hxxp://pdftoolpro[.]com/pdf?cid=KZBWsyvwPpiR36d&gclid=EAIaIQobChMI2KbDpbCChgMVEhyDAx0XNgLtEAEYASAAEgKlsfD_BwE

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://pdftoolpro.com/pdf?cid=KZBWsyvwPpiR36d&gclid=EAIaIQobChMI2KbDpbCChgMVEhyDAx0XNgLtEAEYASAAEgKlsfD_BwE

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 24 IoCs

pid	Process
1716	MsiExec.exe
4172	MsiExec.exe
4172	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
4172	MsiExec.exe
4172	MsiExec.exe
1716	MsiExec.exe
4172	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
4172	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4544	powershell.exe
1800	powershell.exe
2392	powershell.exe
5608	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3628	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3628	msiexec.exe
Token: SeShutdownPrivilege	3036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3036	msiexec.exe
Token: SeSecurityPrivilege	1964	msiexec.exe
Token: SeCreateTokenPrivilege	3628	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3628	msiexec.exe
Token: SeLockMemoryPrivilege	3628	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3628	msiexec.exe
Token: SeMachineAccountPrivilege	3628	msiexec.exe
Token: SeTcbPrivilege	3628	msiexec.exe
Token: SeSecurityPrivilege	3628	msiexec.exe
Token: SeTakeOwnershipPrivilege	3628	msiexec.exe
Token: SeLoadDriverPrivilege	3628	msiexec.exe
Token: SeSystemProfilePrivilege	3628	msiexec.exe
Token: SeSystemtimePrivilege	3628	msiexec.exe
Token: SeProfSingleProcessPrivilege	3628	msiexec.exe
Token: SeIncBasePriorityPrivilege	3628	msiexec.exe
Token: SeCreatePagefilePrivilege	3628	msiexec.exe
Token: SeCreatePermanentPrivilege	3628	msiexec.exe
Token: SeBackupPrivilege	3628	msiexec.exe
Token: SeRestorePrivilege	3628	msiexec.exe
Token: SeShutdownPrivilege	3628	msiexec.exe
Token: SeDebugPrivilege	3628	msiexec.exe
Token: SeAuditPrivilege	3628	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3628	msiexec.exe
Token: SeChangeNotifyPrivilege	3628	msiexec.exe
Token: SeRemoteShutdownPrivilege	3628	msiexec.exe
Token: SeUndockPrivilege	3628	msiexec.exe
Token: SeSyncAgentPrivilege	3628	msiexec.exe
Token: SeEnableDelegationPrivilege	3628	msiexec.exe
Token: SeManageVolumePrivilege	3628	msiexec.exe
Token: SeImpersonatePrivilege	3628	msiexec.exe
Token: SeCreateGlobalPrivilege	3628	msiexec.exe
Token: SeCreateTokenPrivilege	3036	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3036	msiexec.exe
Token: SeLockMemoryPrivilege	3036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3036	msiexec.exe
Token: SeMachineAccountPrivilege	3036	msiexec.exe
Token: SeTcbPrivilege	3036	msiexec.exe
Token: SeSecurityPrivilege	3036	msiexec.exe
Token: SeTakeOwnershipPrivilege	3036	msiexec.exe
Token: SeLoadDriverPrivilege	3036	msiexec.exe
Token: SeSystemProfilePrivilege	3036	msiexec.exe
Token: SeSystemtimePrivilege	3036	msiexec.exe
Token: SeProfSingleProcessPrivilege	3036	msiexec.exe
Token: SeIncBasePriorityPrivilege	3036	msiexec.exe
Token: SeCreatePagefilePrivilege	3036	msiexec.exe
Token: SeCreatePermanentPrivilege	3036	msiexec.exe
Token: SeBackupPrivilege	3036	msiexec.exe
Token: SeRestorePrivilege	3036	msiexec.exe
Token: SeShutdownPrivilege	3036	msiexec.exe
Token: SeDebugPrivilege	3036	msiexec.exe
Token: SeAuditPrivilege	3036	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3036	msiexec.exe
Token: SeChangeNotifyPrivilege	3036	msiexec.exe
Token: SeRemoteShutdownPrivilege	3036	msiexec.exe
Token: SeUndockPrivilege	3036	msiexec.exe
Token: SeSyncAgentPrivilege	3036	msiexec.exe
Token: SeEnableDelegationPrivilege	3036	msiexec.exe
Token: SeManageVolumePrivilege	3036	msiexec.exe
Token: SeImpersonatePrivilege	3036	msiexec.exe
Token: SeCreateGlobalPrivilege	3036	msiexec.exe
Token: SeCreateTokenPrivilege	3628	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3036	msiexec.exe
3628	msiexec.exe
3628	msiexec.exe
2796	msiexec.exe
5356	msiexec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1716	1964	msiexec.exe	117
PID 1964 wrote to memory of 1716	1964	msiexec.exe	117
PID 1964 wrote to memory of 1716	1964	msiexec.exe	117
PID 1964 wrote to memory of 4172	1964	msiexec.exe	118
PID 1964 wrote to memory of 4172	1964	msiexec.exe	118
PID 1964 wrote to memory of 4172	1964	msiexec.exe	118
PID 1964 wrote to memory of 2096	1964	msiexec.exe	121
PID 1964 wrote to memory of 2096	1964	msiexec.exe	121
PID 1964 wrote to memory of 2096	1964	msiexec.exe	121
PID 1716 wrote to memory of 1800	1716	MsiExec.exe	122
PID 1716 wrote to memory of 1800	1716	MsiExec.exe	122
PID 1716 wrote to memory of 1800	1716	MsiExec.exe	122
PID 4172 wrote to memory of 4544	4172	MsiExec.exe	123
PID 4172 wrote to memory of 4544	4172	MsiExec.exe	123
PID 4172 wrote to memory of 4544	4172	MsiExec.exe	123
PID 2096 wrote to memory of 2392	2096	MsiExec.exe	126
PID 2096 wrote to memory of 2392	2096	MsiExec.exe	126
PID 2096 wrote to memory of 2392	2096	MsiExec.exe	126
PID 1964 wrote to memory of 5432	1964	msiexec.exe	130
PID 1964 wrote to memory of 5432	1964	msiexec.exe	130
PID 1964 wrote to memory of 5432	1964	msiexec.exe	130
PID 5432 wrote to memory of 5608	5432	MsiExec.exe	131
PID 5432 wrote to memory of 5608	5432	MsiExec.exe	131
PID 5432 wrote to memory of 5608	5432	MsiExec.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pdftoolpro.com/pdf?cid=KZBWsyvwPpiR36d&gclid=EAIaIQobChMI2KbDpbCChgMVEhyDAx0XNgLtEAEYASAAEgKlsfD_BwE
1⤵
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5056 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4764 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2604 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5432 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=3700 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4724 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=4832 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4980 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=5460 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6968 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6968 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4020

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\FreePDF_48835996.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3036

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\FreePDF_48835996.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3628

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 18FDED95622A3DB1B5D63B8A91183A0D C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss44E2.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi4433.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr4453.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr4454.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C33C16A8B7B785DF699A1D109E8863D2 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss4494.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi4452.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr4463.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr4474.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4544
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4B144990093BEEA6DED8587B0F4B940B C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss4A70.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi4A4E.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr4A4F.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr4A50.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2392
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 68CA4EED70B2575F9E0F3986173D8CD4 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssD172.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiD150.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrD151.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrD162.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3720

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\FreePDF_48835996.msi"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2796

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /f "C:\Users\Admin\Downloads\FreePDF_48835996.msi"
1⤵
PID:5284

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\FreePDF_48835996.msi"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:5356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI394B.tmp

Filesize
759KB

MD5
a2317ebf66616e3b13218b2b9739cf74

SHA1
9fbdf90fb9d2bc93f025c16c94347eb817908d9d

SHA256
d6a3c9c614fa4491a1bd988d86687515e15edf7e0cfde2159d0850bf2c5c7c89

SHA512
8d11a2174e3ac7eefc776ff3d95ac65517c4af78f2880b84c6ce1ed65990e769cdbd5cc3d5755cc0dd9fc69a7c2408b32dde6205503f9a67ec96008c87b1f2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSICD0F.tmp

Filesize
738KB

MD5
d0c9613582605f3793fdad7279de428b

SHA1
8b3e9fb67c7beb20706544d360ee13c3aad9c1d1

SHA256
8bd84f1156ebdfa44afaac8a4579ba56a8c7513e3d51e00822167ea144923726

SHA512
3640a0f53730cad7323473f99a2049833db58eaed00f94b75b4a03b07cc8af99c104a40b2e888307055a5c9740b5fea4b394aa15bc78a3102088cc0770713eac

Download Submit
memory/1800-83-0x0000000004C70000-0x0000000004CA6000-memory.dmp

Filesize
216KB

Download
memory/5608-111-0x0000000004EF0000-0x0000000005518000-memory.dmp

Filesize
6.2MB

Download