Analysis
-
max time kernel
98s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-09-2024 00:35
General
-
Target
f967a2804930393bc3234957bb0d99c3_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
f967a2804930393bc3234957bb0d99c3
-
SHA1
6862a6b2cac87e146888901cad620d56381f115f
-
SHA256
d47277350e6e5c15f013c2af98ae8a51fea1ebd02acb9db40417e43c017066c6
-
SHA512
9b8c5584c5a29b003ec877efea00e18f38e95bc27e462d33007ba2eb85663ed3dbd22ec412edadad2d28d7af8a757f2f11d2572fe1d3df893fec6224933c1bda
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZj:0UzeyQMS4DqodCnoe+iitjWwwf
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 12 IoCs
-
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 10 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 10 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f967a2804930393bc3234957bb0d99c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f967a2804930393bc3234957bb0d99c3_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Users\Admin\AppData\Local\Temp\f967a2804930393bc3234957bb0d99c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f967a2804930393bc3234957bb0d99c3_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE9⤵
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE9⤵
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE9⤵
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE9⤵
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE9⤵
-
-
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdc27346f8,0x7ffdc2734708,0x7ffdc27347182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5176 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5228 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6204 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6648 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,5959978967780205606,7552649374376293382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4176 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\HitmanPro_x64.exe"C:\Users\Admin\Downloads\HitmanPro_x64.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe"C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe" /update:"C:\Users\Admin\Downloads\HitmanPro_x64.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\HitmanPro_x64.exe"C:\Users\Admin\Downloads\HitmanPro_x64.exe" /updated:"C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Enumerates connected drives
- Maps connected drives based on registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\HitmanPro\hmpsched.exe"C:\Program Files\HitmanPro\hmpsched.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Safe Mode Boot
1Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD517258e9f01ee7d4ad1d96d9de8f58d54
SHA141ae9e246ee160c8940714867f0adbeca4d2087a
SHA2561c8a8f227e747f534f5e493e0d2f2ecac1c8eafe83f54f58106f2f49e48d972a
SHA5128c3c93704ca08c7ac8943954547519b3a8913087e70cddfe0d237d054ca532997a045d8e2f220ef2121db7224ce61911e065a4e91d97615ee9dd134bbda601b0
-
Filesize
471B
MD59ec11c089745d73375d78fc1ce7cfb53
SHA1fa0de16ccc85f36723fdd8b4b6beb4a2b566cfdf
SHA256e1c200b5bebeed0812805445cdf57395f1dc0520d0a07db9d3d81ed6598c68b5
SHA51219e429f7a3e69878cc0e16091e43fdd5b87d7c099bed0103789ccba3626941d3b929ad87440b89f927b65abd73c45c3ff906de23eaffb80f2a8c6e18ed87d7bd
-
Filesize
727B
MD5fcb063ffedf9bbb0a0603eb4ec03a708
SHA10a8f08c8c3eb955c2e88498a323ed50453062aa6
SHA2565d41244476c2cac98c45e4dd97390e1f38968bcf19105e5812e977d9218be2d2
SHA5123a8074d909c4deff0b13255c14eba3ea6cbe8ea79972b2be4e9e55839c89affbe8fa1694a0bb76288c4f9313a6362bb966bb1d5d85153236fa0d8333cbd25094
-
Filesize
727B
MD59afe06d446f0a065af01c048cbddc393
SHA18fafc942adfc79cb9c0b86b39516ce2fb01bb3b3
SHA256e231799c5142390fcc9633c021efcf9ecb58420da4a22163e8136eca0d93355b
SHA51269e76904187b8457c55ead8a6ce1444f9b900536d22143c5cacebd5c343216aead5f84b6e6b9f46e3a8ccdd9b3cc98bde775f1961cb8b433cb17cfc299406279
-
Filesize
400B
MD5a6c317ac167b332ad3af211634a509da
SHA1bb291f03b195a7ed33131e61c94d70f99a55c303
SHA25635ea6e7d923e3f2dfb561f969c3c251f2428e9eff9c510b2e7f9b52478d67d49
SHA5122a315ad0c83a540d579abe89f1190226896af1828126fa8a250be0c0d6a52fa8a12deb500d112e708b449647dd1ef40f7cf5526d87193d62a0431963aabe9175
-
Filesize
404B
MD5b4588119e319eac2004c04cd3df3c0de
SHA1c62041542a18206e76368c16359584cb0fa82ecf
SHA2560302b9d2962179e0f6a9a674cc828fd8b55aa509181b8f2c004e363145775c71
SHA512a264e1403503340d76bd05090d84b68d46136380ff16666b5a50a3304d5fddc293f5f69c292b1a7b1048e947eadc26cba2ee1010af265c143badc60e8ee799e5
-
Filesize
412B
MD5a13f2638d1b132130a960fc80d5a5648
SHA1c8d148b053d50edf4296043657edc72743a2caa6
SHA256e406a19ead79a8ae4bb2c01499894e78f967a5ef2de0cda05d01420bbe8785ba
SHA51259fd3b9e16c5c98f85ab758d8bfbe778f115955c93163ad5647c0eb739ed0896ea22a4417794b99790908ef0034f36b11e4570ae985ceefacb630fdcd6da356c
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
1KB
MD5027882fe7fd4ded12cd202fcf500d6f1
SHA1dfe47cf59ec6b8e8b11b6f6d77a0f393a6a6dac7
SHA256c79ba0b36da78c1cc47bd5c9e43a48a842c17ae27a9db62a578820c97964e945
SHA512fe4680850b55081bf43d7c826910bb6c9f0d4888c5bbeff7018a08a4f87752e18b896de6527174744f43ba3ac693fb95f39006692b54c7155e426c2c70158b8d
-
Filesize
28KB
MD51259941fa159f84e042706e6f906a265
SHA1cfe35032ad281a00b7bb824365e08d104655f590
SHA256cd0f867d8df7ef8ed3c855a3d75cb31db3fae3c7d47a2113060e048d25c4bb9a
SHA5126d5ae4f9b3b15ed8437d525ac495858e3b5abea67689ba0876fc72da922c212b19faf85d4767980e63955ea402f5638269ccc07932ba692473605e394c48044b
-
Filesize
1KB
MD5ad34914f57c1b1e167febbbfe70b2565
SHA156874132aa84851de8c0cccdf35ed7aeb7f95d13
SHA256795ecdecac627493d9c205e07d01669d356fe843aac1ecd9d90dc2456a88f140
SHA512bcacf021ec364acdbd2bf6e572626eb34e5941c84986d7d560db25684928c053a72f8f859ebe4712615cbfe33c3820092ce7edc3e1bcb2d2d4a1499c9fc3edf7
-
Filesize
5KB
MD53da9e0ec9464cca267b81f14562fe61a
SHA1422ca7c924b08ddcaafbd8bed0a63217a23c5f53
SHA256f6ad678e3495308128232e9a0ae8cacbd82b07f6b863c1ced63cc50d2aee93c4
SHA5127c491ce426cc36c03963897d172b08b7b41eace8c81195ae1dc0ab0eddff93ec5bfb88a5da02d3e003392b697f9bb0cab82ca1f86aa14c32af4b8a6d9fdaf367
-
Filesize
6KB
MD5767e1d58579a3409bb261a2d5380c8ef
SHA17e92973b145551cd919d2c0b67cf8fc01da48e87
SHA256e0666646bf302f233398b63fec1db5ca10b8059d19a254007901dfd42a4a1fc6
SHA512c1153f9a2075113286bf445174a8c5d893af8eed84ed447ff2434468b6f546008d17d9f829b4509842ee4085cb12cd52d49c9fee24066b615918e7a1befc36be
-
Filesize
7KB
MD5236959ebe470440252fad8d1e271727e
SHA1bffc0aa8712feb5b483473c6f7a79ab5ec6bee8a
SHA2561fd36e54f1b29572d1e0f36cd1c7f2bc2a499c663b68d2f4c5a4fff632aab323
SHA512263a8e807c2751fb9a27d87b4a21351af559f202b1d105d3493bff09b03f9b8960ae6881b5a8bf74a2e9a34997d9a5b96551e1a0b204a727fd56bf40d9a9c45b
-
Filesize
6KB
MD5e71fccd5b0f6467454bdd414469a66ae
SHA15ccf1571234c906be60177451325e038503c6218
SHA256b28e89e5cd943096fb4a2333b597bd4b110c01056b12127b3cde63548901249c
SHA51279750215ef9910ea0447275c3236849a5b0da944ba603eb23cd96eaf882b728cf0caacf70a46eeeb86401bde71eb7199f3f101943d75c6a0826336736ffa3bf4
-
Filesize
1KB
MD58bda8040a43436a08d911fc564295805
SHA1241701f8de66f9b2a0c0d3af04891f9c9b16e135
SHA256eeeb5fbf409519bf45c021b7fc877e330cee3213209fa31f6dba12317580ce51
SHA5129afbc95d0d0a833d53f9fb1462ab7654d5cf6e26a5fc8ec065db265ede375f06d09020d65f7dc93b28eaa3b227df5bba205a15011b609ad8c7a9eb3488a80716
-
Filesize
872B
MD5f66670d2021726b38e73230c8b79d04b
SHA1855c98c5daf15f57fc66707c899c9531a3a35960
SHA256bdb73eac8596921e21e9b276158a81e7bb546fed5049a1d8b329a1ac522e0858
SHA51272ecc0c3b695844778ad9e58c86fbd095e147384c08c32493920bfe776e01bbb414bd43fd6188c51eb146fbe7a02c6fa4fc9028c8714ead98f635593aa6b521e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5c3cbe7d97e95c052cbe667e08c1019d5
SHA1543b61b532067fdd2ed0eadea085903581ebc335
SHA2565d42c54a1662c3ed856167da1a74400e48d1e6bc0b104b1cb4f3f8827adcf166
SHA5126aecc410457280f5fea4df727df9e9d16598c02cfce4396d755a9f38c22767567b4204b7c1d7d27c46ef4ba0acecf4fc626118ca9c8a1f6bcfa674690a7bf314
-
Filesize
10KB
MD59b47af939cf324bd097bccd0ba35eafa
SHA13809f3bff974f3071a60ee244001875f8aa743b5
SHA25623ef38ec8c4d73da345382f1f6c4fa63d34e7846cb8ed672c16b8fd1643e5d99
SHA51286803c6302f6159eb181beff5f511cc902c5f2153f0d9029d4d356d2bf2af00640dc2f6b7b9c6aae6ca1205acc136aa482e6482113330fe0e93270145e0e8651
-
Filesize
13.6MB
MD510dc710dd495e9078ce79b26e18591e0
SHA1aef434d6b77158dd2accd746bbc727bbc3367adc
SHA256be5389a28e952d7ab2d9447c1bdb8eb7d11b24cb02e4b18da367715c2acfdd15
SHA512959c5cb47b9d1c21ddfe2eaac14e0c99c758aab85036705c072525e70255957abc97412ab0ceadd2adbebc1b176699614f71bf50689cf9ff97891e6216a15dc5
-
Filesize
2.2MB
MD5f967a2804930393bc3234957bb0d99c3
SHA16862a6b2cac87e146888901cad620d56381f115f
SHA256d47277350e6e5c15f013c2af98ae8a51fea1ebd02acb9db40417e43c017066c6
SHA5129b8c5584c5a29b003ec877efea00e18f38e95bc27e462d33007ba2eb85663ed3dbd22ec412edadad2d28d7af8a757f2f11d2572fe1d3df893fec6224933c1bda
-
Filesize
2.2MB
MD502e4aac44b87686307f50a6726b1ae69
SHA13a87f802271c2af0bfa88d08958995bc067a646b
SHA2564406dc9040187e1685e6543ee9ca3e3159375e38e1928bf301b306e3bcd2b627
SHA51222bd84b3ca3a4b6b11e8ce750e87e8e927be065c3d2389f6ff0fab0e4b208f4da8bdd016bafb5b1293e04463c3de530bd0435b453ee305685cb9b245a0b6bd7f
-
Filesize
13.6MB
MD557ae72bca137c9ec15470087d2a4c378
SHA1e4dd10c770a7ec7993ed47a37d1f7182e907e3ed
SHA256cfeea4ea5121d1e6b1edbd5ca6e575830a0a4cbaf63120bc36639c44e1b89781
SHA512f80d6732e86a8d38db1ff43c0c5058013bd456c4b86b87018166ca073bc84fb8e7676b55371ae9cec668a77d198e1e7f6854a9a93581ed21a32167e3b9533f6e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
41KB
MD555b9678f6281ff7cb41b8994dabf9e67
SHA195a6a9742b4279a5a81bef3f6e994e22493bbf9f
SHA256eb5d9df12ae2770d0e5558e8264cbb1867c618217d10b5115690ab4dcfe893c6
SHA512d2270c13dc8212b568361f9d7d10210970b313d8cd2b944f63a626f6e7f2feb19671d3fcdbdf35e593652427521c7c18050c1181dc4c114da96db2675814ab40
-
Filesize
2.2MB
MD52ed38b83ab48174c9ff065ce29e47e73
SHA1a592f5e06e8860701c596287ba4ebab9a4d62b45
SHA2568df11a34c4cb1eca8542d3e987658e94469a8fa9863bfb0b1d4a91150f8be256
SHA512a6200e8afb854f44fb218f45bb86a2778e86636198e754ffc16f1fd64ca049f679e3a9519a967d85ce8a7681cff825312e76a3a4f491f3784b963f797a1badb3
-
Filesize
2.2MB
MD51d098c720c238a2279634b3a51663e02
SHA176f846a6dce5d50ed6c8b3132fd3f7d2ca49c3c4
SHA25695e7788e3559814685522214f8f48d3a8fdccfcf2cba1f5374745f7ebdf9a4f4
SHA512261dcf9336e94d002e3d48d32c6ee63eb53c38aacfde427caf318b539581f40561c57f916a2c3f6b99cb0c1e089e70237d50566d4ccc5e2af7384ef070529546
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
804KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB