Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
31.bin/1.exe
windows7-x64
101.bin/1.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102b5e50bc30...ba.dll
windows7-x64
102b5e50bc30...ba.dll
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
931.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
1042f9729255...1).exe
windows7-x64
1042f9729255...1).exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
106a9e7107c9...91.exe
windows7-x64
106a9e7107c9...91.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
1Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:03
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
1.bin/1.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
1.bin/1.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
31.exe
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
31.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240508-en
General
-
Target
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
-
Size
21KB
-
MD5
6fe3fb85216045fdf8186429c27458a7
-
SHA1
ef2c68d0b3edf3def5d90f1525fe87c2142e5710
-
SHA256
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
-
SHA512
d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c
-
SSDEEP
384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1
Malware Config
Extracted
revengerat
XDSDDD
84.91.119.105:333
RV_MUTEX-wtZlNApdygPh
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule C:\Windows\System32\MSSCS.exe revengerat -
Drops startup file 2 IoCs
Processes:
MSSCS.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe MSSCS.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe MSSCS.exe -
Executes dropped EXE 1 IoCs
Processes:
MSSCS.exepid process 2740 MSSCS.exe -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 4 IoCs
Processes:
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exeMSSCS.exedescription ioc process File created C:\Windows\system32\MSSCS.exe 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe File opened for modification C:\Windows\system32\MSSCS.exe 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe File opened for modification C:\Windows\system32\MSSCS.exe MSSCS.exe File created C:\Windows\system32\MSSCS.exe MSSCS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2800 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exeMSSCS.exepowershell.exedescription pid process Token: SeDebugPrivilege 1936 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe Token: SeDebugPrivilege 2740 MSSCS.exe Token: SeDebugPrivilege 2800 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exeMSSCS.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exedescription pid process target process PID 1936 wrote to memory of 2740 1936 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe MSSCS.exe PID 1936 wrote to memory of 2740 1936 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe MSSCS.exe PID 1936 wrote to memory of 2740 1936 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe MSSCS.exe PID 2740 wrote to memory of 2800 2740 MSSCS.exe powershell.exe PID 2740 wrote to memory of 2800 2740 MSSCS.exe powershell.exe PID 2740 wrote to memory of 2800 2740 MSSCS.exe powershell.exe PID 2740 wrote to memory of 1092 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 1092 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 1092 2740 MSSCS.exe vbc.exe PID 1092 wrote to memory of 936 1092 vbc.exe cvtres.exe PID 1092 wrote to memory of 936 1092 vbc.exe cvtres.exe PID 1092 wrote to memory of 936 1092 vbc.exe cvtres.exe PID 2740 wrote to memory of 808 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 808 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 808 2740 MSSCS.exe vbc.exe PID 808 wrote to memory of 1728 808 vbc.exe cvtres.exe PID 808 wrote to memory of 1728 808 vbc.exe cvtres.exe PID 808 wrote to memory of 1728 808 vbc.exe cvtres.exe PID 2740 wrote to memory of 1056 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 1056 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 1056 2740 MSSCS.exe vbc.exe PID 1056 wrote to memory of 1112 1056 vbc.exe cvtres.exe PID 1056 wrote to memory of 1112 1056 vbc.exe cvtres.exe PID 1056 wrote to memory of 1112 1056 vbc.exe cvtres.exe PID 2740 wrote to memory of 608 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 608 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 608 2740 MSSCS.exe vbc.exe PID 608 wrote to memory of 1236 608 vbc.exe cvtres.exe PID 608 wrote to memory of 1236 608 vbc.exe cvtres.exe PID 608 wrote to memory of 1236 608 vbc.exe cvtres.exe PID 2740 wrote to memory of 2988 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 2988 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 2988 2740 MSSCS.exe vbc.exe PID 2988 wrote to memory of 2092 2988 vbc.exe cvtres.exe PID 2988 wrote to memory of 2092 2988 vbc.exe cvtres.exe PID 2988 wrote to memory of 2092 2988 vbc.exe cvtres.exe PID 2740 wrote to memory of 1992 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 1992 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 1992 2740 MSSCS.exe vbc.exe PID 1992 wrote to memory of 1772 1992 vbc.exe cvtres.exe PID 1992 wrote to memory of 1772 1992 vbc.exe cvtres.exe PID 1992 wrote to memory of 1772 1992 vbc.exe cvtres.exe PID 2740 wrote to memory of 2016 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 2016 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 2016 2740 MSSCS.exe vbc.exe PID 2016 wrote to memory of 980 2016 vbc.exe cvtres.exe PID 2016 wrote to memory of 980 2016 vbc.exe cvtres.exe PID 2016 wrote to memory of 980 2016 vbc.exe cvtres.exe PID 2740 wrote to memory of 1972 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 1972 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 1972 2740 MSSCS.exe vbc.exe PID 1972 wrote to memory of 1076 1972 vbc.exe cvtres.exe PID 1972 wrote to memory of 1076 1972 vbc.exe cvtres.exe PID 1972 wrote to memory of 1076 1972 vbc.exe cvtres.exe PID 2740 wrote to memory of 1568 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 1568 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 1568 2740 MSSCS.exe vbc.exe PID 1568 wrote to memory of 1340 1568 vbc.exe cvtres.exe PID 1568 wrote to memory of 1340 1568 vbc.exe cvtres.exe PID 1568 wrote to memory of 1340 1568 vbc.exe cvtres.exe PID 2740 wrote to memory of 860 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 860 2740 MSSCS.exe vbc.exe PID 2740 wrote to memory of 860 2740 MSSCS.exe vbc.exe PID 860 wrote to memory of 884 860 vbc.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\MSSCS.exe"C:\Windows\system32\MSSCS.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lyjsyjs5.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52F1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc52F0.tmp"4⤵PID:936
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-i-be9o8.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES533F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc533E.tmp"4⤵PID:1728
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u-jhaoty.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53AD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc53AC.tmp"4⤵PID:1112
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ypyqhhvv.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5477.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5476.tmp"4⤵PID:1236
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lskkex_0.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc54D4.tmp"4⤵PID:2092
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1zamja9f.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5513.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5512.tmp"4⤵PID:1772
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f5bmxxzd.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5561.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5560.tmp"4⤵PID:980
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cwjbhch0.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55A0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc559F.tmp"4⤵PID:1076
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\soen1n2f.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55EE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc55ED.tmp"4⤵PID:1340
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tldpj8co.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES561D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc561C.tmp"4⤵PID:884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\-i-be9o8.0.vbFilesize
266B
MD5debab8fb1bbcbf74ca2ac313d4d5aa7d
SHA12a4058378b3df8ef9aa547d1511a425ef043d848
SHA2560f1d45b4fd6c36693c7d96bda036a41dccffa4313b92940df6ad180982607744
SHA5128beaad01c2f7541532842aca72324eeee7c582d50db2454bab3288dcb2922fdc1f2a0a3e2347a74e744e92c9f8304916c0f52a18754d2e3a5eb2fe6f9fbf6567
-
C:\Users\Admin\AppData\Local\Temp\-i-be9o8.cmdlineFilesize
166B
MD51034deabd99cf304a7163e423b77b86e
SHA1e2670353cd948eca348cca94eacc78dc864738a8
SHA256f0e3bdb3145c0695235093df830cb76d1274cec4a95fc26b7058a04d07da3849
SHA512d7e204e2098c25707fc0dd32c84cf24643e55c53d4290ddc3f10cbbed63e1503d1525668c4d6cc0a47e6a6d7ff3537aae7391eaa4bcff35e6ee25b7dbb24d84a
-
C:\Users\Admin\AppData\Local\Temp\1zamja9f.0.vbFilesize
290B
MD5ce1182df38f7b4c7a89d1e4d1886b0d8
SHA1ba5cdc6e13b761912d14ec042639566eebc23eca
SHA256e87616f590de6878e0a1051e52bb968d39bad4c7b086cdaecc064c6aa9582e3a
SHA5127be8358cbcefde4b1e1a28480eaea0daf5bbbd25aba3d1bd8c589bad3adb63a90551830efabc6e0d2b01a406e41e44c5797502abc88566694fbff7c2091e05a0
-
C:\Users\Admin\AppData\Local\Temp\1zamja9f.cmdlineFilesize
190B
MD593242973ed8e4242539699e7c598524e
SHA1883954155e8a41772dc467ea73751ab0d0ea75f2
SHA2564a88b76b3efb677cd61e7ea38f7a552a435392b452a25e44fd18f776f8dd2f6d
SHA512bad855014f06e9cd2f5b52c211c471d6212b08b9307b2fa21f4eee46e4c729a2e659a4770a9eb316990322e3513da8673f7d7c10e5418bfd2a8aa6d6566e24b9
-
C:\Users\Admin\AppData\Local\Temp\RES52F1.tmpFilesize
1KB
MD5b2a2a0f99b79361354ca369261aa1429
SHA16ff5739c5b40295086493e4f6718bd1191bf6535
SHA256b03c9277b108e7add17363a6665fc67a6351201b7051d0618db620fa6d13b4bb
SHA512c23a6a8758ba9165f5b35c750aecd734fb71a20c2a80c505e8fe9bc3ec97037792c1473105a7dbf15b98b716bea189650d0b30f5cb45463db8f47e889f320877
-
C:\Users\Admin\AppData\Local\Temp\RES533F.tmpFilesize
1KB
MD553f75cbdf21a223f18a874029c7b3b60
SHA127f6b3b56fe60d86e40f3c0a8603105c4f4ecf35
SHA256635e8b1e9703f9e94629e4fa2e865ca675c2f5d484d8057ac9e4b6eeba94cb56
SHA512967dd0c018a73b5615a6c7e562cf489f15b42d9e8bd2a6cbfe01a8288a3703f3f6eaf24c632439fd0344913cc3bddd9e53e0d9d0fef74fd8e6a942b573f62bcc
-
C:\Users\Admin\AppData\Local\Temp\RES53AD.tmpFilesize
1KB
MD5b0273b61700af533c95a33bf778dff59
SHA1feb5e856575bb7f4e5adc7069936c9114a6b8f32
SHA2565fb517c827d12d3d26842ffd81f57a065b4bc037b8f69abd9fbabe569c259dde
SHA512ab7785fd6a12fdb7e457af4a1dd864d103e873cf9a51b96be48b8f92548e74904523a6415c82e8926c53fc2000425e8447faaf12dbfe4b71fca128b013965e04
-
C:\Users\Admin\AppData\Local\Temp\RES5477.tmpFilesize
1KB
MD5293563a6dae14c4b6e5bd1171bb891ab
SHA1b43921fdb7c25c27ff2cdf843b6070cb1a45bdd2
SHA256da35c2679e11745ea8203a0c7c08e55734e94724b026ac9dac751afba740715f
SHA51227df081a218ac575c2c69d7c1626c8da5adc1424b55c3a61f1de07bd573f18d39b4afffdbfef038d49c68c11c81e7672d6cf5ff2643b3fb199444eedb8eb8be4
-
C:\Users\Admin\AppData\Local\Temp\RES54D5.tmpFilesize
1KB
MD5c62b3e8d4aff548e9080cbea88124337
SHA147624eb90c740864dbb7b56305fc1468572ede81
SHA25682aad6a42b228fb48b3e52e3ddaf477425afc6f52e79cd41c5c98f3138654d26
SHA512b462e00bac8ecc710c87f7a3bdb935896900074b97538df6af87bfa0b2b3e0d019c9c9139f80f881e9f53a72914d06fca381d510d1f3cf5e5cf35df2af17f245
-
C:\Users\Admin\AppData\Local\Temp\RES5513.tmpFilesize
1KB
MD54db782285b51297c865ea5de48976090
SHA1f83df90adaacaeea6b3844f422f7bac55cc5e997
SHA256b4e28423b53453812c685c5fbe5452adf22f3bc0c3d4037a5e2174e703fbef5c
SHA512b7a8a2a2db29cf2cd145138ef06647c2b63b0dbf906840637f4da7077c463b358518dd36e4651e471c717197adb78e87102c60461b56b64799e2ef6332defbca
-
C:\Users\Admin\AppData\Local\Temp\RES5561.tmpFilesize
1KB
MD5542d44aa9f1f2dc7d4b952a845185a02
SHA141fea6a31b259b600c1e1db3f203c836b1a8c731
SHA25649f0f389cb7ad954994a6225d90d38f529cae8db8d2d083bf5f8ce919aeaf773
SHA512a8b53a7dfef156fd4ead160b8bd7ee72b0cbda87acaf16158d6f224a2f0af8aa1adaa1b9d4a078c75b51ca73d481ee9c6dc2085cbb78f246b983240c3c8954c1
-
C:\Users\Admin\AppData\Local\Temp\RES55A0.tmpFilesize
1KB
MD5132b79cfb5aa4c11168d3b83e4a61e08
SHA1a2e766a3712475463923baab8c17176143eacfb3
SHA25609a637a6fe82d74325e502996f4b8c7ee265e23acaeb18afc6f7d8b8ba2ce71a
SHA512469b3f663acde7d482e922ce079b1a84257dc111538e779d71b5ec9cadcb96859b80d891a5df107bd963b9be0d94daec78fff2342964193c3d621e17df61257f
-
C:\Users\Admin\AppData\Local\Temp\RES55EE.tmpFilesize
1KB
MD5eac527779bdc6f3ebc6d37340a2de774
SHA188ac71a66b6111579f8e49820094906707f97052
SHA256bccfd09a926583c5fa515cf6fdfd5393bdd2cb60c4198c3c172db21624c0a1c3
SHA5123ef364b1d3cc26da066b7ed42e0b690c88e499769ad0fae3bfb8be52bdb3beddaab24979d93f4f9e54a431ee4bd87605e140e2e3e3a54517f5016b52e40470b8
-
C:\Users\Admin\AppData\Local\Temp\RES561D.tmpFilesize
1KB
MD55791b8ee9f7b8c10d51eeb5e14c8ad9d
SHA1c8bd4802f92f45fabaf3e20494d198ece0d3aa3e
SHA256781325368c8f9df877432e7f9ed3f2fd7527fe39bdd1465f66960f8738d400c9
SHA5128f4d4302ab0e50e4ca4c048aace8d9e6410e9c4b3378187bb740dce98de5825caf6bc71226490bf2fadc70586670dbc38e6ca274442aaec6670be636727e74da
-
C:\Users\Admin\AppData\Local\Temp\cwjbhch0.0.vbFilesize
264B
MD55ce3977a153152978fa71f8aa96909e9
SHA152af143c553c92afc257f0e0d556908eaa8919cb
SHA256e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed
SHA512eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77
-
C:\Users\Admin\AppData\Local\Temp\cwjbhch0.cmdlineFilesize
164B
MD537ab6cc02bcb935e211c534d410cc0eb
SHA1d72eca9e3027908115a5b03872b8ce1b41d2174a
SHA2566b0f7f22724eefb42b275502b4fda43bebff5e9d309cd7e94a9f249c29b3f2b2
SHA512fa2c71f13f1f20ddb1901a0997e6bbaa07bb9e575235de771809fc5c31b335100c8f46d4e759264e1705215491dbe5bbe1ba74901ab24a3f4b0154c9691ce3c2
-
C:\Users\Admin\AppData\Local\Temp\f5bmxxzd.0.vbFilesize
271B
MD5b19384e98248a2c238e2360d2fecf049
SHA125f5ab6303d0a81f4ef3cc44c0bb53dd3e564fad
SHA256296feb4019e37af5174b813d3ac19fa1b17c4db9ad91b06eba610939983e3262
SHA512e9e4dd4a302d643fd1d0dd46d058ca7a45c8e6d8b299c129e1a412d1d3309cfe4d4da6f9d893460dde7e96c40414d65e02dbab9c1411dd945581e749ae8438e4
-
C:\Users\Admin\AppData\Local\Temp\f5bmxxzd.cmdlineFilesize
171B
MD58b6236edabbc53d845f0fd7f6aadcf8e
SHA10390588d477de9c1002c411a44b22991a93ff2c3
SHA256475f84ae4d87fdf664e5966a4edfa52b1b3aa8cbaf79b1bf10575e18887defca
SHA512c6561692f33273272a0d5dd7c4f99b239bd32d6d29e1a6ca14d6f070847ee235fc2fe508d6edb79f5b0499e6b9638889c856a3a1dc31999b990a6e83ca4edf85
-
C:\Users\Admin\AppData\Local\Temp\lskkex_0.0.vbFilesize
271B
MD5ac972015bef75b540eb33503d6e28cc2
SHA15c1d09fcf4c719711532dcfd0544dfc6f2b90260
SHA256fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7
SHA51236b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83
-
C:\Users\Admin\AppData\Local\Temp\lskkex_0.cmdlineFilesize
171B
MD556861257055a37adb6be35b76f0d7457
SHA14fc3feaaee637e68ad859ae29a3624b1e6e89f70
SHA2566bd6caf989ba5883ac6dd41560ae3432267da75bf9d64e04ab93ae027ee7ae32
SHA5122e5cc40475d7da343957be93c3bd1ddcc4b7d862a3e103aa02f560917b32ba2fda805176bab1d2f3fc5f5fcb4a45a8b6e5ab86da26fb9379b9e896002a4fa4c1
-
C:\Users\Admin\AppData\Local\Temp\lyjsyjs5.0.vbFilesize
262B
MD588cc385da858aaa7057b54eaeb0df718
SHA1b108224d4686b5ca3faaeb1c728dfba8740a6eca
SHA25608a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020
SHA5124787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7
-
C:\Users\Admin\AppData\Local\Temp\lyjsyjs5.cmdlineFilesize
162B
MD5050ed15481f8218fd59545fb908b1ee1
SHA15967e7c1ab024aa4bdfd35e73d00a8a59c3c0a65
SHA25689d8f6505cf625877fea82e7f7b6f5309aa4366e415bebe8625a617073360e9f
SHA51251f461935ca76b341feda3d59a9fd6838306cc2cf97c440de53d756063c94519b2ecdf7c85b93b7b3c4ffcda256b32f8aa10f22d563a5353d2a87ddad7ea6c02
-
C:\Users\Admin\AppData\Local\Temp\soen1n2f.0.vbFilesize
270B
MD5658573fde2bebc77c740da7ddaa4634b
SHA1073da76c50b4033fcfdfb37ba6176afd77b0ea55
SHA256c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607
SHA512f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf
-
C:\Users\Admin\AppData\Local\Temp\soen1n2f.cmdlineFilesize
170B
MD52189166c97dd63b94f15b36b47556ba1
SHA1d16c5d259f23f5668370c507cd30047b00563af4
SHA25687e453f916a268d05892b2de40d891eafecf73e7b3021eba5f8af76f91ce3af1
SHA5123cea55801dfb647f8141e9723fcee24499582a713b9666256b5ca41a1bb65e0bf7a74e7ed75f5aa196bbdc4b47ba402abad33e7cd563d328883bef1939256c8c
-
C:\Users\Admin\AppData\Local\Temp\tldpj8co.0.vbFilesize
273B
MD53c3d3136aa9f1b87290839a1d26ad07a
SHA1005a23a138be5d7a98bdd4a6cc7fab8bdca962f4
SHA2565b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd
SHA512fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60
-
C:\Users\Admin\AppData\Local\Temp\tldpj8co.cmdlineFilesize
173B
MD56c80ae09b0cd2dcba5ab879641ea0fba
SHA1140726684e12ff0a5dcb32bb72083552ea793770
SHA25638e01aecade681fe7e213ee1eb60583f76ea5bdb4dfbdd0cc7980c8e736fa59a
SHA51269d58341df54456066ddb429fadf480543ae47abaaf493433a9f11405dfc62eaff422b5c6eed53de458bc1db6b9cf09fdd71f0cb07497243cf3ebec6f11b16a1
-
C:\Users\Admin\AppData\Local\Temp\u-jhaoty.0.vbFilesize
265B
MD5cbdf61e7858f1274d58258756e185765
SHA115f0d177b5924a5176ff82f0b79bfa3db558145c
SHA256d0aa53536d1316c420848db8bb089b24f9669f1baf3be092a7e0f0a0bc1b997d
SHA512ab21cbb170e38a2600db2587ce92b74499107e361d55bbcd5e6281568307ffb1c087aba905c042e2e8960e2e554c84057a197dc4c03121b682868def94c5a038
-
C:\Users\Admin\AppData\Local\Temp\u-jhaoty.cmdlineFilesize
165B
MD5de8da3492a0f0696070dcb85b0f94e47
SHA1f0cfb7e211fb5e4bd1ab9c608f45845da98c3229
SHA2568f9a890ca7b7e38808648055b9cf788ac6710808f52e1990db522d4ada64607e
SHA512e554efeec595e0c5816fc456660be8425bd0648ba12e7d5d044465995333ae1e261a8a70c24b58acd9e850b652cb15d0236ceaa7a3210fb96cea66a1bc2d01de
-
C:\Users\Admin\AppData\Local\Temp\vbc52F0.tmpFilesize
668B
MD53906bddee0286f09007add3cffcaa5d5
SHA10e7ec4da19db060ab3c90b19070d39699561aae2
SHA2560deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00
SHA5120a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0
-
C:\Users\Admin\AppData\Local\Temp\vbc533E.tmpFilesize
684B
MD541857ef7e71c255abd4d5d2a9174e1a6
SHA195051d6ae43ff1bd9e5ebc95aa2e7b7c3165cb6c
SHA256dfcdf12316f3b523895ec611d8e8d9fdc189ab8dde4e86fb962541aeac54e302
SHA512ec6c5a7729d273be3ff194ffe47056731ab4100e298b7f50108a2599be59c84bd1953a90c4d7390c477257986a18d336d951f590b782f1aa983de7bd4c86e6ac
-
C:\Users\Admin\AppData\Local\Temp\vbc53AC.tmpFilesize
684B
MD5453916f7e3952d736a473b0e2eea5430
SHA1b79ccb2b555a81b8db470ec9fcaea26d42ef1c8b
SHA256b0f8b94a35a12060c70e9f81641be22cbf1f1794c73260f48a2e6e46608623fe
SHA51286d32a03cf04ef8640075c82e5fecb23034413a41b80b81c900a423b03f44589f774f68f83561465e7c9ce46512c818eef5a90e5ed9f7b3f86b592be34fa367f
-
C:\Users\Admin\AppData\Local\Temp\vbc5476.tmpFilesize
700B
MD56ed26221ebae0c285cdced27b4e4dbac
SHA1452e9440a9c5b47a4f54aefdde36c08592e17a38
SHA256aacdfb10fa949c74577bb1778fe2f3bab88b3e587c07cfffb003e059097e9e6c
SHA512c604368a7b4adfbec5b6898c8880ea684bd085d967c1ebd087c9bed065fe3e2575c8298a9ccaa454d68496386667db998e2a04248dda2ab35905c8a9b1135cce
-
C:\Users\Admin\AppData\Local\Temp\vbc5512.tmpFilesize
748B
MD5b548259248343e12d417d6c938cf8968
SHA119703c388a51a7ff81a3deb6a665212be2e6589a
SHA256ab2ce0a14c78f836d2b134a37183b6d89a78b964ea5607940fa5d940d32a0366
SHA51273a3902f000a042a448446f6851d6ad61a30bfdfed7d7903b5dad0f368ee43cd6da3b8ba817ac95be1a7427902aba0642af8ccddc4d442867465f1f1f5bf6f81
-
C:\Users\Admin\AppData\Local\Temp\vbc5560.tmpFilesize
676B
MD5ba2c43095c1c82b8024e968d16bee036
SHA141ea006dbc9f0f6e80941d7547a980a1dde868e0
SHA2561209067183104b41f03a5be0f377dc1865155cc84bdb509b871b7ce3366aae72
SHA51200dc93cdb8c4cb0a681f99d24c59216a721bce963d76bad972e29cf92aafd74e4af46632c00f5aef4ce3160927db9df8aa9a8926ea4a5cb6974b499785569e61
-
C:\Users\Admin\AppData\Local\Temp\vbc559F.tmpFilesize
644B
MD5dac60af34e6b37e2ce48ac2551aee4e7
SHA1968c21d77c1f80b3e962d928c35893dbc8f12c09
SHA2562edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6
SHA5121f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084
-
C:\Users\Admin\AppData\Local\Temp\vbc561C.tmpFilesize
684B
MD57a707b422baa7ca0bc8883cbe68961e7
SHA1addf3158670a318c3e8e6fdd6d560244b9e8860e
SHA256453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c
SHA51281147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9
-
C:\Users\Admin\AppData\Local\Temp\ypyqhhvv.0.vbFilesize
269B
MD5d8ec3923c7b4bf7ae4ba2dd32ba5174f
SHA1bd232f852b5428b0360c9708604793deb513c36e
SHA256316f5f33d99324745cbdad4dfe3ece93321e270a177f3646d78d72d1f7a1d648
SHA512062694e7951b534e5c93d4d2e65c65cc59b9be7f3f1e469b1679d61e03f1770246222009461c6e2a8ddfe41fa367ed6ebd83f53e0a1c3f24db5e97932558ce11
-
C:\Users\Admin\AppData\Local\Temp\ypyqhhvv.cmdlineFilesize
169B
MD5fecde7c334913c7d8624de6f428d0ee0
SHA1c2650a674189f3013743ff7d5b16e00238577f25
SHA256dcf3d089cad705d1deb2a1d3502c5de515ac5baf9d1fbf6ae5de115e8e4141ee
SHA51256387363dc3c31958701fecc9d755fb776981dcb28b804bdb803d5f866aa74fb9b537a196d7f234160d771ec36059b4f79d46d66da2ae710d13a03777bfe49af
-
C:\Windows\System32\MSSCS.exeFilesize
21KB
MD56fe3fb85216045fdf8186429c27458a7
SHA1ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA256905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
SHA512d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c
-
memory/1936-0-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmpFilesize
4KB
-
memory/1936-1-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmpFilesize
9.6MB
-
memory/1936-3-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmpFilesize
9.6MB
-
memory/1936-2-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmpFilesize
9.6MB
-
memory/1936-12-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmpFilesize
9.6MB
-
memory/2740-11-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmpFilesize
9.6MB
-
memory/2740-13-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmpFilesize
9.6MB
-
memory/2800-25-0x000000001B4F0000-0x000000001B7D2000-memory.dmpFilesize
2.9MB
-
memory/2800-26-0x0000000002810000-0x0000000002818000-memory.dmpFilesize
32KB