Overview

overview

10

Static

static

3

d63d9ff2bd...18.exe

windows7-x64

10

d63d9ff2bd...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    130s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d63d9ff2bd7aff47f5251088b6beb889_JaffaCakes118.exe

  • Size

    269KB

  • MD5

    d63d9ff2bd7aff47f5251088b6beb889

  • SHA1

    56f4e043301ad4c17296c8197991db2d4fd80bad

  • SHA256

    ff5fd162a7bcae95742ca98f67b4ff715dbb3d4887811bbb9dc8431c0b09db95

  • SHA512

    d7253fff1c3b2cd9660ae1265c0166b23b310690ba0a54bf44ae0717d60a787299c04574aab773ac99597e825cb4acde6ac56bdf61cc0d111adb09f2bc1dc01c

  • SSDEEP

    6144:wdlQFuqDtqObd9acR91QY7EgITgYEJvPUY:s+Fuy4gdGY7EgmEJXUY

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d63d9ff2bd7aff47f5251088b6beb889_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d63d9ff2bd7aff47f5251088b6beb889_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1688
    • C:\Users\Admin\AppData\Local\Temp\d63d9ff2bd7aff47f5251088b6beb889_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d63d9ff2bd7aff47f5251088b6beb889_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\D8445\DCE4A.exe%C:\Users\Admin\AppData\Roaming\D8445
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2836
    • C:\Users\Admin\AppData\Local\Temp\d63d9ff2bd7aff47f5251088b6beb889_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d63d9ff2bd7aff47f5251088b6beb889_JaffaCakes118.exe startC:\Program Files (x86)\45CE3\lvvm.exe%C:\Program Files (x86)\45CE3
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3524
    • C:\Program Files (x86)\LP\4A5D\361E.tmp
      "C:\Program Files (x86)\LP\4A5D\361E.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4392
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4676
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1604
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:916
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4084
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4684
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4816
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4288
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:860
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1572
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2236
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:320
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3700
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4272
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1180
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4772
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1200
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3464
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3948
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3616
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4280
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4900
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:452
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2404
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3308
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4056
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2296
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4884
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3096
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:940
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4712
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:228
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2436
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4924
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4236
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    PID:1876
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2752
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:4932
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:5112
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:2132
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3016
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:1576
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:2604
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:4036
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:372
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:1816
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:2404
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4976

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Defense Evasion

                      Modify Registry

                      5
                      T1112

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      3
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Discovery

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      4
                      T1012

                      System Information Discovery

                      2
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Data from Local System

                      2
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Program Files (x86)\LP\4A5D\361E.tmp
                        Filesize

                        96KB

                        MD5

                        ba4818120b8c3c87a4437450f5968ea5

                        SHA1

                        d6e47a0c2b2bd8abef58f8d17d1883fc712e4301

                        SHA256

                        59d73ca73fa8bbec1bbcd19299ed082eb7a1f8f2c5343a498420a08f25bb8be9

                        SHA512

                        0c5e85d700f097a4dd299fc18019037bce4abcace311420bcc8011fc94ff247680112ce59fd0a1b9095aa988262c0ef5b1c903686fb864bd85e162a473599558

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                        Filesize

                        471B

                        MD5

                        fb6d48dad9b7772689e7f825b3774772

                        SHA1

                        be3ec403f876cc98263290a8fd1c1b5e55649098

                        SHA256

                        d21e170115828f1cab36a101f06c2212596bfbc6bcdae8ec2cf34e48fbbe6f19

                        SHA512

                        ac808ab2652e911fea4a3177102bca8e24245be005e49960c8dbce32a061c264551e33bbf7396ad120342d7e7fc9d8d9c9bcbbd182a5537d803b6cc18de63afe

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                        Filesize

                        420B

                        MD5

                        e191c3acafa2b5a9771ebeaff1101fa3

                        SHA1

                        1b925a482cf2cf61cda97c3f0eb787041dc8dd28

                        SHA256

                        816cd35ec52f370211c5ab60250295caff2d6003b0a4cb442d02eee4c291feac

                        SHA512

                        c1fe5ee1114e57059027b99cafea18063a627a3c41dc05b15c1734501efef0e3a6a0eadad57d65ece491a7930835d1b0b436b06f38f050db3f289577c9138d2e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                        Filesize

                        2KB

                        MD5

                        53f0a6366538740731092d36a52476ef

                        SHA1

                        99802548f0b6a4dcd106ae881bf8182d93f0074d

                        SHA256

                        84b0e7e75088052171d34544675b2393bcff3687ebc7a7d5df3a9fef6e8cf910

                        SHA512

                        113d3ba65a20c1792e5b19a8ee802b0afcb883fc3594dc08aae3228af90aeafd84f6c5abaa06ddb6645b06c5a3290fc18fd4716b48687cf51ad8f7d1ec1024e8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133703558944021963.txt
                        Filesize

                        74KB

                        MD5

                        e9092daaaefb4358bea483b5b8835103

                        SHA1

                        ee92d7a3b5ffbe21c750255bba1550fd6ff6410b

                        SHA256

                        42761f0f79b6c3138d8dacda06ad4edf2e73112187e90a2b5fb10adcbc8b3309

                        SHA512

                        4a6b76263bc6230a2ca0b65a6d83b4032f41b2189c91eaf36770c829c16e06cadc1d4856857142b2019b50a8db97e66e68f9b39654c75e5cbb3a346fd90e92bb

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MP05IF81\microsoft.windows[1].xml
                        Filesize

                        96B

                        MD5

                        188f8f76ad695de69c313c1113722ec5

                        SHA1

                        acf66cf340e75c0997ab844f745ed139e05b5c1c

                        SHA256

                        d926dfadf64142c9d6e871f8e3d4709e78b5e82e237fcde0680740eed9c82b5b

                        SHA512

                        00eb7bda00afe8efe5b3f29460e2d92d173911f7deabb097d9995fb9af556371c4cecb473d328c8f9c7c85978fd560b1b9cec723805c44bd167ff59c3cf5bbf3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\D8445\5CE3.844
                        Filesize

                        1KB

                        MD5

                        95b9e727b5524a311960ac2d61ab4f3d

                        SHA1

                        b35a7a6cb67ee83a79b5a92c7e51e356d0d8a73f

                        SHA256

                        c8bc722f125f732b08d886978cc95ff4449240e38230b0a7e8f5376d6329407c

                        SHA512

                        5e23daaaf2220adaaba4133b2accb25e053b8fdd1a83941205cac1f5f357c638ea665b03b0506dbb2baff1f6f82ba577f3d183f8f87cefa69f0263bcfa11b135

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\D8445\5CE3.844
                        Filesize

                        600B

                        MD5

                        096d3da1400cb0a136c7912d07a9ffe2

                        SHA1

                        a0d20f46c8c0f0da48c994e6b48da28fe0e3111b

                        SHA256

                        10335587ceb944cc75c9b856a53d5c68e44c1560c1e3218fa20e32f3e3822b58

                        SHA512

                        8e7611a4e3160c25a68b84b340c9f64ffe095408005d9ed5ca6399bd4a148a66e5caee90ea69a0731b25bab252990dab5733ec0e53ff08dd6fb7007355d1d89a

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\D8445\5CE3.844
                        Filesize

                        996B

                        MD5

                        5354319bd1de5874f78679640d7d2b13

                        SHA1

                        93b23d4c6a98080878fe2d1db9ad420034251ead

                        SHA256

                        ccd6364f52ba16b474ec315c199f8c20da56a2d566e377ec8f1784155569d9a3

                        SHA512

                        cb601e94a0423b45523358707dd4573005a1e9744939760b6483260164baa70e6e74a08c72e827ee825fa49f7620c7e7ee65f2f9b14097e6dd70d9d96f3cb9a2

                        Download Submit

                      • memory/228-1208-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/320-359-0x000001864D590000-0x000001864D5B0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/320-348-0x000001864D180000-0x000001864D1A0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/320-336-0x000001864D1C0000-0x000001864D1E0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/452-776-0x00000000045E0000-0x00000000045E1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/860-206-0x0000021B1E000000-0x0000021B1E100000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/860-242-0x0000021B1F4E0000-0x0000021B1F500000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/860-222-0x0000021B1EED0000-0x0000021B1EEF0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/860-211-0x0000021B1EF10000-0x0000021B1EF30000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/1180-477-0x0000000004570000-0x0000000004571000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1200-497-0x0000024D69300000-0x0000024D69320000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/1200-479-0x0000024D68400000-0x0000024D68500000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/1200-508-0x0000024D69900000-0x0000024D69920000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/1200-484-0x0000024D69340000-0x0000024D69360000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/1572-329-0x0000000004510000-0x0000000004511000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1688-2-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                        Download

                      • memory/1688-16-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                        Download

                      • memory/1688-15-0x0000000000400000-0x0000000000468000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/1688-94-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                        Download

                      • memory/1688-200-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                        Download

                      • memory/1688-1-0x0000000000400000-0x0000000000468000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/1688-625-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                        Download

                      • memory/2836-12-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                        Download

                      • memory/2836-14-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                        Download

                      • memory/2836-13-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                        Download

                      • memory/3096-1058-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/3308-792-0x000001B3ECF40000-0x000001B3ECF60000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/3308-785-0x000001B3ECB30000-0x000001B3ECB50000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/3308-778-0x000001ABEAA20000-0x000001ABEAB20000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/3308-783-0x000001B3ECB70000-0x000001B3ECB90000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/3308-779-0x000001ABEAA20000-0x000001ABEAB20000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/3524-92-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                        Download

                      • memory/3616-627-0x00000000047C0000-0x00000000047C1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4056-906-0x0000000004010000-0x0000000004011000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4392-199-0x0000000000400000-0x000000000041B000-memory.dmp

                        Filesize

                        108KB

                        Download

                      • memory/4712-1065-0x000001C5D70E0000-0x000001C5D7100000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4712-1077-0x000001C5D70A0000-0x000001C5D70C0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4712-1089-0x000001C5D7AC0000-0x000001C5D7AE0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4712-1060-0x000001C5D6400000-0x000001C5D6500000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4712-1062-0x000001C5D6400000-0x000001C5D6500000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4816-205-0x0000000000F60000-0x0000000000F61000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4884-909-0x000002C90F340000-0x000002C90F440000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4884-910-0x000002C90F340000-0x000002C90F440000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4884-945-0x000002C910880000-0x000002C9108A0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4884-925-0x000002C910260000-0x000002C910280000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4884-908-0x000002C90F340000-0x000002C90F440000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4884-913-0x000002C9102A0000-0x000002C9102C0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4900-630-0x0000029D8FE00000-0x0000029D8FF00000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4900-666-0x0000029D912C0000-0x0000029D912E0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4900-634-0x0000029D90F00000-0x0000029D90F20000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4900-646-0x0000029D90BB0000-0x0000029D90BD0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4900-629-0x0000029D8FE00000-0x0000029D8FF00000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4924-1211-0x00000233F9820000-0x00000233F9920000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4924-1210-0x00000233F9820000-0x00000233F9920000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4924-1215-0x00000233FA970000-0x00000233FA990000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4924-1234-0x00000233FA930000-0x00000233FA950000-memory.dmp

                        Filesize

                        128KB

                        Download