55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb

Analysis

max time kernel
149s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
Size

48KB
MD5

0afccdcba7062a0eac1442ab279b6684
SHA1

8df03692954e89f0614affae9fe6a636be62f6b8
SHA256

55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb
SHA512

9d3a8fd3dcca0343e41a6b7a75063f574e10ece47866cf8d286054c968ee1ca22856227fd5757ecf3a81a0933bdb01364b13327858252dda96cfe9aa1e2e087d
SSDEEP

768:2s6Hp+Vxr1x5cE9Fl5pz8w1rU9hFInlI1LqYJUukGdKETL4Ibq:2Rpsrz8GvnG1hXRTlq

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2832	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2868	Logo1_.exe
1044	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe

Loads dropped DLL 2 IoCs

pid	Process
2832	cmd.exe
2832	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DAO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2896	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	30
PID 2684 wrote to memory of 2896	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	30
PID 2684 wrote to memory of 2896	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	30
PID 2684 wrote to memory of 2896	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	30
PID 2896 wrote to memory of 1908	2896	net.exe	32
PID 2896 wrote to memory of 1908	2896	net.exe	32
PID 2896 wrote to memory of 1908	2896	net.exe	32
PID 2896 wrote to memory of 1908	2896	net.exe	32
PID 2684 wrote to memory of 2832	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	33
PID 2684 wrote to memory of 2832	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	33
PID 2684 wrote to memory of 2832	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	33
PID 2684 wrote to memory of 2832	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	33
PID 2684 wrote to memory of 2868	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	35
PID 2684 wrote to memory of 2868	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	35
PID 2684 wrote to memory of 2868	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	35
PID 2684 wrote to memory of 2868	2684	55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe	35
PID 2868 wrote to memory of 2612	2868	Logo1_.exe	36
PID 2868 wrote to memory of 2612	2868	Logo1_.exe	36
PID 2868 wrote to memory of 2612	2868	Logo1_.exe	36
PID 2868 wrote to memory of 2612	2868	Logo1_.exe	36
PID 2612 wrote to memory of 2724	2612	net.exe	38
PID 2612 wrote to memory of 2724	2612	net.exe	38
PID 2612 wrote to memory of 2724	2612	net.exe	38
PID 2612 wrote to memory of 2724	2612	net.exe	38
PID 2832 wrote to memory of 1044	2832	cmd.exe	39
PID 2832 wrote to memory of 1044	2832	cmd.exe	39
PID 2832 wrote to memory of 1044	2832	cmd.exe	39
PID 2832 wrote to memory of 1044	2832	cmd.exe	39
PID 2868 wrote to memory of 1916	2868	Logo1_.exe	40
PID 2868 wrote to memory of 1916	2868	Logo1_.exe	40
PID 2868 wrote to memory of 1916	2868	Logo1_.exe	40
PID 2868 wrote to memory of 1916	2868	Logo1_.exe	40
PID 1916 wrote to memory of 2596	1916	net.exe	42
PID 1916 wrote to memory of 2596	1916	net.exe	42
PID 1916 wrote to memory of 2596	1916	net.exe	42
PID 1916 wrote to memory of 2596	1916	net.exe	42
PID 2868 wrote to memory of 1388	2868	Logo1_.exe	21
PID 2868 wrote to memory of 1388	2868	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1388
- C:\Users\Admin\AppData\Local\Temp\55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
  "C:\Users\Admin\AppData\Local\Temp\55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aAA24.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe
      "C:\Users\Admin\AppData\Local\Temp\55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe"
      4⤵
      Executes dropped EXE
      PID:1044
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2724
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
8ef1a94c2988444c9d5d6c36a63765d3

SHA1
d566ce1693e16fd605afcf2c5ea87af57af56197

SHA256
ab3dfdf37c3eaae2dbeb15b4e6be3659187e8e3613450664160702c787cf1623

SHA512
991fc8c061d831e96f6e061ec85f6d5c2aa7e7380a949bd04193ef6b0f8d495a462bf6b9bcafbd2893eefa0195bf4a191a923c36f4845e6f44a86be1e1ded45e

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aAA24.bat

Filesize
722B

MD5
8142d2df553a6495643177f4ffcf5792

SHA1
6c37d385128273dd0dc65a17a20af6e6ac61239b

SHA256
63e7e5fad59432e7306d1459d39183069c1ab62db54061e0ab509951a31c67c6

SHA512
c6fb82476d5e5056b3de1377d5a809b73b2889575cf45d703a4c67c43efdbe61297ea5d1231a69e54228509a1c3b60c58a0a8a66f17b6cb1db4cb4c2b524cf5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\55531bf7f59392f9b32b1c6647b17bd36a75f9536cb5cd8067cbee6d2f6564fb.exe.exe

Filesize
14KB

MD5
dc6311fbfd49f41fbf35860a30e68355

SHA1
b08b15be412e843acaf7ad5e6df0ef1e8bdb465c

SHA256
ffdf81680522029c2eb578a9f442fd9692900a5c782c711e35203fb2d25620ba

SHA512
5e2938f5a8396154928a7d093db3843d73497cea4f49c0f1b77e3aac6e29d1db7f0ad4518587c336f0dfccb67ff33aac8e12afa70503504c5d8d46d12a86e453

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
356cac02b916fa68cdb143461cd998e9

SHA1
888516965d3843e0a10864d6cc0480cc912cf0a8

SHA256
c0e06a40330d72717d8c82fa7844df30dd8c6d99447e2e2372dc22a95120a92f

SHA512
6daeea1394153fb814655ef67b6220182f8eb0fb995f189f455771412e484c6522a6965c13b6ff748060778b25397ecb8a627b2fea4dffcf526ade0aaec53965

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2703099537-420551529-3771253338-1000\_desktop.ini

Filesize
9B

MD5
e2a14c19421b289cbd51a76363b166bd

SHA1
5d0621d68da5a444f49c090b0725c7044d47fdb7

SHA256
844af243be560dc4e478aa7ea28f4959f9df45f204006bade7ae52398d651835

SHA512
8c49bec05605c4d2b8f07f00a7a39e70f5bd4f7c84ba221c615447f947053bf3bb0496c38e2bf8b15235c493cc5a0b41f34285fed1adb4c13572f25b67e178e5

Download Submit
memory/1388-28-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/2684-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2684-12-0x00000000001C0000-0x0000000000200000-memory.dmp

Filesize
256KB

Download
memory/2684-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2868-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2868-2963-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2868-4146-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download