stormkitty | 150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
Size

227KB
MD5

1a83a244d9e90a4865aac14bc0e27052
SHA1

d2b65e7aed7657c9915f90f03d46902087479753
SHA256

150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712
SHA512

f4b9d26d8a0841f9425abf038f85563ddee65e2404bc508fd23c8023bb565fd7f0ceaeaadde49c4951d3bbbb93f6b64b3cf610464855a2bf2d418477dd4fe03f
SSDEEP

6144:YzJS6VlWn4bk0+GIKSppY6sdeZywNeGC4xIAY9F:YzdVlHbk0X5SpppMVwfI

Score

10^/10

stormkitty collection credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\Client.exe"	Client.exe

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x002a000000016d81-34.dat	family_stormkitty
behavioral1/memory/1264-36-0x0000000000070000-0x00000000000C6000-memory.dmp	family_stormkitty

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2332	powershell.exe
2656	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 3 IoCs

pid	Process
2972	Client.exe
2864	Launcher.exe
1264	zzzz.exe

Loads dropped DLL 3 IoCs

pid	Process
2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
2772	Process not Found
1252	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe"	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\zzzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzzz.exe"	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\WatchDog.exe"	Client.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\ProgramData\MVFYZPLM\FileGrabber\Pictures\desktop.ini	zzzz.exe
File created	C:\ProgramData\MVFYZPLM\FileGrabber\Desktop\desktop.ini	zzzz.exe
File created	C:\ProgramData\MVFYZPLM\FileGrabber\Documents\desktop.ini	zzzz.exe
File created	C:\ProgramData\MVFYZPLM\FileGrabber\Downloads\desktop.ini	zzzz.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	api.ipify.org
4	freegeoip.app
7	freegeoip.app
18	api.ipify.org
19	api.ipify.org
20	ip-api.com
22	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zzzz.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	zzzz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	zzzz.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Launcher.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2448	schtasks.exe
2224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2332	powershell.exe
2656	powershell.exe
1264	zzzz.exe
1264	zzzz.exe
1264	zzzz.exe
1264	zzzz.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
1996	WmiApSrv.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe
2972	Client.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2864	Launcher.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2972	Client.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	1264	zzzz.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2864	Launcher.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2332	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	29
PID 2472 wrote to memory of 2332	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	29
PID 2472 wrote to memory of 2332	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	29
PID 2472 wrote to memory of 2972	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	31
PID 2472 wrote to memory of 2972	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	31
PID 2472 wrote to memory of 2972	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	31
PID 2472 wrote to memory of 2864	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	32
PID 2472 wrote to memory of 2864	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	32
PID 2472 wrote to memory of 2864	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	32
PID 2472 wrote to memory of 2656	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	33
PID 2472 wrote to memory of 2656	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	33
PID 2472 wrote to memory of 2656	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	33
PID 2472 wrote to memory of 1264	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	37
PID 2472 wrote to memory of 1264	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	37
PID 2472 wrote to memory of 1264	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	37
PID 2472 wrote to memory of 1264	2472	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	37
PID 2972 wrote to memory of 2860	2972	Client.exe	38
PID 2972 wrote to memory of 2860	2972	Client.exe	38
PID 2972 wrote to memory of 2860	2972	Client.exe	38
PID 2860 wrote to memory of 2448	2860	CMD.exe	40
PID 2860 wrote to memory of 2448	2860	CMD.exe	40
PID 2860 wrote to memory of 2448	2860	CMD.exe	40
PID 2972 wrote to memory of 2592	2972	Client.exe	41
PID 2972 wrote to memory of 2592	2972	Client.exe	41
PID 2972 wrote to memory of 2592	2972	Client.exe	41
PID 2592 wrote to memory of 2224	2592	CMD.exe	43
PID 2592 wrote to memory of 2224	2592	CMD.exe	43
PID 2592 wrote to memory of 2224	2592	CMD.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe

C:\Users\Admin\AppData\Local\Temp\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
"C:\Users\Admin\AppData\Local\Temp\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Client.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Users\Admin\AppData\Local\Temp\Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Client.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2448
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2224
- C:\Users\Admin\AppData\Local\Temp\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zzzz.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\zzzz.exe
  "C:\Users\Admin\AppData\Local\Temp\zzzz.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1264

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MVFYZPLM\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Desktop\CopyLock.css

Filesize
453KB

MD5
ea57fc91ae24cfa5b37d7ab7ce42c9b4

SHA1
b1d274d56e2b54f79aa44c0c6b9f99ff14d7b9ea

SHA256
10ff0c57c1bbf52b5f1bf1e917db6262df84b4b814c228ce67b3f839e2e57384

SHA512
2d5a76a8d7357b6675aaafd8429af3b30616e8cea40433797ae85807ad2d064308513f20942be20f86e340929de6021fb03fc29b6a62f1be794558ad893bf5ac

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Desktop\DebugTest.ppt

Filesize
755KB

MD5
a71bdca67bb817662d1c4564f9674132

SHA1
24f19819c776be10e1126539031e0b8562e2eb47

SHA256
9d0c43aa63dda86161b9c6ea43c42d0cbcfa7eba3cae65e2ac2131ea371387e8

SHA512
3db961197f198aa72fdfe1da153f0359e779dedc915a15c0caffd75994e6cb223e0bb945fdcf27a7a501d58538941888f7a6580f15e546844b4e1bf2fdb86ca3

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Desktop\ExpandSubmit.html

Filesize
634KB

MD5
11fcd51a435f575134d3ddc496fb8829

SHA1
173fcb895392f9283db6385fffac1706512443ca

SHA256
45ef1c9b4c1a9cb7140dd1e3a9f82d285c500676c01a1cc67a0cd8976997e906

SHA512
c45a37b6cc756ac303a6e8f390bfbe514bb5e7c615a4038827752203dc5fd1b91dfca125b9ea0ee4403cd217299e6001602fd4907bec6b12d039cfd3c1e73b82

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Documents\ConnectWait.pdf

Filesize
252KB

MD5
d9add683aebe4e206aaa16deb685c5db

SHA1
1f687b98df14fc8120919f322b0a36c955a2cf1f

SHA256
175d57da3112813910d32ff680966c7b6650400e5cb6f4f8c0d69f13b9c3aa77

SHA512
803d741951394f39c7c666f376c91561eaf30e33936c7d30eb8028633057e492504f10f92578b02933ce5ecb750203b5022bbfb14bb74af24c4195570844b285

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Documents\DebugResolve.xls

Filesize
262KB

MD5
c9d6a473d035d36a24346ba22ae5a169

SHA1
27b7292c1efdcbc84fa0833898067197563bb604

SHA256
84308a8e60581462b322e2ba90ed559a12578d0b325006f573f7eb7753c5b2b5

SHA512
b3b36ecd02f36961a1afc9553991dd418f44f7659e0ef0c5856d99981a0de8818d4ac30477ed4fd9b42a9095ac00c2c990ed6d3cffc4b912ac3890caae81c89d

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Documents\EditConvertFrom.xlsx

Filesize
12KB

MD5
a021b0d07449b1a32c352ece7868dabc

SHA1
1a81ce29c1fd9971d1b46d2ab354e27146cbd4f6

SHA256
571a590bf32e7672c915579d18a9e9d92c3c2b45022c3440ef8b066d01cd0dca

SHA512
3c9e26357a8bd53181f4fd60a5aa3828a17e8425ed41db4ccc062a75dfe6afa6736d945205852d925bb81e45c3c3a9fb22e7b220a54ca7481b2dc749c375c104

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Documents\PopEnter.pdf

Filesize
216KB

MD5
aa95e274ca959c5824c36ec7fac069ed

SHA1
1b89b9d770de15a65321bf1812461524040d6b15

SHA256
0cd69bba5b824b45721f9f3c970ee51cd5d2db33ea8317a7c9d347ae3edf9f64

SHA512
10c52ca03f023235e713a5dfe094599b72d801c82238b7fbfdb21a6394f23ee1c7b8abb3b7476358e653f560cfe82d56e699e106890c1f451ba809a78aecdf15

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Documents\ResumeJoin.xlsx

Filesize
418KB

MD5
542c02c8ff226cf49302baa9ff2637fa

SHA1
2a9b6300244144f112371748b98ba76c750f4b02

SHA256
41504b846e325b1a7f58f2891aad3e966ab886a497854a8ee27abd24ada3a832

SHA512
8be27b951258c404ae47367fa5c2c2d85f4325fc8edaa8fb8166ab9315d3807473340552807d3a68d8fc7a32458f8b38a1d5f351dfdfcfebe7bb5a6c4d0800a4

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Documents\SearchConvertFrom.rtf

Filesize
436KB

MD5
604833e253baacfdbab4ac43bc2e3718

SHA1
15d27a70cd45d8579cc17ace0f1f8a926bab8d8d

SHA256
91a2a9b50b02e69bb9abfe70b21eab271d3b86361ff73676fcf0059b37da3821

SHA512
84772666045df4f6feaf345ae1d87bdf8d2f708353912fef15841ae0b3cc1df0f453daf0a0a5b5ad584be23766cbd83674d9b16a1aaab3ef56ce762af7a57df5

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Downloads\ApproveSwitch.pdf

Filesize
248KB

MD5
88b4547a92b3837b764229f2f0c27995

SHA1
c040da10e16e258d54eeac3215e3b3b8b56a77b1

SHA256
cd5ae38a7a476af095020f8ed086aed25ea61f060ac93e90599fb6965feec6b5

SHA512
2b52b9ca57fa92efce8bd4393e0178e2aa4ce55923fe3976a44ae41fd3234c9cb01fa804c6c58517407eb4940fd62047c0a4e5c8620ef9aae3893686b99c873f

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Downloads\DenySelect.txt

Filesize
533KB

MD5
aac37ac1b106cfe4a0ddea33cc30be2d

SHA1
a9519a64e2a0673a23f087a08ae05142410a7403

SHA256
a91e4b7680a8b6a1ba14b54636327d92f19b396b8a806f6504b313a6e21eca3c

SHA512
9c141c2d5161c444c2fe1a095f7f51e61cd5663e0b40a05aa3d1dc3e86ce227db9e84e21ef49536dc329837b3e50b1d527d96d2af2e3936d03c084f3a50eb78b

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Downloads\GrantUnlock.php

Filesize
426KB

MD5
b93c7adf8d2d9140683965e54e2355c7

SHA1
c4d7b8c13bc67e1466abef37108c5d623d4cabab

SHA256
af62a7dabd4868eafc41112b292e728baa18b777771c326503f499a0a89cf2e1

SHA512
2db1bcc6acda4ff2a6137932a10f2e2b24a984f8b88c52364e59f8e7fdfe682242b19e0cc1283b2b8dd2fd02542748a40e0b283fc3d1136a55fa7e27e18838f3

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Downloads\InvokeLock.ppt

Filesize
272KB

MD5
260bbe5fba583ddb5d07e20dc6ed8445

SHA1
289a13a3478de95715f92755c086bc76d733b699

SHA256
f27d2c47e67a33e6407db270eac71ba6da2bb0ed6288e5c8900ffae80377c827

SHA512
e52f8cafc1bf60f1508fc90a5a43d1f610f6fec162bca374aa54beb04c0f38f7c2e26065b824a38b1b48e8d38030d8b5ac8e0d8822bad2a173e61f56eae4325c

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Pictures\ApproveInitialize.svg

Filesize
367KB

MD5
ff99de647450febf761ee65c56e4ceb7

SHA1
63b3eca2db9881fcd62b0975bccb8af11e1f5b76

SHA256
fb83b08ebdbf8f3b237c96df81677f03c37319b18752173f710d7ac135c775a1

SHA512
4271b66ab074cd62a9d80ddb4295f064c10d0891b081dc04fe90ccde7205e4596d92443d8ef9c7bc10f3e800bf43f647e8a22b18abccecb624ccaf466bcb0ad0

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Pictures\ConnectResume.png

Filesize
477KB

MD5
8be08500f076d1a5336369af28c13ab7

SHA1
0c5b97611518ce96cdcd683d72045f9310f1f04d

SHA256
d3b874e1ed72974163299f29f8e944c57c486d33544b3ca14c1eb5452f4e9b3a

SHA512
c274cf33694b5944053ece0ecd76fc21480ac4c90866a4b26c44d745f53dd72d2aab1dcd8d833ddeb9f3eba100ba82250850af5da0a3195f916c22899b9d039b

Download Submit
C:\ProgramData\MVFYZPLM\FileGrabber\Pictures\DisableSave.jpeg

Filesize
519KB

MD5
6afe1c39a34c5190e5fc7a39767bff84

SHA1
597d608ec328bdfae726d760503f9fdedb52814c

SHA256
28809aac3a0d3c5a3e713e236dae92b561a969ee6f19278605cc5c84d37e93b5

SHA512
065748b31bf16b64e60071421a049676ff7937102e7b59807317b51998f221d76acaea65790c1c66c974d7c9e7c080a48b347fe1efedd9a4253479240fe5bc1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
100KB

MD5
21560cb75b809cf46626556cd5fbe3ab

SHA1
f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

SHA256
d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

SHA512
21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Launcher.exe

Filesize
22KB

MD5
4c8f3a1e15f370ca8afe2992902a6e98

SHA1
dc6324d924ac31bea4ad7e4dd6720ecdad3877dd

SHA256
dcdc72549f7ad41cc860738adbeee5e44f02222415fd84ed5c92538ac9049b92

SHA512
b63c4e48f3024edcf1e1391b5df6ff65fc5111849eb093b429fa0f21c03339dbaeff835f18e250758498f3432874b85348530e47b2ada93f6f68615a5ccf66c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zzzz.exe

Filesize
320KB

MD5
de4824c195cf1b2bb498511ef461e49b

SHA1
f15ca6d0e02c785cce091dbd716cd43e3f5a80bd

SHA256
51813dfedbe02f03d08b4728187eadb4948d8be40c9d8fe6e4e1cb61fa7ae209

SHA512
b211a636f2799d90ce38348dbbc7dbc69ac5374129c7896a137f03a57fe78139a030c1edb90cfc4203799d77a8720df431da75986aa1d8b16274030ad1db770a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3208f38bba6152a013f94e2e55b8c301

SHA1
3936870130647e8125790fbdf02e4347a3e74f99

SHA256
66820ea715c024e01e25584f186b7a0069f7e3449219be06b2d34e54865f7ea8

SHA512
8d8e95e48a2d7e8773ae2b8f6c931d8ec1b3aeaf513ae2182df00d208ffab2c53d89a11e2dccece237d9cde4b75476476e97dba953172e9aaa1a19a7458e344d

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/1264-36-0x0000000000070000-0x00000000000C6000-memory.dmp

Filesize
344KB

Download
memory/1996-289-0x000007FEF0080000-0x000007FEF00A2000-memory.dmp

Filesize
136KB

Download
memory/2332-7-0x000000001B180000-0x000000001B462000-memory.dmp

Filesize
2.9MB

Download
memory/2332-6-0x0000000002500000-0x0000000002580000-memory.dmp

Filesize
512KB

Download
memory/2332-8-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/2472-1-0x0000000000890000-0x00000000008D0000-memory.dmp

Filesize
256KB

Download
memory/2472-0-0x000007FEF6573000-0x000007FEF6574000-memory.dmp

Filesize
4KB

Download
memory/2656-26-0x000000001B350000-0x000000001B632000-memory.dmp

Filesize
2.9MB

Download
memory/2656-27-0x0000000001EB0000-0x0000000001EB8000-memory.dmp

Filesize
32KB

Download
memory/2864-28-0x0000000003A50000-0x0000000003A60000-memory.dmp

Filesize
64KB

Download
memory/2972-16-0x0000000000990000-0x00000000009B0000-memory.dmp

Filesize
128KB

Download