Analysis
-
max time kernel
124s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-06-2024 10:50
Behavioral task
behavioral1
Sample
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe
Resource
win10v2004-20240226-en
General
-
Target
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe
-
Size
2.5MB
-
MD5
6d97ecda69a3b949d29fe88d2f31d95d
-
SHA1
e6730ad822f7c91d3501a401aca1b1c323ca73cb
-
SHA256
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879
-
SHA512
4ba4460b9d3a8e1e8575efcfc1921186894f793e307b3c4b9cfc5c83a291b8cdb982c28fab25240124ead5f74fcf71ffc5c8310fcd7bac573aa1314486b9be72
-
SSDEEP
49152:MxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx5:Mxx9NUFkQx753uWuCyyx5
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Detects executables packed with Themida 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2860-2-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\Themes\explorer.exe INDICATOR_EXE_Packed_Themida behavioral1/memory/1996-12-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\spoolsv.exe INDICATOR_EXE_Packed_Themida behavioral1/memory/1996-22-0x00000000037B0000-0x0000000003DBE000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2572-24-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\svchost.exe INDICATOR_EXE_Packed_Themida behavioral1/memory/2476-36-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2860-42-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2640-44-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2640-49-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2572-51-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2860-53-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/1996-54-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2476-55-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/1996-67-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2476-74-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2476-80-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
spoolsv.exed68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exesvchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exesvchost.exespoolsv.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 1996 explorer.exe 2572 spoolsv.exe 2476 svchost.exe 2640 spoolsv.exe -
Loads dropped DLL 4 IoCs
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exesvchost.exepid process 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 1996 explorer.exe 2572 spoolsv.exe 2476 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/2860-2-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\Themes\explorer.exe themida behavioral1/memory/1996-12-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral1/memory/1996-22-0x00000000037B0000-0x0000000003DBE000-memory.dmp themida behavioral1/memory/2572-24-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\svchost.exe themida behavioral1/memory/2476-36-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2860-42-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2640-44-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2640-49-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2572-51-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2860-53-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/1996-54-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2476-55-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/1996-67-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2476-74-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2476-80-0x0000000000400000-0x0000000000A0E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe -
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 1996 explorer.exe 2572 spoolsv.exe 2476 svchost.exe 2640 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\resources\themes\explorer.exe d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2448 schtasks.exe 2900 schtasks.exe 856 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exesvchost.exepid process 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 1996 explorer.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 2476 svchost.exe 2476 svchost.exe 1996 explorer.exe 1996 explorer.exe 2476 svchost.exe 2476 svchost.exe 1996 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
svchost.exeexplorer.exepid process 2476 svchost.exe 1996 explorer.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe 1996 explorer.exe 1996 explorer.exe 2572 spoolsv.exe 2572 spoolsv.exe 2476 svchost.exe 2476 svchost.exe 2640 spoolsv.exe 2640 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 2860 wrote to memory of 1996 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe explorer.exe PID 2860 wrote to memory of 1996 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe explorer.exe PID 2860 wrote to memory of 1996 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe explorer.exe PID 2860 wrote to memory of 1996 2860 d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe explorer.exe PID 1996 wrote to memory of 2572 1996 explorer.exe spoolsv.exe PID 1996 wrote to memory of 2572 1996 explorer.exe spoolsv.exe PID 1996 wrote to memory of 2572 1996 explorer.exe spoolsv.exe PID 1996 wrote to memory of 2572 1996 explorer.exe spoolsv.exe PID 2572 wrote to memory of 2476 2572 spoolsv.exe svchost.exe PID 2572 wrote to memory of 2476 2572 spoolsv.exe svchost.exe PID 2572 wrote to memory of 2476 2572 spoolsv.exe svchost.exe PID 2572 wrote to memory of 2476 2572 spoolsv.exe svchost.exe PID 2476 wrote to memory of 2640 2476 svchost.exe spoolsv.exe PID 2476 wrote to memory of 2640 2476 svchost.exe spoolsv.exe PID 2476 wrote to memory of 2640 2476 svchost.exe spoolsv.exe PID 2476 wrote to memory of 2640 2476 svchost.exe spoolsv.exe PID 1996 wrote to memory of 2420 1996 explorer.exe Explorer.exe PID 1996 wrote to memory of 2420 1996 explorer.exe Explorer.exe PID 1996 wrote to memory of 2420 1996 explorer.exe Explorer.exe PID 1996 wrote to memory of 2420 1996 explorer.exe Explorer.exe PID 2476 wrote to memory of 2448 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 2448 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 2448 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 2448 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 2900 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 2900 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 2900 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 2900 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 856 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 856 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 856 2476 svchost.exe schtasks.exe PID 2476 wrote to memory of 856 2476 svchost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe"C:\Users\Admin\AppData\Local\Temp\d68a95d3261a2cab1f4df507df39b6a7911c67cc0333362fff36f01c23a3e879.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2640 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:52 /f5⤵
- Creates scheduled task(s)
PID:2448 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:53 /f5⤵
- Creates scheduled task(s)
PID:2900 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:54 /f5⤵
- Creates scheduled task(s)
PID:856 -
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2420
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD55441d975397d436a0141b7c5eb77d53c
SHA1bbff9a108ba557aa9c744952a1323c5946caaafe
SHA256fa46ab633e4750127647414897f0bd06221fd96046492a24ae8e269705c902bb
SHA512a26fac53c19491200b7d896580f166e084a89323967a4f6f4d89a5665c9b77737f04680be8e9f62dcd1106f500d7f20a974dea9eb332359ef7831cd83a44c55a
-
Filesize
2.5MB
MD5bdb049af53e374778511f7138abdb36e
SHA12f4882258edb7ec5781e85f163a8e9bc0cab2286
SHA256f8a31ce10f0748c9aa031d0eed50437d26cd40dacb57d045487c1e82ff98506d
SHA512cec53d225b6bc40d49de8c0e4f467820002b1128a89b655049559fa66611e62086357dcfacb59896bbfd83b7a0f130ec9605f860ff5311daf000218189c7a2d3
-
Filesize
2.5MB
MD57463708b2e1dee5374cbbe1fa79d6c0f
SHA1925aec9adb6d8049d6b4afd589d314e08b3fc208
SHA256a25f8b6475190e1818ebd5023f60bfd7d73394ca1376ce08f809596d081bf454
SHA512c55921eabd0a4e5881114a131d1d111ad3163f16f8a96849f7fa02c32c6e8c56440aeedc479e68e4eff657b084661a9596cc6106fadc53dfba3c1ed200b3798b