9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
Size

26KB
MD5

74da81c0eebadc189825e2c31950e5be
SHA1

4c59523c588fb5ef5cf9b0b8632a2149e6c40e9e
SHA256

9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c
SHA512

17a5b8132be558f994082573a08a1d1e9e2147c31b1a52aa652addaf8470f141f3244e6515c5f001a39ea898fdccd58f94601a2fcab66073ce44d62ac63d5420
SSDEEP

768:uc1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:DfgLdQAQfcfymN

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\T:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\S:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\Q:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\P:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\O:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\L:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\H:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\V:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\K:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\G:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\Y:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\W:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\R:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\N:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\J:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\E:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\X:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\U:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\M:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened (read-only)	\??\I:	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\Microsoft Games\More Games\en-US\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\es-ES\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\Uninstall Information\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2668	1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe	30
PID 1964 wrote to memory of 2668	1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe	30
PID 1964 wrote to memory of 2668	1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe	30
PID 1964 wrote to memory of 2668	1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe	30
PID 2668 wrote to memory of 2788	2668	net.exe	32
PID 2668 wrote to memory of 2788	2668	net.exe	32
PID 2668 wrote to memory of 2788	2668	net.exe	32
PID 2668 wrote to memory of 2788	2668	net.exe	32
PID 1964 wrote to memory of 1268	1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe	21
PID 1964 wrote to memory of 1268	1964	9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe
  "C:\Users\Admin\AppData\Local\Temp\9ff20b9a88231037194ae68ac2ee2fa77c9da20180a67416a9a89bd8a3fd1f9c.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
6bd9e3a4efc02997cccf98e6a1e11c2b

SHA1
9bd2d024ddb8f24aac86d8048e3f27a055995899

SHA256
34059a9d97fb545091f523b419a39d16a3833778ff081623923e9183f09c6a18

SHA512
1dfdc0c1cad5211c1792be9d76d268c8eeccac2a835a6a1e80651514a41049c7123501e4cede12b2a53cb8a0d48cf7a27b63756f369a09ed045d949ced48d905

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
570KB

MD5
56fe3c9c1c676ce70cf3ba2162f9780c

SHA1
18c694b7ccac6df3427a3cf16572f49a6765c16c

SHA256
2d37d076c2a895dbc0f0aa83d48d0e6e7688a261f9d30316ed7e518605b00617

SHA512
5118a32db80aae7b75c768b0974cc4af909d8cae7e67ca74ef19583b866473a835b4495ced5417a6d982012172392115251465432ed4674de15f276538d03521

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
99ea9b604a7a734d3087fa6159684c42

SHA1
709fa1068ad4d560fe03e05b68056f1b0bedbfc8

SHA256
3f733f9e6fec7c4165ca8ba41eb23f604a248babe794c4ad2c6c3ce8032aab1c

SHA512
7af8008c7e187f925c62efc97e1891a7a38d089302dba39fbde137fb895e0592847ed0982c824c2075be8e6b95b6ce165ecb848ab85adf53779ebef613410fbb

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\_desktop.ini

Filesize
8B

MD5
5d65d1288c9ecedfd5f28d17a01a30bc

SHA1
e5bb89b8ad5c73516abf7e3baeaf1855154381dc

SHA256
3501728ad227b52ce4d4f85ddd0e6d28dfa7acce977ae27f1e337be209825a5f

SHA512
6177ce001dd535382c3bae5e8c3cfda85d8d8b76b68bce10fa8e5e1e748fd1512a531ffc93fef1316f2c27d93b5b4a5b60a6391f0e131ccc5cc0a65c2755868e

Download Submit
memory/1268-5-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/1964-66-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-306-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-1850-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-3310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download