934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
Size

26KB
MD5

018bb372281ce4f7e8a92a3d76007b19
SHA1

697cce925b43cb4729a2fe8e99e8cbb526db1b14
SHA256

934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60
SHA512

0ddaabfffe7afa118e6b50fe95bd9df4e7bdb07c0f967881fbe5f83cf3ee725d4164086ad06f3c957c5bbb62e880f53b727a203ca795426149fec043221e4d03
SSDEEP

768:q71ODKAaDMG8H92RwZNQSw+JnbmQj3FZJ9Vs9XnsD:CfgLdQAQfwt7FZJ92Bs

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\R:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\Q:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\M:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\K:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\E:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\Z:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\X:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\T:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\P:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\O:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\H:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\W:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\U:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\S:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\N:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\L:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\J:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\I:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\V:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened (read-only)	\??\G:	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\Windows Mail\de-DE\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EURO\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\DVD Maker\es-ES\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Java\jre7\lib\amd64\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File created	C:\Program Files\Windows Defender\it-IT\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\_desktop.ini	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 760	2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe	31
PID 2316 wrote to memory of 760	2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe	31
PID 2316 wrote to memory of 760	2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe	31
PID 2316 wrote to memory of 760	2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe	31
PID 760 wrote to memory of 2840	760	net.exe	33
PID 760 wrote to memory of 2840	760	net.exe	33
PID 760 wrote to memory of 2840	760	net.exe	33
PID 760 wrote to memory of 2840	760	net.exe	33
PID 2316 wrote to memory of 1176	2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe	21
PID 2316 wrote to memory of 1176	2316	934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1176
- C:\Users\Admin\AppData\Local\Temp\934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe
  "C:\Users\Admin\AppData\Local\Temp\934ae507f1126e3aae3d9ff51ecaca6fbbbcc8c716ef2d0ea6b84ad67e346f60.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
06ab13543199f6bdec5d9811354e1b64

SHA1
1aecff8a4cb3d7ca4467b7817202a222f54042d6

SHA256
76c41c711043934762f2551e30d30484c5109582dfffc44dc2d8348ca438bc66

SHA512
270ee9e691b759ce4f8813460c21c0ddd968ba5f8e81c47fb2ede84bcaa5bcfa2a7d36b31ba3f3c922725b5f70b195be60cf16493cacfcc309e4f2442c4ac2e7

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
956KB

MD5
98e96a6853fc01c4e8ae847ac3b5f9d3

SHA1
2734a35b514c6443f39282b51ee67d92d7e96acd

SHA256
545ba66309b11e9ccfee5e7521cb9f516dfcb4a9ff31d0b11e1daae7a91528f4

SHA512
d0ac2d28f943acec835ac97e50581ab0f466a5b44bf641f61d2e76b51464b66b86e694dfce2ab79bb871c2ac122178b98a377a65559d92892118a325e3384040

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3450744190-3404161390-554719085-1000\_desktop.ini

Filesize
8B

MD5
62ed51082fc4fc1bd95074d15b55235d

SHA1
80c24bf5b2829be9d39199229ec9396e371f4080

SHA256
8aaff1179c8780f4fee8d0594a58b0c3a9e7b013a76908bd05dac636f7af1302

SHA512
19aecc53c5cebcecf9c5889e305e1129ebbdf42d1c414713aa2a4a98e8725ad156f6cd72562f7bb3001ee8d33ed8d5d47704f757001913117633b5151e6aeaf4

Download Submit
memory/1176-5-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/2316-67-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-162-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-1850-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-3170-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-3311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download