Analysis
-
max time kernel
90s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-08-2024 06:09
Static task
static1
Behavioral task
behavioral1
Sample
7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95.exe
Resource
win11-20240802-en
General
-
Target
7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95.exe
-
Size
10.5MB
-
MD5
7fffe8702479239234bce6013bcad409
-
SHA1
ee7aaecaeff869350ead69c907b77d5b0afd3f09
-
SHA256
7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95
-
SHA512
8d5932d1fa8006c73e8576383425151439b4bf4637017f104a6c4e5cf202ce1c4a1dbec6d61adb794fd8a30c1300d6635d162df8630f9193c96239ec8b2a6869
-
SSDEEP
196608:F2f7uyka/QRjnlhNitMYQRs53WiJ4HO7tyc95Gwp+IUos1Ak+rqBdS4Kcm6PJ:F2FEj3omDRs9peutycqOye2H/KclPJ
Malware Config
Signatures
-
Detects Monster Stealer. 3 IoCs
resource yara_rule behavioral2/files/0x000600000002aa30-36.dat family_monster behavioral2/memory/4956-170-0x00007FF6BD640000-0x00007FF6BE666000-memory.dmp family_monster behavioral2/memory/4956-173-0x00007FF6BD640000-0x00007FF6BE666000-memory.dmp family_monster -
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2012 netsh.exe 2456 netsh.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 3532 cmd.exe 2100 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 4956 stub.exe -
Loads dropped DLL 33 IoCs
pid Process 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe 4956 stub.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 raw.githubusercontent.com 3 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
pid Process 3628 cmd.exe 4584 ARP.EXE -
Enumerates processes with tasklist 1 TTPs 4 IoCs
pid Process 1424 tasklist.exe 1120 tasklist.exe 4872 tasklist.exe 996 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 3664 cmd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3828 sc.exe -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral2/files/0x000100000002aa88-54.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3416 cmd.exe 2032 netsh.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 3080 NETSTAT.EXE -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 4020 WMIC.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 928 WMIC.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2352 ipconfig.exe 3080 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 840 systeminfo.exe -
Kills process with taskkill 1 IoCs
pid Process 2040 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2100 powershell.exe 2100 powershell.exe 2100 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 928 WMIC.exe Token: SeSecurityPrivilege 928 WMIC.exe Token: SeTakeOwnershipPrivilege 928 WMIC.exe Token: SeLoadDriverPrivilege 928 WMIC.exe Token: SeSystemProfilePrivilege 928 WMIC.exe Token: SeSystemtimePrivilege 928 WMIC.exe Token: SeProfSingleProcessPrivilege 928 WMIC.exe Token: SeIncBasePriorityPrivilege 928 WMIC.exe Token: SeCreatePagefilePrivilege 928 WMIC.exe Token: SeBackupPrivilege 928 WMIC.exe Token: SeRestorePrivilege 928 WMIC.exe Token: SeShutdownPrivilege 928 WMIC.exe Token: SeDebugPrivilege 928 WMIC.exe Token: SeSystemEnvironmentPrivilege 928 WMIC.exe Token: SeRemoteShutdownPrivilege 928 WMIC.exe Token: SeUndockPrivilege 928 WMIC.exe Token: SeManageVolumePrivilege 928 WMIC.exe Token: 33 928 WMIC.exe Token: 34 928 WMIC.exe Token: 35 928 WMIC.exe Token: 36 928 WMIC.exe Token: SeIncreaseQuotaPrivilege 3384 WMIC.exe Token: SeSecurityPrivilege 3384 WMIC.exe Token: SeTakeOwnershipPrivilege 3384 WMIC.exe Token: SeLoadDriverPrivilege 3384 WMIC.exe Token: SeSystemProfilePrivilege 3384 WMIC.exe Token: SeSystemtimePrivilege 3384 WMIC.exe Token: SeProfSingleProcessPrivilege 3384 WMIC.exe Token: SeIncBasePriorityPrivilege 3384 WMIC.exe Token: SeCreatePagefilePrivilege 3384 WMIC.exe Token: SeBackupPrivilege 3384 WMIC.exe Token: SeRestorePrivilege 3384 WMIC.exe Token: SeShutdownPrivilege 3384 WMIC.exe Token: SeDebugPrivilege 3384 WMIC.exe Token: SeSystemEnvironmentPrivilege 3384 WMIC.exe Token: SeRemoteShutdownPrivilege 3384 WMIC.exe Token: SeUndockPrivilege 3384 WMIC.exe Token: SeManageVolumePrivilege 3384 WMIC.exe Token: 33 3384 WMIC.exe Token: 34 3384 WMIC.exe Token: 35 3384 WMIC.exe Token: 36 3384 WMIC.exe Token: SeIncreaseQuotaPrivilege 928 WMIC.exe Token: SeSecurityPrivilege 928 WMIC.exe Token: SeTakeOwnershipPrivilege 928 WMIC.exe Token: SeLoadDriverPrivilege 928 WMIC.exe Token: SeSystemProfilePrivilege 928 WMIC.exe Token: SeSystemtimePrivilege 928 WMIC.exe Token: SeProfSingleProcessPrivilege 928 WMIC.exe Token: SeIncBasePriorityPrivilege 928 WMIC.exe Token: SeCreatePagefilePrivilege 928 WMIC.exe Token: SeBackupPrivilege 928 WMIC.exe Token: SeRestorePrivilege 928 WMIC.exe Token: SeShutdownPrivilege 928 WMIC.exe Token: SeDebugPrivilege 928 WMIC.exe Token: SeSystemEnvironmentPrivilege 928 WMIC.exe Token: SeRemoteShutdownPrivilege 928 WMIC.exe Token: SeUndockPrivilege 928 WMIC.exe Token: SeManageVolumePrivilege 928 WMIC.exe Token: 33 928 WMIC.exe Token: 34 928 WMIC.exe Token: 35 928 WMIC.exe Token: 36 928 WMIC.exe Token: SeDebugPrivilege 1424 tasklist.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4252 wrote to memory of 4956 4252 7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95.exe 81 PID 4252 wrote to memory of 4956 4252 7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95.exe 81 PID 4956 wrote to memory of 2468 4956 stub.exe 82 PID 4956 wrote to memory of 2468 4956 stub.exe 82 PID 4956 wrote to memory of 2084 4956 stub.exe 85 PID 4956 wrote to memory of 2084 4956 stub.exe 85 PID 4956 wrote to memory of 5008 4956 stub.exe 86 PID 4956 wrote to memory of 5008 4956 stub.exe 86 PID 4956 wrote to memory of 4100 4956 stub.exe 87 PID 4956 wrote to memory of 4100 4956 stub.exe 87 PID 4956 wrote to memory of 4460 4956 stub.exe 88 PID 4956 wrote to memory of 4460 4956 stub.exe 88 PID 2084 wrote to memory of 928 2084 cmd.exe 93 PID 2084 wrote to memory of 928 2084 cmd.exe 93 PID 5008 wrote to memory of 3384 5008 cmd.exe 94 PID 5008 wrote to memory of 3384 5008 cmd.exe 94 PID 4460 wrote to memory of 1424 4460 cmd.exe 95 PID 4460 wrote to memory of 1424 4460 cmd.exe 95 PID 4956 wrote to memory of 2164 4956 stub.exe 97 PID 4956 wrote to memory of 2164 4956 stub.exe 97 PID 2164 wrote to memory of 4412 2164 cmd.exe 99 PID 2164 wrote to memory of 4412 2164 cmd.exe 99 PID 4956 wrote to memory of 3136 4956 stub.exe 100 PID 4956 wrote to memory of 3136 4956 stub.exe 100 PID 4956 wrote to memory of 732 4956 stub.exe 101 PID 4956 wrote to memory of 732 4956 stub.exe 101 PID 732 wrote to memory of 1120 732 cmd.exe 148 PID 732 wrote to memory of 1120 732 cmd.exe 148 PID 3136 wrote to memory of 1376 3136 cmd.exe 143 PID 3136 wrote to memory of 1376 3136 cmd.exe 143 PID 4956 wrote to memory of 3664 4956 stub.exe 106 PID 4956 wrote to memory of 3664 4956 stub.exe 106 PID 3664 wrote to memory of 1896 3664 cmd.exe 108 PID 3664 wrote to memory of 1896 3664 cmd.exe 108 PID 4956 wrote to memory of 4856 4956 stub.exe 109 PID 4956 wrote to memory of 4856 4956 stub.exe 109 PID 4956 wrote to memory of 2632 4956 stub.exe 110 PID 4956 wrote to memory of 2632 4956 stub.exe 110 PID 4856 wrote to memory of 2008 4856 cmd.exe 113 PID 4856 wrote to memory of 2008 4856 cmd.exe 113 PID 2632 wrote to memory of 2040 2632 cmd.exe 114 PID 2632 wrote to memory of 2040 2632 cmd.exe 114 PID 4956 wrote to memory of 2276 4956 stub.exe 115 PID 4956 wrote to memory of 2276 4956 stub.exe 115 PID 4956 wrote to memory of 3532 4956 stub.exe 116 PID 4956 wrote to memory of 3532 4956 stub.exe 116 PID 4956 wrote to memory of 1608 4956 stub.exe 118 PID 4956 wrote to memory of 1608 4956 stub.exe 118 PID 4956 wrote to memory of 1676 4956 stub.exe 119 PID 4956 wrote to memory of 1676 4956 stub.exe 119 PID 2276 wrote to memory of 4872 2276 cmd.exe 123 PID 2276 wrote to memory of 4872 2276 cmd.exe 123 PID 1676 wrote to memory of 2932 1676 cmd.exe 124 PID 1676 wrote to memory of 2932 1676 cmd.exe 124 PID 1608 wrote to memory of 1224 1608 cmd.exe 125 PID 1608 wrote to memory of 1224 1608 cmd.exe 125 PID 3532 wrote to memory of 2100 3532 cmd.exe 126 PID 3532 wrote to memory of 2100 3532 cmd.exe 126 PID 4956 wrote to memory of 3416 4956 stub.exe 127 PID 4956 wrote to memory of 3416 4956 stub.exe 127 PID 4956 wrote to memory of 3628 4956 stub.exe 128 PID 4956 wrote to memory of 3628 4956 stub.exe 128 PID 3628 wrote to memory of 840 3628 cmd.exe 131 PID 3628 wrote to memory of 840 3628 cmd.exe 131 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1896 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95.exe"C:\Users\Admin\AppData\Local\Temp\7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\onefile_4252_133689533683312472\stub.exeC:\Users\Admin\AppData\Local\Temp\7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:2468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"3⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"3⤵PID:4100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"3⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer4⤵PID:4412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:1376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:1120
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"4⤵
- Views/modifies file attributes
PID:1896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"4⤵PID:2008
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
PID:2040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:4872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:2100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"3⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\system32\chcp.comchcp4⤵PID:1224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"3⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\system32\chcp.comchcp4⤵PID:2932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3416 -
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"3⤵
- Network Service Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:840
-
-
C:\Windows\system32\HOSTNAME.EXEhostname4⤵PID:956
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername4⤵
- Collects information from the system
PID:4020
-
-
C:\Windows\system32\net.exenet user4⤵PID:696
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user5⤵PID:2136
-
-
-
C:\Windows\system32\query.exequery user4⤵PID:1432
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"5⤵PID:4460
-
-
-
C:\Windows\system32\net.exenet localgroup4⤵PID:3680
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup5⤵PID:2260
-
-
-
C:\Windows\system32\net.exenet localgroup administrators4⤵PID:1620
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵PID:1376
-
-
-
C:\Windows\system32\net.exenet user guest4⤵PID:3636
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest5⤵PID:4972
-
-
-
C:\Windows\system32\net.exenet user administrator4⤵PID:3936
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator5⤵PID:1600
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command4⤵PID:1120
-
-
C:\Windows\system32\tasklist.exetasklist /svc4⤵
- Enumerates processes with tasklist
PID:996
-
-
C:\Windows\system32\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:2352
-
-
C:\Windows\system32\ROUTE.EXEroute print4⤵PID:2336
-
-
C:\Windows\system32\ARP.EXEarp -a4⤵
- Network Service Discovery
PID:4584
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano4⤵
- System Network Connections Discovery
- Gathers network information
PID:3080
-
-
C:\Windows\system32\sc.exesc query type= service state= all4⤵
- Launches sc.exe
PID:3828
-
-
C:\Windows\system32\netsh.exenetsh firewall show state4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2012
-
-
C:\Windows\system32\netsh.exenetsh firewall show config4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:4264
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4184
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:3920
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4156
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1System Information Discovery
4System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
Filesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
Filesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
Filesize
23KB
MD513aa3af9aed86cc917177ae1f41acc9b
SHA1f5d95679afda44a6689dbb45e93ebe0e9cd33d69
SHA25651dd1ea5e8cacf7ec4cadefdf685334c7725ff85978390d0b3d67fc8c54fe1db
SHA512e1f5dbd6c0afcf207de0100cba6f1344feb0006a5c12dc92768ab2d24e3312f0852f3cd31a416aafeb0471cd13a6c0408f0da62956f7870b2e22d174a8b23c45
-
Filesize
38KB
MD5d2bf6ca0df56379f1401efe347229dd2
SHA195c6a524a9b64ec112c32475f06a0821ff7e79c9
SHA25604d56d6aa727665802283b8adf9b873c1dd76dfc7265a12c0f627528ba706040
SHA512b4a2b9f71b156731aa071d13bf8dcffec4091d8d2fab47aea1ff47cd7abff13e28acf1d9456a97eb7a5723dbfa166fc63de11c63dc5cb63b13b4df9930390377
-
Filesize
34KB
MD5e16a71fc322a3a718aeaeaef0eeeab76
SHA178872d54d016590df87208518e3e6515afce5f41
SHA25651490359d8079232565187223517eca99e1ce55bc97b93cf966d2a5c1f2e5435
SHA512a9a7877aa77d000ba2dd7d96cf88a0e9afb6f6decb9530c1d4e840c270dd1805e73401266b1c8e17c1418effb823c1bd91b13f82dbfc6dba455940e3e644de54
-
Filesize
7.6MB
MD5b98d491ead30f30e61bc3e865ab72f18
SHA1db165369b7f2ae513b51c4f3def9ea2668268221
SHA25635d5aeb890b99e6bae3e6b863313fbc8a1a554acbcd416fe901b1e1ae2993c98
SHA512044c9c39bddb13020ed865d3aa30926460ae6ded5fdea59eca2b1cf6a4ded55728d883f19ee0749f95a4d93f66e04fcc62bc3be67119c4ccabd17b003cf5f3c4
-
Filesize
84KB
MD5911470750962640ceb3fd11e2aeecd14
SHA1af797451d4028841d92f771885cb9d81afba3f96
SHA2565c204f6966526af4dc0c0d6d29909b6f088c4fa781464f2948414d833b03094d
SHA512637043c20dc17fbc472613c0e4f576f0a2211b7916b3488806aec30271cf1bd84bd790518335b88910662fd4844f8ed39fa75aa278577271a966756b8cd793f7
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
45KB
MD5ddd4c0ae1e0d166c22449e9dcdca20d7
SHA1ff0e3d889b4e8bc43b0f13aa1154776b0df95700
SHA25674ec52418c5d38a63add94228c6f68cf49519666ae8bcb7ac199f7d539d8612c
SHA512c8464a77ba8b504ba9c7873f76499174095393c42dc85a9c1be2875c3661cda928851e37013e4ac95ba539eed984bf71c0fcc2cb599f3f0c4c1588d4a692bdfd
-
Filesize
1.4MB
MD5926dc90bd9faf4efe1700564aa2a1700
SHA1763e5af4be07444395c2ab11550c70ee59284e6d
SHA25650825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
SHA512a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556
-
Filesize
1.1MB
MD5102bbbb1f33ce7c007aac08fe0a1a97e
SHA19a8601bea3e7d4c2fa6394611611cda4fc76e219
SHA2562cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758
SHA512a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32
-
Filesize
93KB
MD58b4cd87707f15f838b5db8ed5b5021d2
SHA1bbc05580a181e1c03e0a53760c1559dc99b746fe
SHA256eefb46501ef97baf29a93304f58674e70f5ccecafb183f230e5ce7872a852f56
SHA5126768cff12fa22fe8540a3f6bdb350a5fcec0b2a0f01531458eb23f77b24460620cd400078fd1ec63738884c2b78920e428126833953c26b8dc8ad8b7c069415d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
62KB
MD56eb3c9fc8c216cea8981b12fd41fbdcd
SHA15f3787051f20514bb9e34f9d537d78c06e7a43e6
SHA2563b0661ef2264d6566368b677c732ba062ac4688ef40c22476992a0f9536b0010
SHA5122027707824d0948673443dd54b4f45bc44680c05c3c4a193c7c1803a1030124ad6c8fbe685cc7aaf15668d90c4cd9bfb93de51ea8db4af5abe742c1ef2dcd08b
-
Filesize
177KB
MD5ebb660902937073ec9695ce08900b13d
SHA1881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA25652e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA51219d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24
-
Filesize
60KB
MD549ce7a28e1c0eb65a9a583a6ba44fa3b
SHA1dcfbee380e7d6c88128a807f381a831b6a752f10
SHA2561be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430
SHA512cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9
-
Filesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
Filesize
47KB
MD57e6bd435c918e7c34336c7434404eedf
SHA1f3a749ad1d7513ec41066ab143f97fa4d07559e1
SHA2560606a0c5c4ab46c4a25ded5a2772e672016cac574503681841800f9059af21c4
SHA512c8bf4b1ec6c8fa09c299a8418ee38cdccb04afa3a3c2e6d92625dbc2de41f81dd0df200fd37fcc41909c2851ac5ca936af632307115b9ac31ec020d9ed63f157
-
Filesize
95KB
MD57f61eacbbba2ecf6bf4acf498fa52ce1
SHA13174913f971d031929c310b5e51872597d613606
SHA25685de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
SHA512a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a
-
Filesize
155KB
MD535f66ad429cd636bcad858238c596828
SHA1ad4534a266f77a9cdce7b97818531ce20364cb65
SHA25658b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA5121cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
-
Filesize
217KB
MD59642c0a5fb72dfe2921df28e31faa219
SHA167a963157ee7fc0c30d3807e8635a57750ca0862
SHA256580a004e93bed99820b1584dffaf0c4caa9fbbf4852ccded3b2b99975299367b
SHA512f84b7cde87186665a700c3017efcbcc6c19f5dc2c7b426d427dddbcbdec38b6189dd60ce03153fb14b6ea938d65aab99da33bda63b48e3e9ce9e5d3555b50a04
-
Filesize
22KB
MD59358095a5dc2d4b25fc1c416eea48d2d
SHA1faaee08c768e8eb27bc4b2b9d0bf63c416bb8406
SHA2564a5c9f8c3bca865df94ac93355e3ad492de03ae5fea41c1fa82fa4360c592ba5
SHA512c3d81ddbbe48a56530ea3e2500a78c396385f8ca820b3d71f8e5336ab0c6d484bc2b837ae0a2edb39d0fe24c37815f1b0ccfe25235197f1af19e936ddb41e594
-
Filesize
10KB
MD5f33ca57d413e6b5313272fa54dbc8baa
SHA14e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44
SHA2569b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664
SHA512f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32
-
Filesize
117KB
MD5494f5b9adc1cfb7fdb919c9b1af346e1
SHA14a5fddd47812d19948585390f76d5435c4220e6b
SHA256ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051
SHA5122c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
Filesize
15.9MB
MD51f4bbcf45463611b2321a428424e71ff
SHA1102b8883177489e69964822db3adc4bb3ddba2b5
SHA2561f0ad6f7003fbd3e3e8ebeb0e179ffd8b9ce43f0914b1041136c6603eaa6ebb2
SHA5123613d74999fd7eedbe73ddb63f65529475a432b9203fd86b0f88b45ebff0d2e9192b27ce1c24f4e42eaee0c331bfea34a90764482990b5f2424c0f980c50a44a