6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
Size

5.7MB
MD5

dbf774762061218629602ed7f2a09b4c
SHA1

b4af1c088ba01df9aaf58065a1a49a259ad0acad
SHA256

6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d
SHA512

c7a7658c298739a665f14d20ba9ac547c352429269d6dddcf7c9afee09362cbbb90ab786dc273e5591c8b4ee5040c60c3c4c0ed11ecbbbe7da4c70256e242245
SSDEEP

49152:PPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:3KUgTH2M2m9UMpu1QfLczqssnKSk

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2716	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2224	Logo1_.exe
2840	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe

Loads dropped DLL 1 IoCs

pid	Process
2716	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\_desktop.ini	Logo1_.exe
File created	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe
2224	Logo1_.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1740	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	30
PID 1904 wrote to memory of 1740	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	30
PID 1904 wrote to memory of 1740	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	30
PID 1904 wrote to memory of 1740	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	30
PID 1740 wrote to memory of 1624	1740	net.exe	32
PID 1740 wrote to memory of 1624	1740	net.exe	32
PID 1740 wrote to memory of 1624	1740	net.exe	32
PID 1740 wrote to memory of 1624	1740	net.exe	32
PID 1904 wrote to memory of 2716	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	33
PID 1904 wrote to memory of 2716	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	33
PID 1904 wrote to memory of 2716	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	33
PID 1904 wrote to memory of 2716	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	33
PID 1904 wrote to memory of 2224	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	35
PID 1904 wrote to memory of 2224	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	35
PID 1904 wrote to memory of 2224	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	35
PID 1904 wrote to memory of 2224	1904	6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe	35
PID 2224 wrote to memory of 2148	2224	Logo1_.exe	36
PID 2224 wrote to memory of 2148	2224	Logo1_.exe	36
PID 2224 wrote to memory of 2148	2224	Logo1_.exe	36
PID 2224 wrote to memory of 2148	2224	Logo1_.exe	36
PID 2148 wrote to memory of 2764	2148	net.exe	38
PID 2148 wrote to memory of 2764	2148	net.exe	38
PID 2148 wrote to memory of 2764	2148	net.exe	38
PID 2148 wrote to memory of 2764	2148	net.exe	38
PID 2224 wrote to memory of 2904	2224	Logo1_.exe	40
PID 2224 wrote to memory of 2904	2224	Logo1_.exe	40
PID 2224 wrote to memory of 2904	2224	Logo1_.exe	40
PID 2224 wrote to memory of 2904	2224	Logo1_.exe	40
PID 2904 wrote to memory of 2796	2904	net.exe	42
PID 2904 wrote to memory of 2796	2904	net.exe	42
PID 2904 wrote to memory of 2796	2904	net.exe	42
PID 2904 wrote to memory of 2796	2904	net.exe	42
PID 2224 wrote to memory of 1152	2224	Logo1_.exe	20
PID 2224 wrote to memory of 1152	2224	Logo1_.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1152
- C:\Users\Admin\AppData\Local\Temp\6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
  "C:\Users\Admin\AppData\Local\Temp\6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a85D3.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe
      "C:\Users\Admin\AppData\Local\Temp\6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe"
      4⤵
      Executes dropped EXE
      PID:2840
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
44f2a0b82d8247e1cd5a12a40841f9a8

SHA1
f451bd8ba9098bb674624169aa40f0371ba67924

SHA256
056311169bf6ff9bf378a311dbd3c48697ccce39bedac8cb9ddb7da01384127d

SHA512
bd5f7bf6b83c70bd03416a4944f62fdafbcb7907c3321432c831e189e9d4f95a52faefa575de57209fa5c1523ebed5fde8831f6230fc6f23400bbd33e772c219

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a85D3.bat

Filesize
722B

MD5
a2f0d890835a6ab7621ad697f518ac83

SHA1
a448a17b8ab4d4f13ab60f6ba4c9fe434d858e9b

SHA256
e3d540e0eec04e6c0fe8d710bbc318a9a0bc001908b0dd9ccf4a4c01a9038ec7

SHA512
82b03de57675bfe69ecfba399c091206a8e18db4dd95af79e0532880dab35245af056d5b3e3d92f637a164c2762e4100f0cfc2fe2d3b7526a9a509b1228b388f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6e4f234bffcf629fc2a5d8cb6a5e0781a4c75914e5db1ababd6ea8ad8cf85c2d.exe.exe

Filesize
5.7MB

MD5
ba18e99b3e17adb5b029eaebc457dd89

SHA1
ec0458f3c00d35b323f08d4e1cc2e72899429c38

SHA256
f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628

SHA512
1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
bb7a959afa557a1dc0cb19123d5c8f44

SHA1
b74c512d322dbfa17a9a2af5a8b13e8316f9fd92

SHA256
7754309e77ab4518ee646527676b9f3edb8fe283ee2b2a8a3e4841f2faf95250

SHA512
5973465fa8e2d88cd0de458f91e645484af8940b086118238f27443eb3e1071b16cbbef5b3a723f0c9e7323dce0fa96c489e8dc0785ac82b750bcd9c7190fd69

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\_desktop.ini

Filesize
10B

MD5
d005ae1ecb6b06ec6c392c7dd1dfe7e1

SHA1
323a3af7f375573f33f35736435519df461ee8b0

SHA256
a342a9e9cd7e75b9740454b74f63ba6b3eac159bf04a04772271fcc0b4e9f6bd

SHA512
41628199761447acac22869b32d096f2b49a3159c6fdda216514f3e136fc7028e05c63edc4aab205ee065677b1c011c9cbf28239c819fadc5dde460ca03507e0

Download Submit
memory/1152-29-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/1904-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1904-18-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1904-17-0x00000000003C0000-0x00000000003FD000-memory.dmp

Filesize
244KB

Download
memory/1904-16-0x00000000003C0000-0x00000000003FD000-memory.dmp

Filesize
244KB

Download
memory/2224-20-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2224-2962-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2224-33-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2224-4155-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download