629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
Size

126KB
MD5

1a73de756775fa022c8c9251c4321f8e
SHA1

7b0b30308e6aa293f932bdd960fa4d766a7ba89a
SHA256

629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e
SHA512

5552cf2565ec11c3416c735860665df75aeabaf4652c63d1ae9389b13197ca995a4cd7ebe654c9572be49f8a674e80900aca49f79b8bce07a0b4400e4e96891c
SSDEEP

3072:jEboFVlGAvwsgbpvYfMTc72L10fPsout6S:gBzsgbpvnTcyOPsoS6S

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2796	WmiPrvSE.exe

Executes dropped EXE 2 IoCs

pid	Process
1896	KVEIF.jpg
1104	KVEIF.jpg

Loads dropped DLL 5 IoCs

pid	Process
2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
2796	WmiPrvSE.exe
1896	KVEIF.jpg
1104	KVEIF.jpg
2432	svchost.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2104-2-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-5-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-11-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-9-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-7-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-3-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-13-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-15-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-17-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-19-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-21-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-29-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-27-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-25-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-23-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-31-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-33-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2104-32-0x0000000000220000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/2796-90-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-102-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-100-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-98-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-96-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-94-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-92-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-88-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-86-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-84-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-82-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-80-0x00000000007C0000-0x0000000000815000-memory.dmp	upx
behavioral1/memory/2796-79-0x00000000007C0000-0x0000000000815000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kernel64.dll	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
File opened for modification	C:\Windows\SysWOW64\kernel64.dll	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2104 set thread context of 2796	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe	30
PID 1104 set thread context of 2432	1104	KVEIF.jpg	35

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIF.jpg	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\FKC.WYA	KVEIF.jpg
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFs5.ini	KVEIF.jpg
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\$$.tmp	WmiPrvSE.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFs5.ini	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFmain.ini	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\FKC.WYA	KVEIF.jpg
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFs5.ini	WmiPrvSE.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIF.jpg	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFmain.ini	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\$$.tmp	WmiPrvSE.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIF.jpg	svchost.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFss1.ini	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\1D11C1F123.IMD	WmiPrvSE.exe
File created	C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg	WmiPrvSE.exe
File opened for modification	C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg	svchost.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\FKC.WYA	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFs1.ini	WmiPrvSE.exe
File opened for modification	C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg	WmiPrvSE.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\FKC.WYA	svchost.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\ok.txt	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\FKC.WYA	WmiPrvSE.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIF.jpg	WmiPrvSE.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\1D11C1F123.IMD	WmiPrvSE.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\1D11C1F123.IMD	KVEIF.jpg

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\web\606C646364636479.tmp	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
File opened for modification	C:\Windows\web\606C646364636479.tmp	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiPrvSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KVEIF.jpg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KVEIF.jpg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
1896	KVEIF.jpg
1104	KVEIF.jpg

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
1896	KVEIF.jpg
1896	KVEIF.jpg
1896	KVEIF.jpg
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
1104	KVEIF.jpg
1104	KVEIF.jpg
1104	KVEIF.jpg
2432	svchost.exe
2432	svchost.exe
2432	svchost.exe
2432	svchost.exe
2432	svchost.exe
2432	svchost.exe
2432	svchost.exe
2796	WmiPrvSE.exe
2432	svchost.exe
2796	WmiPrvSE.exe
2432	svchost.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2796	WmiPrvSE.exe
2432	svchost.exe
2432	svchost.exe
2432	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
Token: SeDebugPrivilege	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
Token: SeDebugPrivilege	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
Token: SeDebugPrivilege	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	1896	KVEIF.jpg
Token: SeDebugPrivilege	1896	KVEIF.jpg
Token: SeDebugPrivilege	1896	KVEIF.jpg
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	1104	KVEIF.jpg
Token: SeDebugPrivilege	1104	KVEIF.jpg
Token: SeDebugPrivilege	1104	KVEIF.jpg
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2432	svchost.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2796	WmiPrvSE.exe
Token: SeDebugPrivilege	2432	svchost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2796	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe	30
PID 2104 wrote to memory of 2796	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe	30
PID 2104 wrote to memory of 2796	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe	30
PID 2104 wrote to memory of 2796	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe	30
PID 2104 wrote to memory of 2796	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe	30
PID 2104 wrote to memory of 2796	2104	629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe	30
PID 1804 wrote to memory of 1896	1804	cmd.exe	32
PID 1804 wrote to memory of 1896	1804	cmd.exe	32
PID 1804 wrote to memory of 1896	1804	cmd.exe	32
PID 1804 wrote to memory of 1896	1804	cmd.exe	32
PID 1792 wrote to memory of 1104	1792	cmd.exe	34
PID 1792 wrote to memory of 1104	1792	cmd.exe	34
PID 1792 wrote to memory of 1104	1792	cmd.exe	34
PID 1792 wrote to memory of 1104	1792	cmd.exe	34
PID 1104 wrote to memory of 2432	1104	KVEIF.jpg	35
PID 1104 wrote to memory of 2432	1104	KVEIF.jpg	35
PID 1104 wrote to memory of 2432	1104	KVEIF.jpg	35
PID 1104 wrote to memory of 2432	1104	KVEIF.jpg	35
PID 1104 wrote to memory of 2432	1104	KVEIF.jpg	35
PID 1104 wrote to memory of 2432	1104	KVEIF.jpg	35

C:\Users\Admin\AppData\Local\Temp\629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
"C:\Users\Admin\AppData\Local\Temp\629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
  C:\Windows\System32\wbem\WmiPrvSE.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840 0
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2796

C:\Windows\system32\cmd.exe
cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg
  "C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1896

C:\Windows\system32\cmd.exe
cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg
  "C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840 0
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\1D11C1F123.IMD

Filesize
127KB

MD5
8d4ac7ffcf439607d17574a604890e70

SHA1
c812324bc4956b3dbc2dd9b36f7290c2e0e9f9a3

SHA256
f862f6daab8b1147c12c6a6b8bac84932e702a4d0f6b0bf050f5970085fd7861

SHA512
bcccef35517d5889f7e531aea0e74bbba5f76ad06ba16bd34e28693ffbeb193fec620bcd5a06d370814efea325bb438b4c9fe9314af4e9f57a9b3fa19afb4cfc

Download Submit
C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\FKC.WYA

Filesize
108KB

MD5
f697e0c5c1d34f00d1700d6d549d4811

SHA1
f50a99377a7419185fc269bb4d12954ca42b8589

SHA256
1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16

SHA512
d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

Download Submit
C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIF.jpg

Filesize
126KB

MD5
a75bec01179a4011ea8e5372e63fc5f4

SHA1
ead32741514fd4ca6391240b3e7c24ee9d2e414f

SHA256
72584ffcf77cf86cc6820881dea33ff2ce70c0d15e3c447b99c199d8fb2009b4

SHA512
0019bea4335ae81237b9d2ee2b9cff9189a84f5a60e7faf8577ab67dfa009ef50d4697e6c7caeb8dec52d1fef9151c31dbf850d4c7406f9e544bc0da8c406798

Download Submit
C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFmain.ini

Filesize
843B

MD5
11b38f0c6f553536ff74739ac23453de

SHA1
211f7a22e4466f4df5aa77211beb57d573b95709

SHA256
8ec48a8b83587fac06c348cf682693f9db3bbd7874e8ab94dcf4e6bbc0ab43d7

SHA512
a7d6a6d589a5e0d159b1c4a81e26afa56fcf4cf7f0d4cf143d150e7544805bfd47fbee5c7e5b74d32e8587ec359fb6264840c1e35c44df9a5774e38636169636

Download Submit
C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFss1.ini

Filesize
22B

MD5
2056c975629bc764596c2ba68ab3c6da

SHA1
35e3da93ce68d24c687e8c972f8fa2b903be75b8

SHA256
8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7

SHA512
c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae

Download Submit
C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\ok.txt

Filesize
104B

MD5
88e40d783f03a9e855d9d20eb269f6ad

SHA1
771c3e4a6355cfba3bb51a1af953b3273e9cf05f

SHA256
e1dcbd08aad543693a18973e233ad53a9f2eab2e15413d5110b64e0bed49a9bd

SHA512
480a9885d21fa7957ff89171965b6b7f35fd720d2d65aecb37d1a8eae1e21735867f7cebb867c8d7bad427c16f3cf15cbd1f6892c4bab0226919588849cf27b3

Download Submit
C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg

Filesize
126KB

MD5
41d4eab6f3b2f0c9f42a93252185c7f3

SHA1
0b6d597f1701e3849ed8ce9539d16fa83a663f84

SHA256
599946259944003b60473b346b22a0813ff5424f5032e968bddde2ec63c6ef32

SHA512
a203ba2a9334d0eae36b90ac95d9802049b415a2a256233c59149198350d2f48f2fec0becca2ef37b4a16f8020749f35b6ea79a9ddffbc0fc48cd1f006737c52

Download Submit
C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg

Filesize
126KB

MD5
e87edbfe1a1a9ce4a8e31bc30c957005

SHA1
796f82d3bde86185b5d041a768a77dcf0b91c260

SHA256
1081e48e42548597b84f6f9051a3ef32624643acbd4039b9df89c784bc395f66

SHA512
1de93c927c4f1bd0dac000ccd76365b74146e09b45e8c86e5c0950946a3f7056125d0cfc744109ceef4f6d4c6675a0d5f72de1d3856566332e52f62a931a6fe6

Download Submit
\Windows\SysWOW64\kernel64.dll

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
memory/2104-13-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-19-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-29-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-27-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-25-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-23-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-31-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-33-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-32-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-21-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-17-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-15-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-3-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-7-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-9-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-2-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-11-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2104-5-0x0000000000220000-0x0000000000275000-memory.dmp

Filesize
340KB

Download
memory/2796-72-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2796-100-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-98-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-96-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-94-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-92-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-88-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-86-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-84-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-82-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-80-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-79-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-102-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-90-0x00000000007C0000-0x0000000000815000-memory.dmp

Filesize
340KB

Download
memory/2796-78-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2796-76-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2796-75-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2796-168-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2796-71-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2796-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2796-253-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download