84bebbe2cc14519a656dd6ee54e892191872f7122ebf53ef6b2349a5218c11e1

Resubmissions

18-07-2024 07:25

240718-h84wjs1hpb 10

18-07-2024 07:19

240718-h51pqa1gng 10

17-07-2024 20:55

240717-zqkhmaydmq 10

17-07-2024 19:21

240717-x2pwdaycjb 10

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
Size

121KB
MD5

eac0a08470ee67c63b14ae2ce7f6aa61
SHA1

285c0163376d5d9a5806364411652fe73424d571
SHA256

fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7
SHA512

f3fd7eeae18843d049443f0d5e818302eb3b3f73ad85e26c01e1ddc0a102a0a22b065afe01879aafc95ff3a2d15b5c302394bd03d91e6c4401648cd4222bddc5
SSDEEP

1536:3THoX8wNjiMsyPcjgbKx534oU6Llg/iLBkZhifkdol9LYuVF5yZbn:DjksYKx5o3Slg/itMg8+LYu9ubn

Score

9^/10

defense_evasion evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2768	BC1C9B74EA.exe
2284	BC1C9B74EA.exe

Loads dropped DLL 2 IoCs

pid	Process
2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FF1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe\""	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\BC1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Roaming\\BC1C9B74EA.exe\""	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*BC1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Roaming\\BC1C9B74EA.exe\""	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FF1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Roaming\\BC1C9B74EA.exe\""	BC1C9B74EA.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	BC1C9B74EA.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2768 set thread context of 2284	2768	BC1C9B74EA.exe	63

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\_HELP_INSTRUCTION.TXT	BC1C9B74EA.exe
File opened for modification	C:\Program Files (x86)\_HELP_INSTRUCTION.TXT	BC1C9B74EA.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\_HELP_INSTRUCTION.TXT	BC1C9B74EA.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
340	sc.exe
2076	sc.exe
2856	sc.exe
2620	sc.exe
624	sc.exe
1784	sc.exe
536	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2072	vssadmin.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe:Zone.Identifier	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2040	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2948	vssvc.exe
Token: SeRestorePrivilege	2948	vssvc.exe
Token: SeAuditPrivilege	2948	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2736 wrote to memory of 2796	2736	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	30
PID 2796 wrote to memory of 2720	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	31
PID 2796 wrote to memory of 2720	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	31
PID 2796 wrote to memory of 2720	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	31
PID 2796 wrote to memory of 2720	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	31
PID 2796 wrote to memory of 2880	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	33
PID 2796 wrote to memory of 2880	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	33
PID 2796 wrote to memory of 2880	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	33
PID 2796 wrote to memory of 2880	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	33
PID 2796 wrote to memory of 2896	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	35
PID 2796 wrote to memory of 2896	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	35
PID 2796 wrote to memory of 2896	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	35
PID 2796 wrote to memory of 2896	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	35
PID 2720 wrote to memory of 2856	2720	cmd.exe	36
PID 2720 wrote to memory of 2856	2720	cmd.exe	36
PID 2720 wrote to memory of 2856	2720	cmd.exe	36
PID 2720 wrote to memory of 2856	2720	cmd.exe	36
PID 2880 wrote to memory of 2620	2880	cmd.exe	39
PID 2880 wrote to memory of 2620	2880	cmd.exe	39
PID 2880 wrote to memory of 2620	2880	cmd.exe	39
PID 2880 wrote to memory of 2620	2880	cmd.exe	39
PID 2796 wrote to memory of 2604	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	38
PID 2796 wrote to memory of 2604	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	38
PID 2796 wrote to memory of 2604	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	38
PID 2796 wrote to memory of 2604	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	38
PID 2896 wrote to memory of 624	2896	cmd.exe	42
PID 2896 wrote to memory of 624	2896	cmd.exe	42
PID 2896 wrote to memory of 624	2896	cmd.exe	42
PID 2896 wrote to memory of 624	2896	cmd.exe	42
PID 2796 wrote to memory of 2660	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	41
PID 2796 wrote to memory of 2660	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	41
PID 2796 wrote to memory of 2660	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	41
PID 2796 wrote to memory of 2660	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	41
PID 2604 wrote to memory of 1784	2604	cmd.exe	43
PID 2604 wrote to memory of 1784	2604	cmd.exe	43
PID 2604 wrote to memory of 1784	2604	cmd.exe	43
PID 2604 wrote to memory of 1784	2604	cmd.exe	43
PID 2796 wrote to memory of 264	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	45
PID 2796 wrote to memory of 264	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	45
PID 2796 wrote to memory of 264	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	45
PID 2796 wrote to memory of 264	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	45
PID 2660 wrote to memory of 536	2660	cmd.exe	46
PID 2660 wrote to memory of 536	2660	cmd.exe	46
PID 2660 wrote to memory of 536	2660	cmd.exe	46
PID 2660 wrote to memory of 536	2660	cmd.exe	46
PID 2796 wrote to memory of 1608	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	48
PID 2796 wrote to memory of 1608	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	48
PID 2796 wrote to memory of 1608	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	48
PID 2796 wrote to memory of 1608	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	48
PID 2796 wrote to memory of 2944	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	50
PID 2796 wrote to memory of 2944	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	50
PID 2796 wrote to memory of 2944	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	50
PID 2796 wrote to memory of 2944	2796	fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe	50
PID 264 wrote to memory of 340	264	cmd.exe	51

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
"C:\Users\Admin\AppData\Local\Temp\fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
  "C:\Users\Admin\AppData\Local\Temp\fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C sc stop VVS
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\SysWOW64\sc.exe
      sc stop VVS
      4⤵
      Launches sc.exe
      PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C sc stop wscsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\SysWOW64\sc.exe
      sc stop wscsvc
      4⤵
      Launches sc.exe
      PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C sc stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C sc stop wuauserv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:1784
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C sc stop BITS
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\sc.exe
      sc stop BITS
      4⤵
      Launches sc.exe
      PID:536
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C sc stop ERSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\Windows\SysWOW64\sc.exe
      sc stop ERSvc
      4⤵
      Launches sc.exe
      PID:340
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C sc stop WerSvc
    3⤵
    PID:1608
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WerSvc
      4⤵
      Launches sc.exe
      PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    PID:2944
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:2072
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe
    C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2768
  - - C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe
      C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:2284
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:2040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\_HELP_INSTRUCTION.TXT

Filesize
1KB

MD5
6e04bc8f308993e1e5f1f0531f564a75

SHA1
042f692829949c15e6df023c01511e9d4c6c5c10

SHA256
792c38d9c0c2a4f4b7aaef6ec331204e973f3f54b8b40233611c925c88e0e3f6

SHA512
357d6bb09397f42cc584851be7fd08bfb74f67e6aae632e5488a0531666907ef38401c4c05f8945ad80ff372a8c40708b4a3a9639cd7eaf5b3b3241279cb9c12

Download Submit
\Users\Admin\AppData\Roaming\BC1C9B74EA.exe

Filesize
121KB

MD5
eac0a08470ee67c63b14ae2ce7f6aa61

SHA1
285c0163376d5d9a5806364411652fe73424d571

SHA256
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7

SHA512
f3fd7eeae18843d049443f0d5e818302eb3b3f73ad85e26c01e1ddc0a102a0a22b065afe01879aafc95ff3a2d15b5c302394bd03d91e6c4401648cd4222bddc5

Download Submit
memory/2284-38-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-78-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-164-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-24-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-83-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-29-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-33-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-88-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-43-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-93-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-53-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-58-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-63-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-68-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-73-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-158-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-27-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-162-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-48-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-98-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-103-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-108-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-113-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-118-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-124-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-160-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-134-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-140-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-147-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2284-153-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2736-4-0x00000000002F6000-0x0000000000302000-memory.dmp

Filesize
48KB

Download
memory/2796-3-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2796-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2796-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads