cobaltstrike | 5747e9cd2cabeea85ad02e83ec4124c4461a20065d3a631340c155b2e4c8b121

General

Target

Project2.exe
Size

12KB
MD5

2e098fe6d840861abc61a0b542a0069b
SHA1

e4dd6bb202abb8defa8688fd122e979311a80a0b
SHA256

29c12e35c1942362bdb1e41cc45e65f51ec5f40a0b84c1406b56addf24d814bc
SHA512

46323dbfacb5e67012300b207d8143bdc227f679c37104feefa91e62845457683d63de2de3457359b701e3f919289ef66af1293c8d5c2e9a65312f626f5f3ab2
SSDEEP

96:QQJsYdT/L3YhpwbmTt7YJ/zUce6rsPX0zjQqeZ8CjRdGLj7jPrmFxe3Q5tfcsDJu:QYdTzI3OUe3SkjQxe3Q5tfFDA+Z2

Score

10^/10

cobaltstrike targetcompany backdoor evasion ransomware trojan

Malware Config

Extracted

Path

C:\HOW TO BACK FILES.txt

Family

targetcompany

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 1D074FC2E748BAA03A2E3E4E 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
ransomware targetcompany
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2892 bcdedit.exe
2712 bcdedit.exe
Renames multiple (7236) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

fkFSqdHI.exe

pid process

2800 fkFSqdHI.exe
Loads dropped DLL 2 IoCs

Processes:

Project2.exe

pid process

2980 Project2.exe
2980 Project2.exe

pid	process
2892	bcdedit.exe
2712	bcdedit.exe

pid	process
2800	fkFSqdHI.exe

pid	process
2980	Project2.exe
2980	Project2.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fkFSqdHI.exe

description	ioc	process
File opened (read-only)	\??\S:	fkFSqdHI.exe
File opened (read-only)	\??\W:	fkFSqdHI.exe
File opened (read-only)	\??\E:	fkFSqdHI.exe
File opened (read-only)	\??\G:	fkFSqdHI.exe
File opened (read-only)	\??\J:	fkFSqdHI.exe
File opened (read-only)	\??\Q:	fkFSqdHI.exe
File opened (read-only)	\??\P:	fkFSqdHI.exe
File opened (read-only)	\??\U:	fkFSqdHI.exe
File opened (read-only)	\??\D:	fkFSqdHI.exe
File opened (read-only)	\??\A:	fkFSqdHI.exe
File opened (read-only)	\??\M:	fkFSqdHI.exe
File opened (read-only)	\??\O:	fkFSqdHI.exe
File opened (read-only)	\??\X:	fkFSqdHI.exe
File opened (read-only)	\??\H:	fkFSqdHI.exe
File opened (read-only)	\??\K:	fkFSqdHI.exe
File opened (read-only)	\??\L:	fkFSqdHI.exe
File opened (read-only)	\??\R:	fkFSqdHI.exe
File opened (read-only)	\??\V:	fkFSqdHI.exe
File opened (read-only)	\??\Y:	fkFSqdHI.exe
File opened (read-only)	\??\Z:	fkFSqdHI.exe
File opened (read-only)	\??\B:	fkFSqdHI.exe
File opened (read-only)	\??\I:	fkFSqdHI.exe
File opened (read-only)	\??\N:	fkFSqdHI.exe
File opened (read-only)	\??\T:	fkFSqdHI.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 api.ipify.org

flow	ioc
12	api.ipify.org

Drops file in Program Files directory 64 IoCs

Processes:

fkFSqdHI.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00177_.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\ALARM.WAV	fkFSqdHI.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Boise	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\GRDEN_01.MID	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02298_.WMF	fkFSqdHI.exe
File created	C:\Program Files\Windows Journal\fr-FR\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar	fkFSqdHI.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02126_.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_COL.HXC	fkFSqdHI.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0144773.JPG	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0314068.JPG	fkFSqdHI.exe
File opened for modification	C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\OCEAN_01.MID	fkFSqdHI.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek	fkFSqdHI.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01182_.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00452_.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14692_.GIF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR48F.GIF	fkFSqdHI.exe
File created	C:\Program Files\Java\jre7\lib\amd64\HOW TO BACK FILES.txt	fkFSqdHI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\HOW TO BACK FILES.txt	fkFSqdHI.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png	fkFSqdHI.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386120.JPG	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\BUTTON.GIF	fkFSqdHI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia	fkFSqdHI.exe
File opened for modification	C:\Program Files\Java\jre7\lib\tzmappings	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01247U.BMP	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00005_.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02426_.WMF	fkFSqdHI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png	fkFSqdHI.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDREQ.CFG	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIcons.jpg	fkFSqdHI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01160_.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00233_.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01566_.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV.HXS	fkFSqdHI.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png	fkFSqdHI.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297551.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\HOW TO BACK FILES.txt	fkFSqdHI.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107134.WMF	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02208U.BMP	fkFSqdHI.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Thatch.xml	fkFSqdHI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Project2.exefkFSqdHI.exe

pid process

2980 Project2.exe
2980 Project2.exe
2800 fkFSqdHI.exe
2800 fkFSqdHI.exe

pid	process
2980	Project2.exe
2980	Project2.exe
2800	fkFSqdHI.exe
2800	fkFSqdHI.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

fkFSqdHI.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeDebugPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe
Token: SeTakeOwnershipPrivilege	2800	fkFSqdHI.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Project2.exefkFSqdHI.execmd.execmd.exe

description	pid	process	target process
PID 2980 wrote to memory of 2800	2980	Project2.exe	fkFSqdHI.exe
PID 2980 wrote to memory of 2800	2980	Project2.exe	fkFSqdHI.exe
PID 2980 wrote to memory of 2800	2980	Project2.exe	fkFSqdHI.exe
PID 2800 wrote to memory of 2772	2800	fkFSqdHI.exe	cmd.exe
PID 2800 wrote to memory of 2772	2800	fkFSqdHI.exe	cmd.exe
PID 2800 wrote to memory of 2772	2800	fkFSqdHI.exe	cmd.exe
PID 2800 wrote to memory of 2464	2800	fkFSqdHI.exe	cmd.exe
PID 2800 wrote to memory of 2464	2800	fkFSqdHI.exe	cmd.exe
PID 2800 wrote to memory of 2464	2800	fkFSqdHI.exe	cmd.exe
PID 2772 wrote to memory of 2892	2772	cmd.exe	bcdedit.exe
PID 2772 wrote to memory of 2892	2772	cmd.exe	bcdedit.exe
PID 2772 wrote to memory of 2892	2772	cmd.exe	bcdedit.exe
PID 2464 wrote to memory of 2712	2464	cmd.exe	bcdedit.exe
PID 2464 wrote to memory of 2712	2464	cmd.exe	bcdedit.exe
PID 2464 wrote to memory of 2712	2464	cmd.exe	bcdedit.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

fkFSqdHI.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	fkFSqdHI.exe

C:\Users\Admin\AppData\Local\Temp\Project2.exe
"C:\Users\Admin\AppData\Local\Temp\Project2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Public\fkFSqdHI.exe
  C:\Users\Public\fkFSqdHI.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2800
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2892
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HOW TO BACK FILES.txt

Filesize
1KB

MD5
238e44aa7c7079f6700b2da4301b72f8

SHA1
357fca9c0374c64103580cf4c6ba9600b02541b8

SHA256
18d42b77456dcd8991cc3e80c02532a2d1f389e6eeec804d41068c520aab319c

SHA512
44475c6c091444c6f1e676dd091a068f865fef46f632caf05d6404a0a67dc70a25bb87a5b0577f841a0f7bc218d11d043bb34f9c6eb9636a356ff078538f9569

Download Submit
C:\Users\Public\TargetInfo.txt

Filesize
84B

MD5
46ec5e5765bfea48c4f3384daade4051

SHA1
9c3ddbb1b32df22d7a28a01240a06907d081e739

SHA256
18b33e7c2b477ee114e5b6f6f2ce73131021856b9479ec3b30479982ee95907b

SHA512
ef5192f70e2bf49ac69e233f304c3ad7433b41a5764c8bc71eec14e51e8897c96eb451502983d98028cd7b4938b6f2933be6edd508d0f406fed467be99e0c557

Download Submit
\Users\Public\fkFSqdHI.exe

Filesize
484KB

MD5
0aab6bab5024b02b33b3a1ab6403a63b

SHA1
042571a56c890ec611c626602573dba953155512

SHA256
d6e3f6e93f95b70c8d5c4721cc1dbe09e9ae5eaa4b5a0fb7da1e1206ab601d0b

SHA512
2470de2c1ba96989bab3a61c96e8dbedc1b51ca72def312cd352a21e1abd5b4b003e624079241948c978fd51e0c1842eb56c931ffb4c34609b531e274cc7d07e

Download Submit
memory/2980-1-0x00000000001D0000-0x0000000000232000-memory.dmp

Filesize
392KB

Download
memory/2980-0-0x0000000000360000-0x00000000007D2000-memory.dmp

Filesize
4.4MB

Download
memory/2980-2-0x0000000000210000-0x0000000000212000-memory.dmp

Filesize
8KB

Download
memory/2980-3-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2980-4-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2980-1092-0x00000000001D0000-0x0000000000232000-memory.dmp

Filesize
392KB

Download
memory/2980-4450-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads