to memory of 3232	1600	cmd.exe	109
PID 1600 wrote to memory of 1772	1600	cmd.exe	110
PID 1600 wrote to memory of 1772	1600	cmd.exe	110
PID 1600 wrote to memory of 1940	1600	cmd.exe	111
PID 1600 wrote to memory of 1940	1600	cmd.exe	111
PID 1940 wrote to memory of 4536	1940	mscom.exe	113
PID 1940 wrote to memory of 4536	1940	mscom.exe	113
PID 4536 wrote to memory of 3648	4536	cmd.exe	115
PID 4536 wrote to memory of 3648	4536	cmd.exe	115
PID 4536 wrote to memory of 4356	4536	cmd.exe	116
PID 4536 wrote to memory of 4356	4536	cmd.exe	116
PID 4536 wrote to memory of 1592	4536	cmd.exe	121
PID 4536 wrote to memory of 1592	4536	cmd.exe	121
PID 1592 wrote to memory of 1400	1592	mscom.exe	125
PID 1592 wrote to memory of 1400	1592	mscom.exe	125
PID 1400 wrote to memory of 2896	1400	cmd.exe	127
PID 1400 wrote to memory of 2896	1400	cmd.exe	127
PID 1400 wrote to memory of 4568	1400	cmd.exe	128
PID 1400 wrote to memory of 4568	1400	cmd.exe	128
PID 1400 wrote to memory of 4572	1400	cmd.exe	129
PID 1400 wrote to memory of 4572	1400	cmd.exe	129
PID 4572 wrote to memory of 4560	4572	mscom.exe	130
PID 4572 wrote to memory of 4560	4572	mscom.exe	130
PID 4560 wrote to memory of 4656	4560	cmd.exe	132
PID 4560 wrote to memory of 4656	4560	cmd.exe	132
PID 4560 wrote to memory of 1180	4560	cmd.exe	133
PID 4560 wrote to memory of 1180	4560	cmd.exe	133
PID 4560 wrote to memory of 1608	4560	cmd.exe	134
PID 4560 wrote to memory of 1608	4560	cmd.exe	134
PID 1608 wrote to memory of 3468	1608	mscom.exe	135
PID 1608 wrote to memory of 3468	1608	mscom.exe	135
PID 3468 wrote to memory of 752	3468	cmd.exe	137
PID 3468 wrote to memory of 752	3468	cmd.exe	137
PID 3468 wrote to memory of 2892	3468	cmd.exe	138
PID 3468 wrote to memory of 2892	3468	cmd.exe	138
PID 3468 wrote to memory of 768	3468	cmd.exe	139
PID 3468 wrote to memory of 768	3468	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe
"C:\Users\Admin\AppData\Local\Temp\1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\perfNet\3avxEvz443e8fK5hO0euPJUAURE3dMdoo4.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\perfNet\2Ry7Kk5ZsbIxjy4EHSdRm6lA5qf0cEB8qgrvpCqSPa.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\perfNet\mscom.exe
      "C:\perfNet/mscom.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zjvdTUSaeH.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1600
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3232
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1772
      - C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe
        
        "C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b9Anfm3pCF.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:4356
        
        C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe
        
        "C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2ERwRXGzbm.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2896
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:4568
        
        C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe
        
        "C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FbfnFz5COU.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4656
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:1180
        
        C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe
        
        "C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cO0v9X3fOA.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:2892
        
        C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe
        
        "C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\perfNet\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\perfNet\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\perfNet\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscomm" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscom" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscomm" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\mscom.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\perfNet\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\perfNet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\perfNet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mscom.exe.log

Filesize
1KB

MD5
9c46a6a79f6f8d9a9a8efa72b5cb18d3

SHA1
4f012a8af24f3959ecc97d4134d3bc2e91075d4a

SHA256
6fa59f5ba5e96afeb43feaf27ca49b6c250e38fb0a9dfbbb26857f8c787803cc

SHA512
4d691be464f14c1b8055cb2b53e84e0c3921e8419548df30d11550146672cd91764587b89169b5ed5c8d507163495b82d587c56386cc4a3e3465dde1d7ff598a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ERwRXGzbm.bat

Filesize
181B

MD5
14cea83da1f50d5b2b48f0b57271e26d

SHA1
b334f2bbb2a4eefe61e9d2034213ddd34fe67c20

SHA256
b6b2ee9bc4a27a36d2b64466ba7bda338d60741e7a2a0d88b8af8786377f9ef9

SHA512
235a9a9b0f9d4e3eb43e3d73ef78dc010b3c3cf4f768d104cf29a7af9b8f4c6842aedc1fd730f5febe1747a9d8bbdfcff22451da7f1d96f7215d874fc3b21c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\FbfnFz5COU.bat

Filesize
181B

MD5
ebb2128ddd93edc8a4c29004c6d00229

SHA1
5ed6cf8d9b86dd4a5f9f6c07046c11185213385c

SHA256
5414dfae3f9a4f4ff1b9207f755c661f7484ad77c1015b546b64127be1d10d0f

SHA512
a22a2aca6fadf622a4c8a89f1ea66dc94b874cf015bcb8eaa7a28465996edcfce74fba1845b5899b750faab16783ff11da87a5210f8e39e17b44e012ba1b5aaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\b9Anfm3pCF.bat

Filesize
181B

MD5
c29989cd3502a460eb66f0fcc344e3b3

SHA1
1ec8bfcc025a93a55112ff3b71b94727c2501774

SHA256
88188e4fdaabf13f1f329ff9c1024f7a2669c3a99fe591271fe31f668fc16f53

SHA512
aba3765122a818993acbacb213277ebfb2ce854e1617963ebd9b9abec38305c27820b12b314acf379e3169cac876855aae63ca8261a62d219c7ef1f371afa899

Download Submit
C:\Users\Admin\AppData\Local\Temp\cO0v9X3fOA.bat

Filesize
181B

MD5
332cba2795721c9b114749116eb6ce0e

SHA1
124532d3053d86d82d05036cefad6b0127012cc9

SHA256
2ab92d71021ba1ee9919129f29c09936b026e042c8179df5b033a48cf4870fd2

SHA512
4275cade7ca61ccf07ffe7a990eac23585cc08b9ea82ec67b2c8712241e62abc20cf6a4fc3f25a714d43ca4aee0af7623b831dd9d2bf11aa6544154dc085cbca

Download Submit
C:\Users\Admin\AppData\Local\Temp\zjvdTUSaeH.bat

Filesize
229B

MD5
4f8a13b47c90601ea8bdddd78952bed6

SHA1
98472e1b7c0edeee8da695af283e129b7adba535

SHA256
6657cc07853b8b7ebc8b8d33f20ef7698d36a22363734f38a80ef7a39ae5ff6f

SHA512
007f030683d0953ca10af1e06d2fe00ce3e35b890b3a10e88ad01767db0db8f8dc41a5862442da0938e61cb62c9638e3b4f856fcebe4e114e344a60b376e1945

Download Submit
C:\perfNet\2Ry7Kk5ZsbIxjy4EHSdRm6lA5qf0cEB8qgrvpCqSPa.bat

Filesize
80B

MD5
ec8794c7e2e95913910fbd015673af21

SHA1
b78fcf173a7c04c6e380f43f46994427ba34facb

SHA256
af0e1c35fb89eeb787d8a66e95850e16c3e4101c08bd405429e4818a878b2010

SHA512
b99cf41f8b4806397e2a17889b687a7b91366e917aaad00b2dd3fa1819fe0bef68699d01f9b14208ad76d35e9310e79c5137ceed58d9f5a1609ac89e7b36b730

Download Submit
C:\perfNet\3avxEvz443e8fK5hO0euPJUAURE3dMdoo4.vbe

Filesize
228B

MD5
93b1feeffa519c911b37d8f6b71a4365

SHA1
d09a173ce2653fe61efd5e35fcbc8ddc10f2218a

SHA256
3a47a541817337a14cd5873cf8c1cfb8f229ef192e92a657335cc90a896a738d

SHA512
1ddacbbec74946869ec67a1275866096f007443993909499e89b064e3adfee69f77f187578c6d55b86ec0820ecdbe08119b9899317c8e1e5202396240aeaeed2

Download Submit
C:\perfNet\mscom.exe

Filesize
2.0MB

MD5
9de6f58850c3f3e04cd1d7a836cf9094

SHA1
cd08f280a6a5b65fa96421b1111ba0e4a01e3ce0

SHA256
278b07211495ebf53014aeee5241b246a2aa5273e39150e625d9a6b9c04d419d

SHA512
ec5540950c861d5cb0e43d133e4c7376dae04b91afcae791f3fa4489fc8f5e9c65b55d9e34dd196ea8c715a4a72af96a98e93d31f52e63c81539b92fba5935e5

Download Submit
memory/2820-24-0x000000001B440000-0x000000001B452000-memory.dmp

Filesize
72KB

Download
memory/2820-22-0x00000000010B0000-0x00000000010BE000-memory.dmp

Filesize
56KB

Download
memory/2820-25-0x000000001BC10000-0x000000001C138000-memory.dmp

Filesize
5.2MB

Download
memory/2820-27-0x00000000028F0000-0x00000000028FC000-memory.dmp

Filesize
48KB

Download
memory/2820-29-0x0000000002900000-0x000000000290E000-memory.dmp

Filesize
56KB

Download
memory/2820-31-0x000000001B460000-0x000000001B46C000-memory.dmp

Filesize
48KB

Download
memory/2820-47-0x00007FFFD0EA0000-0x00007FFFD1961000-memory.dmp

Filesize
10.8MB

Download
memory/2820-20-0x000000001B420000-0x000000001B438000-memory.dmp

Filesize
96KB

Download
memory/2820-18-0x000000001B690000-0x000000001B6E0000-memory.dmp

Filesize
320KB

Download
memory/2820-17-0x000000001B400000-0x000000001B41C000-memory.dmp

Filesize
112KB

Download
memory/2820-15-0x00000000010A0000-0x00000000010AE000-memory.dmp

Filesize
56KB

Download
memory/2820-13-0x00007FFFD0EA0000-0x00007FFFD1961000-memory.dmp

Filesize
10.8MB

Download
memory/2820-12-0x00000000005C0000-0x00000000007CC000-memory.dmp

Filesize
2.0MB

Download