4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
Size

264KB
MD5

4ab45cfb9b6521024b3829a53017c2d2
SHA1

590a9bc930de81b2a2b5577f2e1162be6f0c4920
SHA256

4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c
SHA512

f461363ec46ab62e488dc37a1982c028afc51ee5a855d2d7f7f8c0959619e2e418b426721e6e4c158b39366cb2f44c567a69e4b5bfe781b5a9a77a83a88e2c28
SSDEEP

3072:2CaY46tGNttyeQLYm1LLRkgUA1nQZwFGVO4Mqg+WDY:h46tGdye41LLRp1nQ4QLd

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Deletes itself 1 IoCs

pid	Process
1852	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
1152	Logo1_.exe
2624	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe

Loads dropped DLL 1 IoCs

pid	Process
1852	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
File created	C:\Windows\Logo1_.exe	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe
1152	Logo1_.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2080	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	30
PID 2432 wrote to memory of 2080	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	30
PID 2432 wrote to memory of 2080	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	30
PID 2432 wrote to memory of 2080	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	30
PID 2080 wrote to memory of 2212	2080	net.exe	32
PID 2080 wrote to memory of 2212	2080	net.exe	32
PID 2080 wrote to memory of 2212	2080	net.exe	32
PID 2080 wrote to memory of 2212	2080	net.exe	32
PID 2432 wrote to memory of 1852	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	34
PID 2432 wrote to memory of 1852	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	34
PID 2432 wrote to memory of 1852	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	34
PID 2432 wrote to memory of 1852	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	34
PID 2432 wrote to memory of 1152	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	36
PID 2432 wrote to memory of 1152	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	36
PID 2432 wrote to memory of 1152	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	36
PID 2432 wrote to memory of 1152	2432	4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe	36
PID 1152 wrote to memory of 2896	1152	Logo1_.exe	37
PID 1152 wrote to memory of 2896	1152	Logo1_.exe	37
PID 1152 wrote to memory of 2896	1152	Logo1_.exe	37
PID 1152 wrote to memory of 2896	1152	Logo1_.exe	37
PID 1852 wrote to memory of 2624	1852	cmd.exe	40
PID 1852 wrote to memory of 2624	1852	cmd.exe	40
PID 1852 wrote to memory of 2624	1852	cmd.exe	40
PID 1852 wrote to memory of 2624	1852	cmd.exe	40
PID 1852 wrote to memory of 2624	1852	cmd.exe	40
PID 1852 wrote to memory of 2624	1852	cmd.exe	40
PID 1852 wrote to memory of 2624	1852	cmd.exe	40
PID 2896 wrote to memory of 2960	2896	net.exe	39
PID 2896 wrote to memory of 2960	2896	net.exe	39
PID 2896 wrote to memory of 2960	2896	net.exe	39
PID 2896 wrote to memory of 2960	2896	net.exe	39
PID 1152 wrote to memory of 2652	1152	Logo1_.exe	41
PID 1152 wrote to memory of 2652	1152	Logo1_.exe	41
PID 1152 wrote to memory of 2652	1152	Logo1_.exe	41
PID 1152 wrote to memory of 2652	1152	Logo1_.exe	41
PID 2652 wrote to memory of 2844	2652	net.exe	43
PID 2652 wrote to memory of 2844	2652	net.exe	43
PID 2652 wrote to memory of 2844	2652	net.exe	43
PID 2652 wrote to memory of 2844	2652	net.exe	43
PID 1152 wrote to memory of 1236	1152	Logo1_.exe	21
PID 1152 wrote to memory of 1236	1152	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1236
- C:\Users\Admin\AppData\Local\Temp\4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
  "C:\Users\Admin\AppData\Local\Temp\4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aD1A1.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe
      "C:\Users\Admin\AppData\Local\Temp\4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2624
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
aafff27a423e2993ede528075c1f1852

SHA1
fb5f5d781a2f405a62658ee6156806cb1440af50

SHA256
a341ea6ea0b94996007723410bfcb17cce91cfcab0e86e111a3b320afea0d6b3

SHA512
63be407cb2a41809bc9d6174baacd6dac700eebfbccefa49593daa33fa7570c08dac58a267dfe50214118dba19065e6fb70820178558c26c7b14e27c33f08490

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
221886d1b103525fc407c8fed3ab083e

SHA1
965d60f0b645def3fdc5dc1d0178b6bfee45d941

SHA256
12b9b8617c5633e47953da144c80388512ee9a5fcb4fe7d0c143a3bc08e90458

SHA512
f5f7aea322a28570dfa57b5344002759e043b1f0e2806d95ee2492f6fe6a8a3cd5a9f8817cd4714cfa9f90fb219613654f03ed5b7e4ccf7b0761d9f945485348

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aD1A1.bat

Filesize
722B

MD5
9f724fb1eb3cda255804efc37311486e

SHA1
2721d1c535cc4e77e77c130840b1c95876348c32

SHA256
48c3cb855251b1b90cff0089bc36c685098e8ea4a9cb04344a34b8aedb20e472

SHA512
61fd19a1a8ba489d91b8e291fb0ebda2a0480bcdd6c89b9901c7a7107dbc607eddc954b0ceed1826d8f04034bfe64714a0790492514d9c15ee33d0bf6a705f3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4b08663a1ea030d9b396d356fbf16b1ba2f3671118285952f2aaf2254e4c868c.exe.exe

Filesize
231KB

MD5
6f581a41167d2d484fcba20e6fc3c39a

SHA1
d48de48d24101b9baaa24f674066577e38e6b75c

SHA256
3eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7

SHA512
e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
da194ed032e8c4c99f906abd0b52e279

SHA1
77b06c04e207481522179ea7ac71c7ebdc80b70e

SHA256
b06e9af9027c0f9b6929c97f21192d88b44fc4e0be72db6db918398eb8ea183b

SHA512
02a6b836e8f8221d994fcad3f05bec20ea32029cbd56946670414b0fd3b4d391c6ccf455f2c18fc6a5e0d0d4174cc402cabe3ea8109e7bca27e9e728aea43f1a

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
832B

MD5
7e3a0edd0c6cd8316f4b6c159d5167a1

SHA1
753428b4736ffb2c9e3eb50f89255b212768c55a

SHA256
1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

SHA512
9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1846800975-3917212583-2893086201-1000\_desktop.ini

Filesize
10B

MD5
1603436fb34d76c51d66ab1816519131

SHA1
3d5dc4ccfe3cc992c253dccfccf66ea727f66bf6

SHA256
9072a674ab684ff3ef851bf4f0fdc4118d2bcbe765282f38f3f6de4360057d60

SHA512
30d89b59822313e4b281b8f63b959f36262b2b948cf38e6389e9a1a7517c7c239349a41de9e35c8cd27d6b852ab5349206c2fb85b631dc59fab5421d997dbd46

Download Submit
memory/1152-23-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1152-35-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1152-2964-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1152-4153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1236-31-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2432-20-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2432-18-0x00000000002D0000-0x000000000030E000-memory.dmp

Filesize
248KB

Download
memory/2432-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2432-13-0x00000000002D0000-0x000000000030E000-memory.dmp

Filesize
248KB

Download