neshta | a73a05a4b6ec6ae1c1ba6d3d12b68cc52b899e2a6dbbaaa1f48f2c260a733123

Resubmissions

18-10-2024 17:25

241018-vzl1la1cqq 10

18-10-2024 16:26

241018-txhdyswgqh 10

18-10-2024 16:25

241018-tw78zsydrp 3

18-10-2024 16:22

241018-tvh8gawfqa 3

Analysis

max time kernel
150s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18-10-2024 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6812964531.exe
Size

67KB
MD5

7de65122a13ab9d81368ee3dff3cc80a
SHA1

ecbb4db641431d4d672e4b88e8d309419fd32f04
SHA256

a73a05a4b6ec6ae1c1ba6d3d12b68cc52b899e2a6dbbaaa1f48f2c260a733123
SHA512

b156d77a665c3256ddfd016e46105b6e87db6a4c1ca77e9bb25b221c368f3cc53dddc7159602cfb926ef0cc9bacac57b6bd41e7e28998883c996727d58d29401
SSDEEP

1536:pr3rob4nqB6veqHnq+Pgm5NN9vbDTc+1vIQ/EXyBej:h7PEg3qcv5PvB/EVj

Score

10^/10

neshta bootkit discovery evasion persistence spyware trojan

Malware Config

Signatures

Detect Neshta payload 1 IoCs

Processes:

resource	yara_rule
behavioral4/files/0x0002000000025b09-560.dat	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

cheat_master_install.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cheat_master_install.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

cheat_master_install.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	cheat_master_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat_master_install.exe"	cheat_master_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	cheat_master_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat_master_install.exe"	cheat_master_install.exe

Executes dropped EXE 5 IoCs

Processes:

cheat_master_install.execheat_master_install.exe3mb_online_install.exewindef_installer.exewindef_installer.exe

pid	Process
372	cheat_master_install.exe
2676	cheat_master_install.exe
4520	3mb_online_install.exe
2204	windef_installer.exe
1224	windef_installer.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

windef_installer.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	windef_installer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cheat_master_install.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Java = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat_master_install.exe"	cheat_master_install.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

cheat_master_install.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cheat_master_install.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

cheat_master_install.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cheat_master_install.exe

Drops file in Windows directory 1 IoCs

Processes:

windef_installer.exe

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	windef_installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

windef_installer.exewindef_installer.exe6812964531.execheat_master_install.execheat_master_install.exe3mb_online_install.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windef_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windef_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6812964531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cheat_master_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cheat_master_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3mb_online_install.exe

Modifies registry class 2 IoCs

Processes:

windef_installer.exejava.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	windef_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	java.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cheat_master_install.exe

pid	Process
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe
372	cheat_master_install.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1900	WMIC.exe
Token: SeSecurityPrivilege	1900	WMIC.exe
Token: SeTakeOwnershipPrivilege	1900	WMIC.exe
Token: SeLoadDriverPrivilege	1900	WMIC.exe
Token: SeSystemProfilePrivilege	1900	WMIC.exe
Token: SeSystemtimePrivilege	1900	WMIC.exe
Token: SeProfSingleProcessPrivilege	1900	WMIC.exe
Token: SeIncBasePriorityPrivilege	1900	WMIC.exe
Token: SeCreatePagefilePrivilege	1900	WMIC.exe
Token: SeBackupPrivilege	1900	WMIC.exe
Token: SeRestorePrivilege	1900	WMIC.exe
Token: SeShutdownPrivilege	1900	WMIC.exe
Token: SeDebugPrivilege	1900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1900	WMIC.exe
Token: SeRemoteShutdownPrivilege	1900	WMIC.exe
Token: SeUndockPrivilege	1900	WMIC.exe
Token: SeManageVolumePrivilege	1900	WMIC.exe
Token: 33	1900	WMIC.exe
Token: 34	1900	WMIC.exe
Token: 35	1900	WMIC.exe
Token: 36	1900	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1900	WMIC.exe
Token: SeSecurityPrivilege	1900	WMIC.exe
Token: SeTakeOwnershipPrivilege	1900	WMIC.exe
Token: SeLoadDriverPrivilege	1900	WMIC.exe
Token: SeSystemProfilePrivilege	1900	WMIC.exe
Token: SeSystemtimePrivilege	1900	WMIC.exe
Token: SeProfSingleProcessPrivilege	1900	WMIC.exe
Token: SeIncBasePriorityPrivilege	1900	WMIC.exe
Token: SeCreatePagefilePrivilege	1900	WMIC.exe
Token: SeBackupPrivilege	1900	WMIC.exe
Token: SeRestorePrivilege	1900	WMIC.exe
Token: SeShutdownPrivilege	1900	WMIC.exe
Token: SeDebugPrivilege	1900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1900	WMIC.exe
Token: SeRemoteShutdownPrivilege	1900	WMIC.exe
Token: SeUndockPrivilege	1900	WMIC.exe
Token: SeManageVolumePrivilege	1900	WMIC.exe
Token: 33	1900	WMIC.exe
Token: 34	1900	WMIC.exe
Token: 35	1900	WMIC.exe
Token: 36	1900	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2384	WMIC.exe
Token: SeSecurityPrivilege	2384	WMIC.exe
Token: SeTakeOwnershipPrivilege	2384	WMIC.exe
Token: SeLoadDriverPrivilege	2384	WMIC.exe
Token: SeSystemProfilePrivilege	2384	WMIC.exe
Token: SeSystemtimePrivilege	2384	WMIC.exe
Token: SeProfSingleProcessPrivilege	2384	WMIC.exe
Token: SeIncBasePriorityPrivilege	2384	WMIC.exe
Token: SeCreatePagefilePrivilege	2384	WMIC.exe
Token: SeBackupPrivilege	2384	WMIC.exe
Token: SeRestorePrivilege	2384	WMIC.exe
Token: SeShutdownPrivilege	2384	WMIC.exe
Token: SeDebugPrivilege	2384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2384	WMIC.exe
Token: SeRemoteShutdownPrivilege	2384	WMIC.exe
Token: SeUndockPrivilege	2384	WMIC.exe
Token: SeManageVolumePrivilege	2384	WMIC.exe
Token: 33	2384	WMIC.exe
Token: 34	2384	WMIC.exe
Token: 35	2384	WMIC.exe
Token: 36	2384	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2384	WMIC.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

java.exejavaw.execheat_master_install.execheat_master_install.exe

pid	Process
4860	java.exe
5056	javaw.exe
372	cheat_master_install.exe
2676	cheat_master_install.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

6812964531.exejavaw.exejava.execmd.execmd.exejavaw.execmd.execmd.exewindef_installer.exejavaw.execmd.execmd.exe

description	pid	Process	procid_target
PID 900 wrote to memory of 3496	900	6812964531.exe	77
PID 900 wrote to memory of 3496	900	6812964531.exe	77
PID 3496 wrote to memory of 4860	3496	javaw.exe	78
PID 3496 wrote to memory of 4860	3496	javaw.exe	78
PID 4860 wrote to memory of 312	4860	java.exe	80
PID 4860 wrote to memory of 312	4860	java.exe	80
PID 312 wrote to memory of 2064	312	cmd.exe	82
PID 312 wrote to memory of 2064	312	cmd.exe	82
PID 4860 wrote to memory of 1724	4860	java.exe	83
PID 4860 wrote to memory of 1724	4860	java.exe	83
PID 1724 wrote to memory of 372	1724	cmd.exe	85
PID 1724 wrote to memory of 372	1724	cmd.exe	85
PID 4860 wrote to memory of 5056	4860	java.exe	86
PID 4860 wrote to memory of 5056	4860	java.exe	86
PID 5056 wrote to memory of 3440	5056	javaw.exe	87
PID 5056 wrote to memory of 3440	5056	javaw.exe	87
PID 3440 wrote to memory of 1900	3440	cmd.exe	89
PID 3440 wrote to memory of 1900	3440	cmd.exe	89
PID 5056 wrote to memory of 2248	5056	javaw.exe	90
PID 5056 wrote to memory of 2248	5056	javaw.exe	90
PID 2248 wrote to memory of 2384	2248	cmd.exe	92
PID 2248 wrote to memory of 2384	2248	cmd.exe	92
PID 5056 wrote to memory of 372	5056	javaw.exe	96
PID 5056 wrote to memory of 372	5056	javaw.exe	96
PID 5056 wrote to memory of 372	5056	javaw.exe	96
PID 5056 wrote to memory of 4520	5056	javaw.exe	99
PID 5056 wrote to memory of 4520	5056	javaw.exe	99
PID 5056 wrote to memory of 4520	5056	javaw.exe	99
PID 5056 wrote to memory of 2204	5056	javaw.exe	100
PID 5056 wrote to memory of 2204	5056	javaw.exe	100
PID 5056 wrote to memory of 2204	5056	javaw.exe	100
PID 2204 wrote to memory of 1224	2204	windef_installer.exe	101
PID 2204 wrote to memory of 1224	2204	windef_installer.exe	101
PID 2204 wrote to memory of 1224	2204	windef_installer.exe	101
PID 544 wrote to memory of 2540	544	javaw.exe	102
PID 544 wrote to memory of 2540	544	javaw.exe	102
PID 2540 wrote to memory of 4840	2540	cmd.exe	104
PID 2540 wrote to memory of 4840	2540	cmd.exe	104
PID 544 wrote to memory of 636	544	javaw.exe	105
PID 544 wrote to memory of 636	544	javaw.exe	105
PID 636 wrote to memory of 4584	636	cmd.exe	107
PID 636 wrote to memory of 4584	636	cmd.exe	107

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

cheat_master_install.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cheat_master_install.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cheat_master_install.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	cheat_master_install.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6812964531.exe
"C:\Users\Admin\AppData\Local\Temp\6812964531.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:900
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\6812964531.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    java -jar C:\Users\Admin\download_libra.jar
    3⤵
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:312
    - - C:\Windows\system32\cacls.exe
        
        "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
        5⤵
        
        PID:2064
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c SCHTASKS /CREATE /F /SC MINUTE /TN OneDrive\OneDriveUpdateTask /RL HIGHEST /TR C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /CREATE /F /SC MINUTE /TN OneDrive\OneDriveUpdateTask /RL HIGHEST /TR C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:372
  - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar"
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3440
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c wmic cpu get name
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2248
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic cpu get name
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\cheat_master_install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cheat_master_install.exe"
        5⤵
        UAC bypass
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:372
    - - C:\Users\Admin\AppData\Local\Temp\3mb_online_install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3mb_online_install.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\windef_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\windef_installer.exe"
        5⤵
        Executes dropped EXE
        Modifies system executable filetype association
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\3582-490\windef_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\windef_installer.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1224

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar"
1⤵
PID:640

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\system32\cmd.exe
  cmd /c wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    PID:4840
- C:\Windows\system32\cmd.exe
  cmd /c wmic cpu get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:4584

C:\Users\Admin\AppData\Local\Temp\cheat_master_install.exe
C:\Users\Admin\AppData\Local\Temp\cheat_master_install.exe explorer.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
ba5cd4b8f29768a15240c4ed4626b2da

SHA1
5ac8cf09005824a02396e6ce6bc1d5c44159d0c7

SHA256
0419c456c0faac042de35afe05edd20c8f4fbebc800880afbf698eb0419bab28

SHA512
82e56a738561f867f97136da3f323053c185fac01cec2b7c2ffdf6abbd6578d5a2603b9c8fad5723bc403a38b7e9f7761760e0ace616ad3e0494a8531d48bf2b

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\windef_installer.exe

Filesize
5.1MB

MD5
86a1cbee2b7dc5d64051c83c82c8d02b

SHA1
55d82d17f7f10d088909d0cb7116969d12308974

SHA256
d3f47cd85c525a0c3ed855949bf27023c27b24c51d388166d72d4fa8cae4c2f5

SHA512
6720ecb2799185bf2a03259766e3dd38aeaec674a3a28e657bd55131b1e9fb18fab118afc3aa7881de56d7af36d60bf8b29449065ba32c5cf0dea38fb892ecbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3mb_online_install.exe

Filesize
3.0MB

MD5
89adc93450933f84d40ba2d07de9f55d

SHA1
3bdbe9c88b36c79ff2f29839993d2622b894f2fd

SHA256
ef10ef6ec96b3afa2b121edbf8cc45735e06842a26d48e55cc1fff42aa665087

SHA512
49b0b71a2865081759890f9414216f3ab9a6b7579f3f0287157b8c89de8dd61da13a1f6ebaf19aa859bd60a373c0a00f036f6bf97357643235cdbada58204720

Download Submit
C:\Users\Admin\AppData\Local\Temp\cheat_master_install.exe

Filesize
2.5MB

MD5
8a7174b8fb3eafebd5b59dcea31a88fa

SHA1
7783ab6618807000e0ca219465e3774d2a643dad

SHA256
9ab066c5398610d0c3a442e60bca5f7d6d89e645a8cfe8b6216a736af10fce33

SHA512
c5814dc9e8e7c9d2668f0d2031e54b7d1657029c693c0bc0b0506fc7bc07be1091ddc1257f5bd02dc46c1ebeecb292752b7a45479a9cd5aac2c65e92a1e6427e

Download Submit
C:\Users\Admin\AppData\Local\Temp\windef_installer.exe

Filesize
5.2MB

MD5
d5f38176aa233dc3a85f2c3e7c6cf1f7

SHA1
022ea6d320067d2429b26cc424145610fa0ad28e

SHA256
db307d31bbb3d282685bf28e0abf464a931fa749633d784e39adbe7d8d8ead31

SHA512
f58f855e3a102b6ccb4197b38323149342c23c2182b6309074d5720c2b2f20d764c33b10013834e85f73e22c0b7ab95ec4171ff251523b598821ad632af5a893

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3973800497-2716210218-310192997-1000\83aa4cc77f591dfc2374580bbd95f6ba_43ef074c-17c1-4956-ab3f-c3b0c6ae62b9

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\download_libra.jar

Filesize
25.9MB

MD5
df616fd81f8ee6e3a87e4a065c3cbfd6

SHA1
434a2c9c17c41972daf12f31bd69fb6740fbb051

SHA256
6011bacfd1df40248d92e7e71570f1bfc2288886fab7ff1102a8987a3b12829e

SHA512
6105ce13d2f07540371a156ac967c3bb788fdb529aabc65114fe186ce523b3daaab658bce31ba9e00bd7151afdb99b20cbe023383c1baff78acac0a3c5c78c51

Download Submit
memory/640-294-0x000002DCBB360000-0x000002DCBB361000-memory.dmp

Filesize
4KB

Download
memory/900-0-0x0000000000ED0000-0x0000000000EEF000-memory.dmp

Filesize
124KB

Download
memory/3496-109-0x000001A4017F0000-0x000001A401800000-memory.dmp

Filesize
64KB

Download
memory/3496-163-0x000001A4018A0000-0x000001A4018B0000-memory.dmp

Filesize
64KB

Download
memory/3496-33-0x000001A401410000-0x000001A401680000-memory.dmp

Filesize
2.4MB

Download
memory/3496-36-0x000001A401680000-0x000001A401690000-memory.dmp

Filesize
64KB

Download
memory/3496-35-0x000001A401720000-0x000001A401730000-memory.dmp

Filesize
64KB

Download
memory/3496-39-0x000001A401730000-0x000001A401740000-memory.dmp

Filesize
64KB

Download
memory/3496-38-0x000001A401690000-0x000001A4016A0000-memory.dmp

Filesize
64KB

Download
memory/3496-34-0x000001A401710000-0x000001A401720000-memory.dmp

Filesize
64KB

Download
memory/3496-44-0x000001A401740000-0x000001A401750000-memory.dmp

Filesize
64KB

Download
memory/3496-43-0x000001A4016A0000-0x000001A4016B0000-memory.dmp

Filesize
64KB

Download
memory/3496-50-0x000001A401750000-0x000001A401760000-memory.dmp

Filesize
64KB

Download
memory/3496-49-0x000001A4016C0000-0x000001A4016D0000-memory.dmp

Filesize
64KB

Download
memory/3496-48-0x000001A4016B0000-0x000001A4016C0000-memory.dmp

Filesize
64KB

Download
memory/3496-53-0x000001A401760000-0x000001A401770000-memory.dmp

Filesize
64KB

Download
memory/3496-57-0x000001A401770000-0x000001A401780000-memory.dmp

Filesize
64KB

Download
memory/3496-56-0x000001A4016D0000-0x000001A4016E0000-memory.dmp

Filesize
64KB

Download
memory/3496-59-0x000001A401780000-0x000001A401790000-memory.dmp

Filesize
64KB

Download
memory/3496-58-0x000001A4016E0000-0x000001A4016F0000-memory.dmp

Filesize
64KB

Download
memory/3496-62-0x000001A401790000-0x000001A4017A0000-memory.dmp

Filesize
64KB

Download
memory/3496-61-0x000001A4016F0000-0x000001A401700000-memory.dmp

Filesize
64KB

Download
memory/3496-65-0x000001A4017A0000-0x000001A4017B0000-memory.dmp

Filesize
64KB

Download
memory/3496-64-0x000001A401700000-0x000001A401710000-memory.dmp

Filesize
64KB

Download
memory/3496-68-0x000001A4017B0000-0x000001A4017C0000-memory.dmp

Filesize
64KB

Download
memory/3496-67-0x000001A401710000-0x000001A401720000-memory.dmp

Filesize
64KB

Download
memory/3496-72-0x000001A4017C0000-0x000001A4017D0000-memory.dmp

Filesize
64KB

Download
memory/3496-71-0x000001A401720000-0x000001A401730000-memory.dmp

Filesize
64KB

Download
memory/3496-75-0x000001A4017D0000-0x000001A4017E0000-memory.dmp

Filesize
64KB

Download
memory/3496-74-0x000001A401730000-0x000001A401740000-memory.dmp

Filesize
64KB

Download
memory/3496-76-0x000001A47F250000-0x000001A47F251000-memory.dmp

Filesize
4KB

Download
memory/3496-77-0x000001A401740000-0x000001A401750000-memory.dmp

Filesize
64KB

Download
memory/3496-79-0x000001A401750000-0x000001A401760000-memory.dmp

Filesize
64KB

Download
memory/3496-80-0x000001A4017E0000-0x000001A4017F0000-memory.dmp

Filesize
64KB

Download
memory/3496-83-0x000001A401760000-0x000001A401770000-memory.dmp

Filesize
64KB

Download
memory/3496-84-0x000001A4017F0000-0x000001A401800000-memory.dmp

Filesize
64KB

Download
memory/3496-86-0x000001A401770000-0x000001A401780000-memory.dmp

Filesize
64KB

Download
memory/3496-87-0x000001A401800000-0x000001A401810000-memory.dmp

Filesize
64KB

Download
memory/3496-90-0x000001A401780000-0x000001A401790000-memory.dmp

Filesize
64KB

Download
memory/3496-91-0x000001A401810000-0x000001A401820000-memory.dmp

Filesize
64KB

Download
memory/3496-93-0x000001A401790000-0x000001A4017A0000-memory.dmp

Filesize
64KB

Download
memory/3496-94-0x000001A47F250000-0x000001A47F251000-memory.dmp

Filesize
4KB

Download
memory/3496-97-0x000001A4017A0000-0x000001A4017B0000-memory.dmp

Filesize
64KB

Download
memory/3496-98-0x000001A401820000-0x000001A401830000-memory.dmp

Filesize
64KB

Download
memory/3496-100-0x000001A401830000-0x000001A401840000-memory.dmp

Filesize
64KB

Download
memory/3496-116-0x000001A401850000-0x000001A401860000-memory.dmp

Filesize
64KB

Download
memory/3496-102-0x000001A4017C0000-0x000001A4017D0000-memory.dmp

Filesize
64KB

Download
memory/3496-105-0x000001A401840000-0x000001A401850000-memory.dmp

Filesize
64KB

Download
memory/3496-104-0x000001A4017D0000-0x000001A4017E0000-memory.dmp

Filesize
64KB

Download
memory/3496-107-0x000001A4017E0000-0x000001A4017F0000-memory.dmp

Filesize
64KB

Download
memory/3496-28-0x000001A4016F0000-0x000001A401700000-memory.dmp

Filesize
64KB

Download
memory/3496-110-0x000001A401800000-0x000001A401810000-memory.dmp

Filesize
64KB

Download
memory/3496-111-0x000001A401810000-0x000001A401820000-memory.dmp

Filesize
64KB

Download
memory/3496-112-0x000001A401820000-0x000001A401830000-memory.dmp

Filesize
64KB

Download
memory/3496-113-0x000001A401830000-0x000001A401840000-memory.dmp

Filesize
64KB

Download
memory/3496-115-0x000001A401840000-0x000001A401850000-memory.dmp

Filesize
64KB

Download
memory/3496-99-0x000001A4017B0000-0x000001A4017C0000-memory.dmp

Filesize
64KB

Download
memory/3496-3-0x000001A401410000-0x000001A401680000-memory.dmp

Filesize
2.4MB

Download
memory/3496-31-0x000001A401700000-0x000001A401710000-memory.dmp

Filesize
64KB

Download
memory/3496-131-0x000001A401870000-0x000001A401880000-memory.dmp

Filesize
64KB

Download
memory/3496-132-0x000001A401880000-0x000001A401890000-memory.dmp

Filesize
64KB

Download
memory/3496-134-0x000001A401890000-0x000001A4018A0000-memory.dmp

Filesize
64KB

Download
memory/3496-137-0x000001A4018A0000-0x000001A4018B0000-memory.dmp

Filesize
64KB

Download
memory/3496-138-0x000001A4018B0000-0x000001A4018C0000-memory.dmp

Filesize
64KB

Download
memory/3496-140-0x000001A4018C0000-0x000001A4018D0000-memory.dmp

Filesize
64KB

Download
memory/3496-142-0x000001A4018D0000-0x000001A4018E0000-memory.dmp

Filesize
64KB

Download
memory/3496-144-0x000001A4018E0000-0x000001A4018F0000-memory.dmp

Filesize
64KB

Download
memory/3496-150-0x000001A401860000-0x000001A401870000-memory.dmp

Filesize
64KB

Download
memory/3496-153-0x000001A4018F0000-0x000001A401900000-memory.dmp

Filesize
64KB

Download
memory/3496-152-0x000001A401870000-0x000001A401880000-memory.dmp

Filesize
64KB

Download
memory/3496-156-0x000001A401900000-0x000001A401910000-memory.dmp

Filesize
64KB

Download
memory/3496-155-0x000001A401880000-0x000001A401890000-memory.dmp

Filesize
64KB

Download
memory/3496-159-0x000001A401910000-0x000001A401920000-memory.dmp

Filesize
64KB

Download
memory/3496-158-0x000001A401890000-0x000001A4018A0000-memory.dmp

Filesize
64KB

Download
memory/3496-164-0x000001A4018B0000-0x000001A4018C0000-memory.dmp

Filesize
64KB

Download
memory/3496-127-0x000001A401850000-0x000001A401860000-memory.dmp

Filesize
64KB

Download
memory/3496-168-0x000001A401920000-0x000001A401930000-memory.dmp

Filesize
64KB

Download
memory/3496-26-0x000001A4016E0000-0x000001A4016F0000-memory.dmp

Filesize
64KB

Download
memory/3496-180-0x000001A4018C0000-0x000001A4018D0000-memory.dmp

Filesize
64KB

Download
memory/3496-12-0x000001A47F250000-0x000001A47F251000-memory.dmp

Filesize
4KB

Download
memory/3496-22-0x000001A4016B0000-0x000001A4016C0000-memory.dmp

Filesize
64KB

Download
memory/3496-192-0x000001A4018D0000-0x000001A4018E0000-memory.dmp

Filesize
64KB

Download
memory/3496-14-0x000001A401680000-0x000001A401690000-memory.dmp

Filesize
64KB

Download
memory/3496-195-0x000001A4018E0000-0x000001A4018F0000-memory.dmp

Filesize
64KB

Download
memory/3496-16-0x000001A401690000-0x000001A4016A0000-memory.dmp

Filesize
64KB

Download
memory/3496-23-0x000001A4016C0000-0x000001A4016D0000-memory.dmp

Filesize
64KB

Download
memory/3496-18-0x000001A4016A0000-0x000001A4016B0000-memory.dmp

Filesize
64KB

Download
memory/3496-215-0x000001A47F250000-0x000001A47F251000-memory.dmp

Filesize
4KB

Download
memory/3496-225-0x000001A401700000-0x000001A401710000-memory.dmp

Filesize
64KB

Download
memory/3496-224-0x000001A4016F0000-0x000001A401700000-memory.dmp

Filesize
64KB

Download
memory/3496-223-0x000001A4016E0000-0x000001A4016F0000-memory.dmp

Filesize
64KB

Download
memory/3496-222-0x000001A4016D0000-0x000001A4016E0000-memory.dmp

Filesize
64KB

Download
memory/3496-221-0x000001A4016C0000-0x000001A4016D0000-memory.dmp

Filesize
64KB

Download
memory/3496-220-0x000001A4016B0000-0x000001A4016C0000-memory.dmp

Filesize
64KB

Download
memory/3496-219-0x000001A4016A0000-0x000001A4016B0000-memory.dmp

Filesize
64KB

Download
memory/3496-218-0x000001A401690000-0x000001A4016A0000-memory.dmp

Filesize
64KB

Download
memory/3496-217-0x000001A401680000-0x000001A401690000-memory.dmp

Filesize
64KB

Download
memory/3496-216-0x000001A401720000-0x000001A401730000-memory.dmp

Filesize
64KB

Download
memory/3496-128-0x000001A401860000-0x000001A401870000-memory.dmp

Filesize
64KB

Download
memory/3496-24-0x000001A4016D0000-0x000001A4016E0000-memory.dmp

Filesize
64KB

Download
memory/4860-214-0x0000021C540D0000-0x0000021C54340000-memory.dmp

Filesize
2.4MB

Download
memory/4860-201-0x0000021C540B0000-0x0000021C540B1000-memory.dmp

Filesize
4KB

Download
memory/4860-194-0x0000021C540B0000-0x0000021C540B1000-memory.dmp

Filesize
4KB

Download
memory/4860-181-0x0000021C540D0000-0x0000021C54340000-memory.dmp

Filesize
2.4MB

Download
memory/5056-262-0x000001A69F230000-0x000001A69F231000-memory.dmp

Filesize
4KB

Download
memory/5056-267-0x000001A69F230000-0x000001A69F231000-memory.dmp

Filesize
4KB

Download
memory/5056-268-0x000001A69F230000-0x000001A69F231000-memory.dmp

Filesize
4KB

Download
memory/5056-271-0x000001A69F230000-0x000001A69F231000-memory.dmp

Filesize
4KB

Download
memory/5056-272-0x000001A69F230000-0x000001A69F231000-memory.dmp

Filesize
4KB

Download
memory/5056-258-0x000001A69F230000-0x000001A69F231000-memory.dmp

Filesize
4KB

Download
memory/5056-282-0x000001A69F230000-0x000001A69F231000-memory.dmp

Filesize
4KB

Download