formbook | acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19

General

Target

6d7ada8915023eb188f47444a77d169d_JaffaCakes118.msi
Size

480KB
MD5

6d7ada8915023eb188f47444a77d169d
SHA1

f87023a7c0de6b0ff4b0b2b799e58f41b938c332
SHA256

acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19
SHA512

d37cf81df8f8dc64c5d5f0d68a2ad428b7d7d31658dd6980bc27db0d3dbc3ef44776012ea72feafc1c3348b0c9cd3599ce89168aa7edd992769dca26a98cc084
SSDEEP

12288:TEqy7sSW7kNUhBiTL1wuG2YVkp455oaomdIbTbq:TE5wzAQUTO/2SkpWon

Score

10^/10

formbook ai persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

ai

Decoy

theapschool.com

riseupfloridakeys.com

xn--mgbb2awa9dm20i.com

apnee-coach.com

christianmarketinggifts.com

eurothereum.biz

solutionfull.com

equifaxqsecurity2017.com

roboeye-tech.com

living-isar.immo

cable-online-zone.sale

parfumirza.com

civilizationsprice.com

zealasia.com

billet-bateau-tanger.com

andrewkurtsummers.net

darylandkaitlyn.com

ddaak.com

seattlepetadventures.com

iopuern.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2400-18-0x0000000000080000-0x00000000000AA000-memory.dmp	formbook

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msdt.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MJOXCFP0V8 = "C:\\Program Files (x86)\\L6lglbno\\igfx1bg.exe"	msdt.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

MSI4388.tmpMSI4388.tmpmsdt.exe

description	pid	process	target process
PID 2180 set thread context of 2400	2180	MSI4388.tmp	MSI4388.tmp
PID 2400 set thread context of 1204	2400	MSI4388.tmp	Explorer.EXE
PID 324 set thread context of 1204	324	msdt.exe	Explorer.EXE

Drops file in Program Files directory 1 IoCs

Processes:

msdt.exe

description ioc process

File opened for modification C:\Program Files (x86)\L6lglbno\igfx1bg.exe msdt.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\L6lglbno\igfx1bg.exe	msdt.exe

Drops file in Windows directory 10 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f76426d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4388.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f764270.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4347.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f76426d.msi	msiexec.exe
File created	C:\Windows\Installer\f764270.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 2 IoCs

Processes:

MSI4388.tmpMSI4388.tmp

pid process

2180 MSI4388.tmp
2400 MSI4388.tmp

pid	process
2180	MSI4388.tmp
2400	MSI4388.tmp

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

msdt.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1298544033-3225604241-2703760938-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	msdt.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

msiexec.exeMSI4388.tmpmsdt.exe

pid	process
1788	msiexec.exe
1788	msiexec.exe
2400	MSI4388.tmp
2400	MSI4388.tmp
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe
324	msdt.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

MSI4388.tmpmsdt.exe

pid process

2400 MSI4388.tmp
2400 MSI4388.tmp
2400 MSI4388.tmp
324 msdt.exe
324 msdt.exe

pid	process
2400	MSI4388.tmp
2400	MSI4388.tmp
2400	MSI4388.tmp
324	msdt.exe
324	msdt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exeMSI4388.tmpMSI4388.tmpExplorer.EXE

description	pid	process
Token: SeShutdownPrivilege	1632	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1788	msiexec.exe
Token: SeTakeOwnershipPrivilege	1788	msiexec.exe
Token: SeSecurityPrivilege	1788	msiexec.exe
Token: SeCreateTokenPrivilege	1632	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1632	msiexec.exe
Token: SeLockMemoryPrivilege	1632	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1632	msiexec.exe
Token: SeMachineAccountPrivilege	1632	msiexec.exe
Token: SeTcbPrivilege	1632	msiexec.exe
Token: SeSecurityPrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeLoadDriverPrivilege	1632	msiexec.exe
Token: SeSystemProfilePrivilege	1632	msiexec.exe
Token: SeSystemtimePrivilege	1632	msiexec.exe
Token: SeProfSingleProcessPrivilege	1632	msiexec.exe
Token: SeIncBasePriorityPrivilege	1632	msiexec.exe
Token: SeCreatePagefilePrivilege	1632	msiexec.exe
Token: SeCreatePermanentPrivilege	1632	msiexec.exe
Token: SeBackupPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeShutdownPrivilege	1632	msiexec.exe
Token: SeDebugPrivilege	1632	msiexec.exe
Token: SeAuditPrivilege	1632	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1632	msiexec.exe
Token: SeChangeNotifyPrivilege	1632	msiexec.exe
Token: SeRemoteShutdownPrivilege	1632	msiexec.exe
Token: SeUndockPrivilege	1632	msiexec.exe
Token: SeSyncAgentPrivilege	1632	msiexec.exe
Token: SeEnableDelegationPrivilege	1632	msiexec.exe
Token: SeManageVolumePrivilege	1632	msiexec.exe
Token: SeImpersonatePrivilege	1632	msiexec.exe
Token: SeCreateGlobalPrivilege	1632	msiexec.exe
Token: SeBackupPrivilege	796	vssvc.exe
Token: SeRestorePrivilege	796	vssvc.exe
Token: SeAuditPrivilege	796	vssvc.exe
Token: SeBackupPrivilege	1788	msiexec.exe
Token: SeRestorePrivilege	1788	msiexec.exe
Token: SeRestorePrivilege	2968	DrvInst.exe
Token: SeRestorePrivilege	2968	DrvInst.exe
Token: SeRestorePrivilege	2968	DrvInst.exe
Token: SeRestorePrivilege	2968	DrvInst.exe
Token: SeRestorePrivilege	2968	DrvInst.exe
Token: SeRestorePrivilege	2968	DrvInst.exe
Token: SeRestorePrivilege	2968	DrvInst.exe
Token: SeLoadDriverPrivilege	2968	DrvInst.exe
Token: SeLoadDriverPrivilege	2968	DrvInst.exe
Token: SeLoadDriverPrivilege	2968	DrvInst.exe
Token: SeRestorePrivilege	1788	msiexec.exe
Token: SeTakeOwnershipPrivilege	1788	msiexec.exe
Token: SeRestorePrivilege	1788	msiexec.exe
Token: SeTakeOwnershipPrivilege	1788	msiexec.exe
Token: SeRestorePrivilege	1788	msiexec.exe
Token: SeTakeOwnershipPrivilege	1788	msiexec.exe
Token: SeRestorePrivilege	1788	msiexec.exe
Token: SeTakeOwnershipPrivilege	1788	msiexec.exe
Token: SeDebugPrivilege	2180	MSI4388.tmp
Token: SeDebugPrivilege	2400	MSI4388.tmp
Token: SeRestorePrivilege	1788	msiexec.exe
Token: SeTakeOwnershipPrivilege	1788	msiexec.exe
Token: SeRestorePrivilege	1788	msiexec.exe
Token: SeTakeOwnershipPrivilege	1788	msiexec.exe
Token: SeShutdownPrivilege	1204	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1632 msiexec.exe
1632 msiexec.exe

pid	process
1632	msiexec.exe
1632	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

msiexec.exeMSI4388.tmpExplorer.EXEmsdt.exe

description	pid	process	target process
PID 1788 wrote to memory of 2180	1788	msiexec.exe	MSI4388.tmp
PID 1788 wrote to memory of 2180	1788	msiexec.exe	MSI4388.tmp
PID 1788 wrote to memory of 2180	1788	msiexec.exe	MSI4388.tmp
PID 1788 wrote to memory of 2180	1788	msiexec.exe	MSI4388.tmp
PID 2180 wrote to memory of 2400	2180	MSI4388.tmp	MSI4388.tmp
PID 2180 wrote to memory of 2400	2180	MSI4388.tmp	MSI4388.tmp
PID 2180 wrote to memory of 2400	2180	MSI4388.tmp	MSI4388.tmp
PID 2180 wrote to memory of 2400	2180	MSI4388.tmp	MSI4388.tmp
PID 2180 wrote to memory of 2400	2180	MSI4388.tmp	MSI4388.tmp
PID 2180 wrote to memory of 2400	2180	MSI4388.tmp	MSI4388.tmp
PID 2180 wrote to memory of 2400	2180	MSI4388.tmp	MSI4388.tmp
PID 1204 wrote to memory of 324	1204	Explorer.EXE	msdt.exe
PID 1204 wrote to memory of 324	1204	Explorer.EXE	msdt.exe
PID 1204 wrote to memory of 324	1204	Explorer.EXE	msdt.exe
PID 1204 wrote to memory of 324	1204	Explorer.EXE	msdt.exe
PID 324 wrote to memory of 3032	324	msdt.exe	cmd.exe
PID 324 wrote to memory of 3032	324	msdt.exe	cmd.exe
PID 324 wrote to memory of 3032	324	msdt.exe	cmd.exe
PID 324 wrote to memory of 3032	324	msdt.exe	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6d7ada8915023eb188f47444a77d169d_JaffaCakes118.msi
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1632
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\SysWOW64\msdt.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:324
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Installer\MSI4388.tmp"
    3⤵
    PID:3032

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\Installer\MSI4388.tmp
  "C:\Windows\Installer\MSI4388.tmp"
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\Installer\MSI4388.tmp
    "C:\Windows\Installer\MSI4388.tmp"
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B4" "00000000000004C0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f764271.rbs

Filesize
663B

MD5
8f6cf7c6018a74f7d728d99b2f0b97d3

SHA1
e36050935d81a39697f6c00f87e52c8b26b66563

SHA256
64f7a6f83df5d14fe1a8e81622a6b210190b0e70790aac35aa209447b730f47e

SHA512
580fc60a3994cb583e81087b60943106c212d9872f122e846f1964ada40f9634910f5f1b3a5762b53401eec877dea21584f983ec1cb37b43d8e0ff49d603dd05

Download Submit
C:\Windows\Installer\MSI4388.tmp

Filesize
453KB

MD5
fb6874156f7530ccaac5c0c8b4ab22ba

SHA1
8e70fa2fb16735594c961db602ccd965f7634122

SHA256
6e7119cc172059cedc3933aa66cfbe816196859a1bb87604ac8253ddebf85f8b

SHA512
56f131092278769526e5d8b784be32781d7c36cbdf14e535919ab654b5a5c9ae7d7734c6549e92bad18b3b5289f9b86a820daed2bdc18fc78392455dfefa1f90

Download Submit
memory/324-30-0x0000000000780000-0x0000000000874000-memory.dmp

Filesize
976KB

Download
memory/1204-44-0x0000000006640000-0x000000000677F000-memory.dmp

Filesize
1.2MB

Download
memory/2180-12-0x00000000001F0000-0x000000000026A000-memory.dmp

Filesize
488KB

Download
memory/2180-13-0x0000000001DF0000-0x0000000001E20000-memory.dmp

Filesize
192KB

Download
memory/2180-14-0x0000000001E20000-0x0000000001E3E000-memory.dmp

Filesize
120KB

Download
memory/2400-18-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads