Overview

overview

10

Static

static

1

RNSM00379.7z

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RNSM00379.7z

  • Size

    27.9MB

  • Sample

    241104-wjg75stmds

  • MD5

    59e53cc4c3a9cb4d0b965ec637bcf169

  • SHA1

    cd9d547d737e2ca22d32722c23c1552e5e104b01

  • SHA256

    c21aa3d27a5957e5c39e4c0630d1c0e6a9083a670e0f1c81a1fba9fa1115442c

  • SHA512

    7c97a623dee692afe2d6380901ea6b5afad44ac9ae092ffc6114c26035faa77e5d3da81698ec3b6ae61ef64ff989741cc23f5dcf05cda7b194a758ec18ad06f4

  • SSDEEP

    786432:Y1c0lgTFvGoWFeKnWdNp/A/hcZD3pMawtwvLytbPM19:Y15lOFgFeKnqIhUDZGwDytbA

Score
10/10
agenttesladharmadjvuemotetgandcrabhawkeye_rebornlokibotmimikatzsodinokibixtremerat$2a$10$nwpirsot/ccktpp00tnxqofn2ns9abxbedablqph5cricw8.cqoug1648epoch1283929323382backdoorbankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactkeyloggerpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

187.162.62.135:80

181.231.72.200:80

45.55.83.204:8080

104.236.217.164:8080

128.199.78.227:8080

46.101.123.139:8080

185.94.252.27:443

181.171.118.19:80

46.21.105.59:8080

105.224.171.102:80

86.6.188.121:80

190.246.146.101:80

200.80.198.34:80

200.58.171.51:80

109.104.79.48:8080

89.134.144.41:8080

159.65.241.220:8080

186.23.146.42:80

203.25.159.3:8080

190.1.37.125:443
rsa_pubkey.plain

Extracted

Path

C:\$Recycle.Bin\YEYFQM-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .YEYFQM The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/5ef1df3d38d4324c | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAHDlol+ijchnq1YSzUPMFe0FT+qYf2xKtA28Y3LrLIQQNqRLBRtEPLBowukVlfwumGH0IleCEfPKG+76we5+2/yyaQEY5wwWVQ8Rj6pUCvBECVr755Xl8qREENmAONBij6nXQx9lTfCcDoW+M4VI25Am3ww3CuuFO6otSvYKIaXLdRo/7jPayJuczyIRcY8FvxRs3oQGadh6u9cea+IuHNrM33gCLCEcSbhjWgCiQHDsp6CswMoZU00+KMDSQtfpnl01r/SMrTZlpCpxvZvA87298ByLJnPvTBYZiZ6At7X3H8/3olDGR+0m/WCs4F+fcqGrpc/U8i2MPWBHpQQ2MjINO4my7VF8qwNuSfquliiEqzOhocrQqQwVcR05G8k5Z9+csJNqYZrplYiyVIIkD8vAASi2ym5POI2OoBgRaXCCcn0AvkRswi9LXz1OhUQiNL+aHHyouYEKPik6iRTDEaXMLpoXcNipW1SQUxXnwWcPzd3q5UdrD0cE027hUn9kxttXEgWQSbrjXXP2gvN2n/Hb0Flon/lTqhHCLGw4uobZRiZMzxES15avNHxWmHKlhhe2iScHeHK5lKmunTIqLwOf9J5HI6P/bgOMTLPk4PPPJJKiKiH8rWYBJKtgV+6is6Ew/XMh9IgvBEabVU8Ojrp3IFamQcBpdymHAi8Txnqr4WoYhWF0KfknEow2lKWaRFzFt7l7g2vK3nD/Y4WC7DEVukRnXYMmHS+XPomyWVrVDjTou0lhBw2++bwwx1pfoSMdKc5+bHUeuGEM9pQnMxpFUfOvH0XT+EhkEo3rNyX27G2lO+Vm/Fb707f7UdOBOJqlcyN7IrhW7vDJM1CQ0Df0YwYiRImP/DfzkIKVgBC9I2Z599jwiJ8w8ZvQv+QCUEfnQq3KSc1UNbHdsjuffGIdVMGBxQVg8SBskXLd49hxfZbq5m9B/0TQ2dT6RXhuHccQon4sICvsFWMMuChCMhEgk91beNAh/Wv1flaysKe3Bz7DBmYn3nIvMgZER/briE02+V4X5+G68Q+oBYGFAJvMKvko8QWvR3XQqeckCI9uneSRbkLo4XCzPD1Wsc8Ls4zxdbT0pBmMGklhyR4ruUJSAI3mRfpVebpM35eWgw0DCafXpyQx4/HbIlDPY2G7SIPcrq6uzc+OKgUCVS+C7UwDmyZYpipZ41TinEm77M16ARRTl4bkI8AFCiXrtnzV9CGsNI0qR9qZz+sY/DpYuyd9EgYMbXOnRh9Zw+840T1JK6UYamC2hJsYTjPwy3EYZXZirBqN4xS0whHxSpOQpviczLGOZGi4daUWcyWnoTn055lsVmQwoVcm5pJCu0omEEOEO56PNyFbmeqiurbmOJ166vCVWhmuwEmPof1Udp/NBSeYIMbj5R3dgPuBIXU7UTgaWoXiy41X3Ayzxzg9frRIk9lc1nZia6z7ZLbrSmImVcQmKGHaycNGJ6PbqYpIg9UfAjeBw0tWPDCiIWruUHrFmBrSib5XnvGwjixQMoouBOvnqZ7gk0hOOQtwLTYhubkAJrAuLFYBv7YwCgUWWmkZ+P7d6PBBYJT8LnkCc5eCd/w+W+kYyYrwVupL2gu1txRlCPK/B/SxzeHm8xf5zABnSGIejAdW2gwGbRlektYv3WKKcnv7nHixlMFpL9SjRqUEg11pCo+i1hXsVKZe2vMWHGL7eC76nFWALsndG7r2L1KooiVbQdOErNqBFzCsucutvRHf6Y+5G5SAxL2lDaZ3GNbSd4Lg6LBmDct1CP3nHclNG8oAFIZ2pWvRqmPkf1po5Q/seiW/UnUgQmkapEbpl+ds9Hs2ci2XyDqPaiWWdqahnyvR6esxU/MZ+Q9AmpsnMJfLidbL9D/jB9qxvUXDTnb6Fe1dhhauAn38UQkkqjLSLfsEzXwhjBaSOt58wNt/H7PitPFe8yO4VudqutI/gR4L2T0A8z0xtp3SDsMy23pxTxJGzaPPza8T9GMsdekU83TLjFN/0uDoRR/4EkD4Z8FkDTQDOhdjzN4YZ1MbGtbVUhWik9oRSwZwz8WQ8mumNNKy38GL54Lmc3YAiAmawYPRjhZR03XAgfb9Sz0lP4+uRDyjMaPw3SUvbJMFhNaFC4afO1HonnMyvZLsC6cUPMWRmSBzG+R4299HTPHCG2l2saBSRvmxNKD9SI/4kEcW0iIvMTJ8glDMO7NMYPFWqiiNpiztwNi6iLeuRG6k0Pndx37sBQbCqVJBRAxWG2DLKgQ= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDn9M3JLpDWAu+VvODPRWXIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJeNBYBnJqr8ZqR7a3MrGYmdeRhEfUP93y//NnLLDjCqP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoypS8D1fKlXTmS7q54Auw6gT2wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsyM4ANvhxNQXIE31UkGbyf6MN51c1gY/+uQbe2gEznTbCqfrOdcnPBOVfcolLq8b9QmbcC2V7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/5ef1df3d38d4324c

Extracted

Family

gandcrab

C2

http://gdcbghvjyqy7jclk.onion.top/

Extracted

Family

sodinokibi

Botnet

16

Campaign

2932

Decoy

premier-iowa.com

turing.academy

physio-lang.de

rarefoods.ro

palmecophilippines.com

ddmgen.com

omnicademy.com

baita.ac

cmascd.com

nationnewsroom.com

belofloripa.be

babysitting-hk.helpergo.co

tages-geldvergleich.de

iactechnologies.net

line-x.co.uk

richardiv.com

goeppinger-teppichreinigung.de

dinecorp.com

hawthornsretirement.co.uk

kerstliedjeszingen.nl
Attributes
  • net

    false

  • pid

    16

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2932

Extracted

Family

sodinokibi

Botnet

$2a$10$nWPIRSot/CckTPp00tnXQOFn2NS9abxBEdAbLQPH5CRiCW8.CQOuG

Campaign

3382

Decoy

bouldercafe-wuppertal.de

i-arslan.de

chavesdoareeiro.com

work2live.de

rehabilitationcentersinhouston.net

mirjamholleman.nl

pogypneu.sk

babcockchurch.org

lorenacarnero.com

schlafsack-test.net

c-a.co.in

lapinvihreat.fi

smart-light.co.uk

craigvalentineacademy.com

lange.host

amerikansktgodis.se

blacksirius.de

desert-trails.com

exenberger.at

hrabritelefon.hr
Attributes
  • net

    true

  • pid

    $2a$10$nWPIRSot/CckTPp00tnXQOFn2NS9abxBEdAbLQPH5CRiCW8.CQOuG

  • prc

    powerpnt

    winword

    ocssd

    onenote

    sqbcoreservice

    encsvc

    outlook

    oracle

    dbsnmp

    xfssvccon

    agntsvc

    dbeng50

    visio

    thebat

    mydesktopservice

    thunderbird

    msaccess

    mydesktopqos

    steam

    sql

    infopath

    firefox

    tbirdconfig

    wordpad

    isqlplussvc

    ocautoupds

    mspub

    synctime

    ocomm

    excel

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3382

  • svc

    sophos

    sql

    svc$

    memtas

    mepocs

    veeam

    backup

    vss

Extracted

Family

sodinokibi

Botnet

48

Campaign

2839

Decoy

fotoeditores.com

lisa-poncon.fr

loysonbryan.com

levencovka.ru

dierenambulancealkmaar.nl

apogeeconseils.fr

xn--ziinoapte-6ld.ro

mrkluttz.com

larchwoodmarketing.com

cymru.futbol

afbudsrejserallinclusive.dk

towelroot.co

frimec-international.es

fluzfluzrewards.com

liepertgrafikweb.at

sppdstats.com

happylublog.wordpress.com

kelsigordon.com

biodentify.ai

bratek-immobilien.de
Attributes
  • net

    false

  • pid

    48

  • prc

    pvlsvr

    dbsnmp

    VeeamDeploymentSvc

    dbeng50

    beserver

    bengien

    powerpnt

    bedbh

    EnterpriseClient

    ocomm

    outlook

    thunderbird

    thebat

    isqlplussvc

    steam

    infopath

    tbirdconfig

    xfssvccon

    sql

    onenote

    mydesktopservice

    DellSystemDetect

    visio

    sqbcoreservice

    msaccess

    ocssd

    raw_agent_svc

    oracle

    vxmon

    excel

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2839

  • svc

    stc_raw_agent

    BackupExecAgentAccelerator

    AcrSch2Svc

    vss

    backup

    PDVFSService

    VSNAPVSS

    VeeamDeploymentService

    sophos

    ARSM

    BackupExecVSSProvider

    memtas

    svc$

    MSSQL$

    BackupExecJobEngine

    VeeamTransportSvc

    VeeamNFSSvc

    mepocs

    BackupExecAgentBrowser

    MSSQL

    CAARCUpdateSvc

    CASAD2DWebSvc

    BackupExecManagementService

    veeam

    BackupExecRPCService

    MSExchange

    MVarmor64

    WSBExchange

    sql

    AcronisAgent

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

  • Protocol:     smtp
  • Host:
    smtp.mail.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    (#@jS%{GF;0
Mutex

51ca91c3-9a11-4443-9e61-ee6e5c097d44

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:(#@jS%{GF;0 _EmailPort:587 _EmailSSL:true _EmailServer:smtp.mail.ru _EmailUsername:[email protected] _ExecutionDelay:5 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:51ca91c3-9a11-4443-9e61-ee6e5c097d44 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Extracted

Family

lokibot

C2

http://107.175.150.73/~giftioz/.rojonm/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

djvu

C2

http://mopg.top/Asjdi435784ihjk65pen2/get.php

http://nokd.top/ydtftysdtyftysdfsdpen3/get.php

http://ring2.ug/As73yhsyU34578hxxx1/SDf565g/get.php
Attributes
  • extension

    .rezm

  • offline_id

    oTNOXYrFxLZ6FFJDHoOj4iFOlC2xJsN3KurV05t1

  • payload_url

    http://mopg.top/files/penelop/updatewin1.exe

    http://mopg.top/files/penelop/updatewin2.exe

    http://mopg.top/files/penelop/updatewin.exe

    http://mopg.top/files/penelop/3.exe

    http://mopg.top/files/penelop/4.exe

    http://mopg.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-yVc390S6cs Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0211Asd4a7d6

rsa_pubkey.plain
rsa_pubkey.plain
rsa_pubkey.plain

Extracted

Family

xtremerat

C2

iaficasioo.zapto.org

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.gandi.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Blessed000@

Targets

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

File and Directory Permissions Modification

1
T1222

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Network Service Discovery

1
T1046

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Service Stop

1
T1489

Tasks