remcos | 9082c4d76e331613cd970532a2fa90fcf86ffe0180b9d997dd8c4c93559e5d0d

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe
Size

321KB
MD5

efd7d49d7985282a6049b308965c1888
SHA1

308ccb6f12c0f3c456c57051f691e929edf13a9e
SHA256

9082c4d76e331613cd970532a2fa90fcf86ffe0180b9d997dd8c4c93559e5d0d
SHA512

8ca78873323ed7d56b6f610227bb40d30883db1ba3dbee7a322872ab091a21b58dd52e762d00ea3d4eee7416c24400cac07743e21597d61bff5e83c1a7cacc21
SSDEEP

6144:BrJOumSn1I+U5F5WTLErZ0ySwNNZFnKZ8+0nAbSfOL/+H0mjYawdF1Ust:KumSnm+U5F5WTLErZ0PwnySmL/+UmjY4

Score

10^/10

remcos remotehost defense_evasion discovery evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

2.4.7 Pro

Botnet

RemoteHost

okkkk1.ddns.net:4444

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
true
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-9WWA88
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Drops startup file 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe\:Zone.Identifier:$DATA	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2656	render.exe
1640	render.exe

Loads dropped DLL 2 IoCs

pid	Process
2832	cmd.exe
2656	render.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\render.exe -boot"	render.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2656 set thread context of 1640	2656	render.exe	42
PID 1640 set thread context of 2972	1640	render.exe	44

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe:Zone.Identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	render.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	render.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000009420368c543a0165ae08e32428d279315031d3b7d48e9c3298ea58d35df1d565000000000e800000000200002000000067f26d16d92debbeafe93b2391db19f162bbbb08416a67ef2f9e66e41fc9064420000000f7cb6c23b30412120d1339b34efd585e891ea54499498058b24a7ec2243532f74000000009460518265b591f57a3515f519319e5644345918f7734b660bb850ecb13a2ef09ffdb22f019b386aae515f7ceba7122c562617eb3a364a55119ee53f575ea34	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433085243"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E33FD3F1-7818-11EF-9DFD-D67B43388B6B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000979ad144a4c6204e72b4ddc78db6cc10b4a785c9948e3ea35ca6dc7b022b7215000000000e800000000200002000000061f22823c1c70dddd739d85550768a1e54c08dd8fa4c6d26e6db92b528afafd6900000004a38a88ff0e56ca0bf6db9ea68535b0503fc232438d8307936b9f80a66b77b8c027c79faa6b913f4b5de8770756898a2b5df22c38f87a359b8a3b75a5514b50913e0911a4b0a95ed8e1d481625bf3f6faf40f4d44b39a6830c040336cbe262818f0d3f5c50652e19c183fec03e96055ccab2b630f1bea08186ab5ac0f54918b39b2699aab2f32c168cb449b34242f836400000006ca67c36cae2f15916a6542fdc0c71d39971763276571ca7b1789bb23ebe06b57192842146c416dbdec95e53c79497bc4b69d06246532f4636681e737739e84a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90cb63b9250cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2980	reg.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe:Zone.Identifier	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe
Token: SeDebugPrivilege	2656	render.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1312	iexplore.exe
1312	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2800	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2800	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2800	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2800	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2936	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2936	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2936	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2936	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2592	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	33
PID 2320 wrote to memory of 2592	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	33
PID 2320 wrote to memory of 2592	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	33
PID 2320 wrote to memory of 2592	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	33
PID 2320 wrote to memory of 2832	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	35
PID 2320 wrote to memory of 2832	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	35
PID 2320 wrote to memory of 2832	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	35
PID 2320 wrote to memory of 2832	2320	efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe	35
PID 2832 wrote to memory of 2656	2832	cmd.exe	37
PID 2832 wrote to memory of 2656	2832	cmd.exe	37
PID 2832 wrote to memory of 2656	2832	cmd.exe	37
PID 2832 wrote to memory of 2656	2832	cmd.exe	37
PID 2656 wrote to memory of 2400	2656	render.exe	38
PID 2656 wrote to memory of 2400	2656	render.exe	38
PID 2656 wrote to memory of 2400	2656	render.exe	38
PID 2656 wrote to memory of 2400	2656	render.exe	38
PID 2656 wrote to memory of 2928	2656	render.exe	40
PID 2656 wrote to memory of 2928	2656	render.exe	40
PID 2656 wrote to memory of 2928	2656	render.exe	40
PID 2656 wrote to memory of 2928	2656	render.exe	40
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 2656 wrote to memory of 1640	2656	render.exe	42
PID 1640 wrote to memory of 2984	1640	render.exe	43
PID 1640 wrote to memory of 2984	1640	render.exe	43
PID 1640 wrote to memory of 2984	1640	render.exe	43
PID 1640 wrote to memory of 2984	1640	render.exe	43
PID 1640 wrote to memory of 2972	1640	render.exe	44
PID 1640 wrote to memory of 2972	1640	render.exe	44
PID 1640 wrote to memory of 2972	1640	render.exe	44
PID 1640 wrote to memory of 2972	1640	render.exe	44
PID 1640 wrote to memory of 2972	1640	render.exe	44
PID 1640 wrote to memory of 2972	1640	render.exe	44
PID 1640 wrote to memory of 2972	1640	render.exe	44
PID 1640 wrote to memory of 2972	1640	render.exe	44
PID 1640 wrote to memory of 2972	1640	render.exe	44
PID 2984 wrote to memory of 2980	2984	cmd.exe	46
PID 2984 wrote to memory of 2980	2984	cmd.exe	46
PID 2984 wrote to memory of 2980	2984	cmd.exe	46
PID 2984 wrote to memory of 2980	2984	cmd.exe	46
PID 2972 wrote to memory of 1312	2972	iexplore.exe	47
PID 2972 wrote to memory of 1312	2972	iexplore.exe	47
PID 2972 wrote to memory of 1312	2972	iexplore.exe	47
PID 2972 wrote to memory of 1312	2972	iexplore.exe	47
PID 1312 wrote to memory of 2504	1312	iexplore.exe	48
PID 1312 wrote to memory of 2504	1312	iexplore.exe	48
PID 1312 wrote to memory of 2504	1312	iexplore.exe	48
PID 1312 wrote to memory of 2504	1312	iexplore.exe	48

C:\Users\Admin\AppData\Local\Temp\efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe:Zone.Identifier"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe:Zone.Identifier"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\efd7d49d7985282a6049b308965c1888_JaffaCakes118.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe:Zone.Identifier"
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      PID:2400
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe:Zone.Identifier"
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      PID:2928
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2984
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2980
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1312 CREDAT:275457 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C

Filesize
579B

MD5
f55da450a5fb287e1e0f0dcc965756ca

SHA1
7e04de896a3e666d00e687d33ffad93be83d349e

SHA256
31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

SHA512
19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C

Filesize
252B

MD5
2f0a9e0fb5fc1ae7fcb4909c6865b9a2

SHA1
2d8668159d76e8dbc7f1f258f09b920b72f2ce34

SHA256
f9f80b03dc6aa0b1ecb11094368d58724db228a99d269bf542a184dba712a0f8

SHA512
018556af55f64fa745ab94e49cde3e9aba5a2bdb92fcb62dad0f15c73503e014f56a53ff65d5825fc6ea46f2937b76b4220f501ef4d2be542aced9af516b9b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c996609a9cb4b46669c9e9958085eabb

SHA1
8779fc7d7c8efd6e3c5552e9457e46ae17baa5f6

SHA256
d95b8bbd2bafa73272421b7c2a155ee0130232635bedbcd535c4491c5ab0266b

SHA512
1fdfbf6e22678cd438b0fc605f08c75605fd7ad3e0ab5b0a1119b1945229bdde3d461b9946fe7a97aeafbcbb9944df0e7e814e2b9bcc17ae2399408021fba41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9568880f51141930ecf390e364b459e5

SHA1
05f8088998922276ae2f1eabedde4ca545db4129

SHA256
90bcfe0fea3fe5d942a0e87edee6ee8d2a0c34126b9f74ad2aa24d9658fbbef6

SHA512
07ba7f9cdfd6d3781f77a182f56f3efd121576f171bd4462c3b60802ffa87b3285f659d3f840ab130364a2069224459747af19ba80157c3e95044ae558be77ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdbb2bae8a765ff07a334d01e7381715

SHA1
dfd120261a864e43439ddb9084440e9b3af28c6d

SHA256
e1f7c9d0758850475c143a8c228585464a3dac72e06190661d41f77608321e65

SHA512
97e1bc00f3e220848790ec6eec6cc528c8403cb24793a3cd21d70aa62fc3f9c5deb728cf332ea9c37ee237f56d3da7c61dfb5ae66b526b258bb10005e35f4c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e75dea5e34871e1c080dcfe6c800898

SHA1
a7c613a652ee4b2d73db9881ab4a63a1015b0613

SHA256
8f241c29bae347b452a98ad89b8c03f75a0d79d77f418975823dc325eaea546f

SHA512
4b1f31229b7eb38a3c5d48d34c6e5984f365cdeb1bdf2b9014c78da39401f01a2b279fec06c2caed95f6f40bc79b37f318fd8fb5ca02f7fae28d4aa208831846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ef150c0cc99152a0d9397e28e46d149

SHA1
6c69719fc390c654cf7cc3160cf6073fb1f0f1fb

SHA256
b4dddf8630c2a251f573c07bec30d2820c0a1376af6b5efbe25cda1ddf0569b5

SHA512
87d9b157154c6143068701cb9aa5c47e4263fcf3e4655b514a323f675a63c3e42acd31cf230b3479febcc0cb5fc18bf1f0c6a7ceaee42287281749d139b4dc04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ffe56247ee5adbe980bff0ce6d40294

SHA1
86cfa96b51784ce41f87f0dd91db0ddb81b2f50e

SHA256
7a9aa06ae340c639fb7b30de1659701855e72cc4a87551c37fe2dd31796c5e54

SHA512
aff743476d1e3d150fd3f062b017acaa15d10ee2a54ae5cd4cdbf8c1c28bf890dee04175ccf14a476f6bd7631c862d2afba9413349c86f86a096bc1f6ab0626e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef7e65c64a10e02d166b1ea5f613a84d

SHA1
f62878a4e5ff1671462d4450ecd3eccc2a1f412b

SHA256
93d1f6788d11512b23569a79099fc65a2e0fbab04c686edafff59022b76e7927

SHA512
c6273b0001a9d2ff2a79c369d701a00dbccee5fdba6a1e90b006d6207721f7f4093914c27b2ed80b99c21e4bd83459939958fa8e59ca696d5eb3b6d93150fb6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2414dcde00548ac70f1403e3b446d67

SHA1
edc697b0980b4e85add45755ea5ba76a657d7573

SHA256
2e0065c3a09dbee7699b1ba4b3a4c5e494f9f40a7bc9044600c98c330c8077cd

SHA512
a7ddc6f371ac35f9f87571fbf9da5e117997686780c957cc661838a4cd22de3965f91f7290bb7f45cbba13bd557d2ed6d63712ae30f6a65c8e6651e1001f5ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcf32a71af7815aae92c12340746fc9d

SHA1
b75756bfd0e692edfaeb9096f01d544cfcd8f68c

SHA256
c1476a51d5665b9a9860ac760b75784aa6f48decd12f6be2030325d8be148fe9

SHA512
a643970145abe7f21723c4c1005045d2eeac67a5a95df2c73a17b1473f4d05ff98a2e045295eca70432105864dc528ed8e3c0596943734f7b98271b97de553a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3c230613430cf7f20ad670b14d904ad

SHA1
f6b64a568f85f9462beccc93735604e93798784d

SHA256
beba0f275230d9c2eec38a200efec42b5630974312f57d29e816a0ffdb642abc

SHA512
e10e662ef5cb758f6cfaee56dfd0c9620daff36157b0caa075c52fd2eb07206dc24c43d46b006d524054083d692295aa2855c9baeccac755c04db70f1bb28710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b12c05c5dc35129e3df3b2eb6c18c625

SHA1
2628d7b90dd3501f24e38dbd4090462290f84f2d

SHA256
e85f48d64781a214cf49d90cb3e98d6b487e9b7f582b0a246d6435aaa2134dda

SHA512
99a44464aea61880d74e23e853fe26f9fc8a6559918e07fdd522ae6f0f6c3204e64126ff948a49b35edf61e3e42955872a9cdb052bdf41e5663f5aeff6e19bd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2657593bcb8cedc13dc34dc00fc29d37

SHA1
151cb68061a962910a48755f15749e7739731dac

SHA256
34d4c83c39e3e8491c4a06d07af9cf70255f797ce25eac056744a5ec9890c819

SHA512
5cf55eba5c03ad66083513597a3133a2779a108c1c45c226913fb65f7c0b1035716d0a403789d1da785f23b708089640e94c1f2a0f1f34b1c3656580571488dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8da3d819a9d859bacc785a2451635f34

SHA1
8fad8206c2329259757d2227aa23995b037478b6

SHA256
0e9118cbfaf8515b2e8ed282b2dc841e0a22539146815e1259d2fa0aee795224

SHA512
5e51ec71a350107c23b34d6709186b6fcc06624988de732b0a3db57875d8f09392ec7d9faefc032bfb9fe3fce39932dd1ec37e753bdaf95eb44d84dcdc16cc89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
937af8ef8580c2028f708a77ffe9e171

SHA1
8672633999570c96f43af1568c5d37eaa1826288

SHA256
bc167450ff38541425c3092ca1951975564be408bd902fbf69f764445390abab

SHA512
d138fa7536b377ced942b4ff23e1a4e6a1ca88bacdfb79bf04034e23e87b70f81b4d6ddd0a36f64caa3314bb990ab8fd564d1d0e0feac8a0ec2ac6312e4facb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89fc11dbcbb3f8ffc0b39bd30a237b00

SHA1
0ff632a9a9ea663b5b7ffc82e441ae348b7b1f1b

SHA256
e4f680ca7706bbfd2b93e616a90b2faecd0a82a0a67e1c455686f6f3c8c2aca0

SHA512
ff6f6757b4a7eeefd84fe24cff9f7f9ca522a9378e309870a687331e98bff56525f70be8395df0e0ed49a190564f4d5eb4e7e5c85a8ed9daed3921de2fc81ffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9eb954f9090b48058e588d00f5e6ca6

SHA1
3db9eba8782be55687f7bcd46cf59841354b8de3

SHA256
c694c397b05d4c467f71844acf8d1795758aba08ce15a4239893282f168769f0

SHA512
a2c54e7b573873fa5eb7f5210c067d3aceb69128c68e7221ac506f4c543c0898c36bf6042d56d73d8525b65fe4ff1f3748f2176cbf378bbaf8989335c6cca1a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8199723fdc162fdda4acc6fc61cc4091

SHA1
a89343996423459c968d93af3c596ac0b27c2f45

SHA256
707357e63c2e31148cd09dbb914ee6ce7e68961cbd68322dfd4be7af418cf34b

SHA512
c50fd9f0513cc434c164e7524443bb9fd2ff14da7216fbfaacc65401140014a8f9d56877b381b128b24a68f1b67f351cefa323abc56b33dfddc5e75163272cd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaa29179be57769e5dc9a36849207577

SHA1
9b7dcc847749749a970a9e85df90f108adcbe194

SHA256
a878b79874f0b8aa49e7b1d566ad24491809d5dca2f429f731addfa39c4bff2f

SHA512
e78b5e8bbcd5e30314f657cfdaa45b05f5708cef10b2db78b59cea7bb05133af6e60b1dab19965cc498d00bc8567badf355434e3c19e9fef016613e760cee643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69a85692fe35b5cd6c08c43fb82290b0

SHA1
13cbe4924057b46f680f027d8bb9e4edca7207aa

SHA256
0f98bcf40d9b89f320dcf9514684eef6dd3c90a556b134dfb9688a9b06328844

SHA512
ffed6ecba3ae2b590362d5f8749b065e04f3c73bb60ee2884c46dabe727a1d3be91560d62a46ba0646a770b90cd0798e1fc18d7650d253f2d2df6efd49022b02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ce29f9de5ada87096077f6011716b46

SHA1
fafdd84f979d2dcf76ce01377eb903e5a9dc6f69

SHA256
b3c532e8f4d87a89ed190d36b86a30f6ac8524ad9d00cfae620bc9eb585a1269

SHA512
20e702802f2137557a9a53a2afa759451dc180b690040613f93a09ac0e89bb8a3ddf5365e16decf26fe8356da93a4ab28702d1067c1b383d1338f7bc1b096239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7be8f61e4964dc4868683186aecb7c0d

SHA1
68e96b76b7973d20e5aaa1d40bdba37077974357

SHA256
e16d9289bfd66b9d15ef3f0874be3997560fb9ff94588f219d4b278d6b966b2a

SHA512
c51c055670b77065da488ca7f5ae8c122a84d26a6f6b9651296f2ca9d9a58dc9db67af3bc2b2c064c62b7537e1be82a0563e36da94be80129bae2acd5f5a9785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27bb628459855f5da0563a99bf422dab

SHA1
47ec762b1e184479d8b9208ed71d68d9fa5bfd75

SHA256
06bde31723ef068b14ea4526286cbf86b6615f5c423405a9fb35a32f62fbc15b

SHA512
107a5f3f8ede8306d2cd901b80efee70c68aec847d181e6c752bb2f112d5fc5f72b27377d38f5ff36eeb0ecd154ab2532157af0dee064256d87a6ecf29d6d39b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e7d31379fc6681868d84f4073de972a

SHA1
612838d8dc75389a24b1f8f0c9554b56f0870ddd

SHA256
8e316dca25bd734acb356b800f07fcd25224e388aad1afc92e97059b519747fa

SHA512
5c1c0193a466fb59ffe919f341d3a80c32c92798b99ede2f56b166f9ab301daadb07c515c2e73c9a5e5bb8b696a895bdbc3aefbac0494ca5521d553e84b63ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
749acec4f3f447c21df865271ed7af3e

SHA1
84ff2ce17be40a3027a34d86dd3e061db55db0b4

SHA256
7dc52b80d9a1b772f26aec767d96b7c1c7cdb50d338657734311d3839d78330c

SHA512
dbd0938a1e72a8e633941e4ce11526448c6f2481d1819d11882fe662b9b5d2ba6981001c1deca1772f5e540df12e2b05a3bc519cbc330ee3b6d3c0d4bf1c842f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1719de66c489314d030c5a83dd20dbb

SHA1
27e9b066a573eb714487daef07e3a509ec6225f8

SHA256
4ef0269d3508204a6268ac741b40b382d53773393027f72bb479d5f48a891e72

SHA512
f57241b6aad599b018caaa09973c3db29066bd7788a147a3b1e5ac159b095133ac16d7de5727e9c5253a215df7620d92988639fbf49ecbf063cc8b6dd9ed268b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69feb9dad2bd19c7f4ae6fa7f5dc2689

SHA1
ad8437aa89a9e01e473b184a96115cd083bbbda8

SHA256
39cac2a938031db51fe3b842644e83f2d6745b5aa73ceab6d5a9ebbd82185ebb

SHA512
d980aaf5a89dfdbc310d0c708142bdda0028ee0c2ef2917479ad6efbfb9b1ab5c5c954d6e6de1078224e7b9431a63ee49ccfe75266cb9b3e6cc04c3f224b8449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41191ee52cc692e327fb335dd06e800b

SHA1
e9b6aba74b75b62314bbabd6966df976981213e6

SHA256
e036526c6c40f3715e073d03bf8b4bb4281f2bca26d555e081a46717d7343e81

SHA512
7d1bc8bf45bac177b1236a9fac8ab4abbd869dce5312b082dbbe3e427d2b172a4cd1451315f501ce78a72082480c3ce522fc1cf207b28e76dd86425fb9c3baf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4866c93ef2bce3061301268dd9f022a1

SHA1
984fcb96aebcf7fa2e16970b1283c8c16c0df524

SHA256
c4f56234e4a3d19f559045b86e1e780c9b42be068d2d3dcdb91389a1c034280f

SHA512
7adef7a004870feb8559afce8a6050b6f251947421d7e96934ed6f2750298d835cb106e578a8070392e9314c06705307f577f9823d3b74d47ac0208cb79679b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16CD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar178B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\render.exe

Filesize
321KB

MD5
efd7d49d7985282a6049b308965c1888

SHA1
308ccb6f12c0f3c456c57051f691e929edf13a9e

SHA256
9082c4d76e331613cd970532a2fa90fcf86ffe0180b9d997dd8c4c93559e5d0d

SHA512
8ca78873323ed7d56b6f610227bb40d30883db1ba3dbee7a322872ab091a21b58dd52e762d00ea3d4eee7416c24400cac07743e21597d61bff5e83c1a7cacc21

Download Submit
memory/1640-28-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1640-26-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1640-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1640-33-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1640-31-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1640-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1640-20-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1640-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1640-25-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2320-0-0x000000007444E000-0x000000007444F000-memory.dmp

Filesize
4KB

Download
memory/2320-14-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2320-7-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2320-6-0x0000000000B40000-0x0000000000B4C000-memory.dmp

Filesize
48KB

Download
memory/2320-5-0x00000000007A0000-0x00000000007A8000-memory.dmp

Filesize
32KB

Download
memory/2320-4-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2320-3-0x00000000004A0000-0x00000000004CA000-memory.dmp

Filesize
168KB

Download
memory/2320-2-0x000000007444E000-0x000000007444F000-memory.dmp

Filesize
4KB

Download
memory/2320-1-0x0000000000FD0000-0x0000000001026000-memory.dmp

Filesize
344KB

Download
memory/2656-15-0x0000000001230000-0x0000000001286000-memory.dmp

Filesize
344KB

Download
memory/2656-16-0x0000000001220000-0x000000000122C000-memory.dmp

Filesize
48KB

Download
memory/2972-34-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads