14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13

Analysis

max time kernel
118s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe
Size 1.2MB
Sample241109-3vhflstpcw
SHA256 14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13
MD5 8887c5db714b065926289af3cec1b1c0
SHA1 2cae053964382ae5aec3f1c39fdf949e862ffb82
SHA512 c7ac79618778cd0620cea349d37f8f2296794f317e95e27fc7e6e387a6269ea655361f3219c5cc28aa70db91a03779c011b2d73f487191151098a338fecd27f0
SSDEEP 24576:nFo0Ivtw+m/1/aq3AHrF+hFj4iD/AnqPo0lQ:nv0wx/YqQHh0Fj4ijAnqFC
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\hfile.sys	zmwvwgzxrg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	eizddajifs.exe

Executes dropped EXE 4 IoCs

pid	Process
2324	eizddajifs.exe
548	zmwvwgzxrg.exe
1980	bfcinfo.exe
4860	14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netwiz = "C:\\ProgramData\\Identities\\netwiz.exe"	zmwvwgzxrg.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
748	cmd.exe
2936	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2356	tasklist.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023b92-6.dat	upx
behavioral2/memory/2324-9-0x0000000000240000-0x0000000000253000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-15.dat	upx
behavioral2/memory/548-17-0x0000000000780000-0x00000000008DB000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-27.dat	upx
behavioral2/memory/1980-28-0x00000000001A0000-0x00000000001D8000-memory.dmp	upx
behavioral2/memory/2324-46-0x0000000000240000-0x0000000000253000-memory.dmp	upx
behavioral2/memory/548-71-0x0000000000780000-0x00000000008DB000-memory.dmp	upx
behavioral2/memory/1980-73-0x00000000001A0000-0x00000000001D8000-memory.dmp	upx
behavioral2/memory/548-324-0x0000000000780000-0x00000000008DB000-memory.dmp	upx
behavioral2/memory/548-416-0x0000000000780000-0x00000000008DB000-memory.dmp	upx
behavioral2/memory/548-574-0x0000000000780000-0x00000000008DB000-memory.dmp	upx
behavioral2/memory/548-669-0x0000000000780000-0x00000000008DB000-memory.dmp	upx
behavioral2/memory/1980-722-0x00000000001A0000-0x00000000001D8000-memory.dmp	upx
behavioral2/memory/548-764-0x0000000000780000-0x00000000008DB000-memory.dmp	upx
behavioral2/memory/548-773-0x0000000000780000-0x00000000008DB000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2028	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfcinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eizddajifs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zmwvwgzxrg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2668	cmd.exe
1932	PING.EXE

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2004	cmd.exe
4924	NETSTAT.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4924	NETSTAT.EXE
4344	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4704	systeminfo.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1328	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1932	PING.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
1980	bfcinfo.exe
1980	bfcinfo.exe
2356	tasklist.exe
2356	tasklist.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe
548	zmwvwgzxrg.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	tasklist.exe
Token: SeDebugPrivilege	4924	NETSTAT.EXE
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe
Token: SeDebugPrivilege	548	zmwvwgzxrg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2324	1516	14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe	86
PID 1516 wrote to memory of 2324	1516	14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe	86
PID 1516 wrote to memory of 2324	1516	14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe	86
PID 1516 wrote to memory of 548	1516	14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe	87
PID 1516 wrote to memory of 548	1516	14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe	87
PID 1516 wrote to memory of 548	1516	14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe	87
PID 548 wrote to memory of 1980	548	zmwvwgzxrg.exe	88
PID 548 wrote to memory of 1980	548	zmwvwgzxrg.exe	88
PID 548 wrote to memory of 1980	548	zmwvwgzxrg.exe	88
PID 548 wrote to memory of 4784	548	zmwvwgzxrg.exe	89
PID 548 wrote to memory of 4784	548	zmwvwgzxrg.exe	89
PID 548 wrote to memory of 4784	548	zmwvwgzxrg.exe	89
PID 4784 wrote to memory of 4704	4784	cmd.exe	91
PID 4784 wrote to memory of 4704	4784	cmd.exe	91
PID 4784 wrote to memory of 4704	4784	cmd.exe	91
PID 2324 wrote to memory of 4860	2324	eizddajifs.exe	92
PID 2324 wrote to memory of 4860	2324	eizddajifs.exe	92
PID 2324 wrote to memory of 4860	2324	eizddajifs.exe	92
PID 548 wrote to memory of 3308	548	zmwvwgzxrg.exe	98
PID 548 wrote to memory of 3308	548	zmwvwgzxrg.exe	98
PID 548 wrote to memory of 3308	548	zmwvwgzxrg.exe	98
PID 3308 wrote to memory of 2356	3308	cmd.exe	100
PID 3308 wrote to memory of 2356	3308	cmd.exe	100
PID 3308 wrote to memory of 2356	3308	cmd.exe	100
PID 548 wrote to memory of 2004	548	zmwvwgzxrg.exe	101
PID 548 wrote to memory of 2004	548	zmwvwgzxrg.exe	101
PID 548 wrote to memory of 2004	548	zmwvwgzxrg.exe	101
PID 2004 wrote to memory of 4924	2004	cmd.exe	103
PID 2004 wrote to memory of 4924	2004	cmd.exe	103
PID 2004 wrote to memory of 4924	2004	cmd.exe	103
PID 548 wrote to memory of 732	548	zmwvwgzxrg.exe	104
PID 548 wrote to memory of 732	548	zmwvwgzxrg.exe	104
PID 548 wrote to memory of 732	548	zmwvwgzxrg.exe	104
PID 732 wrote to memory of 4344	732	cmd.exe	107
PID 732 wrote to memory of 4344	732	cmd.exe	107
PID 732 wrote to memory of 4344	732	cmd.exe	107
PID 548 wrote to memory of 4620	548	zmwvwgzxrg.exe	109
PID 548 wrote to memory of 4620	548	zmwvwgzxrg.exe	109
PID 548 wrote to memory of 4620	548	zmwvwgzxrg.exe	109
PID 4620 wrote to memory of 4612	4620	cmd.exe	111
PID 4620 wrote to memory of 4612	4620	cmd.exe	111
PID 4620 wrote to memory of 4612	4620	cmd.exe	111
PID 548 wrote to memory of 748	548	zmwvwgzxrg.exe	112
PID 548 wrote to memory of 748	548	zmwvwgzxrg.exe	112
PID 548 wrote to memory of 748	548	zmwvwgzxrg.exe	112
PID 748 wrote to memory of 2936	748	cmd.exe	114
PID 748 wrote to memory of 2936	748	cmd.exe	114
PID 748 wrote to memory of 2936	748	cmd.exe	114
PID 548 wrote to memory of 1848	548	zmwvwgzxrg.exe	115
PID 548 wrote to memory of 1848	548	zmwvwgzxrg.exe	115
PID 548 wrote to memory of 1848	548	zmwvwgzxrg.exe	115
PID 1848 wrote to memory of 1328	1848	cmd.exe	117
PID 1848 wrote to memory of 1328	1848	cmd.exe	117
PID 1848 wrote to memory of 1328	1848	cmd.exe	117
PID 548 wrote to memory of 752	548	zmwvwgzxrg.exe	118
PID 548 wrote to memory of 752	548	zmwvwgzxrg.exe	118
PID 548 wrote to memory of 752	548	zmwvwgzxrg.exe	118
PID 752 wrote to memory of 1736	752	cmd.exe	120
PID 752 wrote to memory of 1736	752	cmd.exe	120
PID 752 wrote to memory of 1736	752	cmd.exe	120
PID 1736 wrote to memory of 612	1736	net.exe	121
PID 1736 wrote to memory of 612	1736	net.exe	121
PID 1736 wrote to memory of 612	1736	net.exe	121
PID 548 wrote to memory of 2668	548	zmwvwgzxrg.exe	122

C:\Users\Admin\AppData\Local\Temp\14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe
"C:\Users\Admin\AppData\Local\Temp\14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\eizddajifs.exe
  "C:\Users\Admin\AppData\Local\Temp\eizddajifs.exe" "C:\Users\Admin\AppData\Local\Temp\kjugxhqbaq.exe" "C:\Users\Admin\AppData\Local\Temp\14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe
    "C:\Users\Admin\AppData\Local\Temp\14b3041b5b89d333c392273c3a155c8d5d553897f4651f977b03e0db97934b13N.exe"
    3⤵
    - Executes dropped EXE
    PID:4860
- C:\Users\Admin\AppData\Local\Temp\zmwvwgzxrg.exe
  C:\Users\Admin\AppData\Local\Temp\zmwvwgzxrg.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\ProgramData\Identities\bfcinfo.exe
    "C:\ProgramData\Identities\bfcinfo.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    /c systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    /c "tasklist /v"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /v
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    /c "netstat -ano"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Connections Discovery
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      System Location Discovery: System Language Discovery
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:4924
- - C:\Windows\SysWOW64\cmd.exe
    /c "ipconfig /all"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:732
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:4344
- - C:\Windows\SysWOW64\cmd.exe
    /c "route print"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route print
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    /c "arp -a"
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    /c "reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    /c "net share"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\SysWOW64\net.exe
      net share
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:612
- - C:\Windows\SysWOW64\cmd.exe
    /c "ping server"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2668
  - - C:\Windows\SysWOW64\PING.EXE
      ping server
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    /c "sc query hfile.sys"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4780
  - - C:\Windows\SysWOW64\sc.exe
      sc query hfile.sys
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2028
- - C:\Windows\SysWOW64\wscript.exe
    C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Word\winword.vbs C:\Users\Admin\AppData\Roaming\Microsoft\Word
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3128
- - C:\Windows\SysWOW64\wscript.exe
    C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Word\winword.vbs C:\Users\Admin\AppData\Roaming\Microsoft\Word
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bfcinfo.exe

Path C:\ProgramData\Identities\bfcinfo.exe
Size 173KB
SHA256 c04341676f8b868e630de0eea760215375e020dee53cfdb86b30cf4751946385
MD5 668b4d9effb6a2d47e64106de04998a4
SHA1 b3e02a79c72fb0abe60c950e933b37c7c6a8ccf5
SHA512 e276ce1972af7f87bd3572a36a9ba4a2bda5655e74acc66dde0b299189b827088079d72e9e111b822f3906db7eb1281593ed1b5133b638a68f9dcf5b99c85c28
SSDEEP 3072:u/a/WgwEEXeRDyTGDxJs6wqSMJO0Y045IFC5mQvebTRH8BGwJoM:mAJEXeh9DXxTSMJaLuCwcWTRHs2M
MD5 SHA1 SHA512 SSDEEP

Submit Download

ramdisk.sdb

Path C:\ProgramData\MediaCache\ramdisk.sdb
Size 4KB
SHA256 a8a37839f299132d054c0fe430e569b1c9d4ef0cdd0e37e91973d4e6a0205dd7
MD5 f7ea889c0053d2027fde523657c659a2
SHA1 324c47aa9bf20ae011ef440aa1398cd575d98681
SHA512 e2523958fe2688fcb44a09b370fe4ec5e371ef595881db8352428e2e3e14be0f4827b85152ef52cf9858617e8cd511909a98677be8b8167131f86506bccea189
SSDEEP 96:cD18tzPe01A6S94Er794e+FC9UbKg943fTbcT943yT943SgLMyxu0V0ZyYC4d2F5:catze6S9Dr79YFC9KKg9wfTbcT9wyT9Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ramdisk.sdb

Path C:\ProgramData\MediaCache\ramdisk.sdb
Size 2KB
SHA256 d7bafcb0814e24235efd582cb171a123621d06935f6c08c0f335a68d3c0d628d
MD5 e2e373d3172b86fb5847be446ac66ff9
SHA1 32eca6f198c57fb1f5559c8f635c980f738bd7fe
SHA512 cea556b36fdd2bad35a9d072c876f5f9ba4ac2793500578d1494de1970b002e345d35211699bbd936087112232fb7630a0918d519c0c4dcbce3dd2741361ff21
MD5 SHA1 SHA512

Submit Download

trnmg.sdb

Path C:\ProgramData\trnmg.sdb
Size 868B
SHA256 a4b8cad394bd98b4dde61a9116ffaf77c1835ee44a04b8676168c5edd9971ce8
MD5 163625765b2a37b6a59df2c54ce2ead0
SHA1 b80011316ed2e37c3e3c6032cf36806d86850dca
SHA512 f0449d596b9d53c51a116a7fdd849f6b78f9d9a3abab4c2eeb8bb775b19b5f7a412e14f9c82c19543651c802704f94877b37c337dd20ccc4e22dafe67fa535c2
MD5 SHA1 SHA512

Submit Download

eizddajifs.exe

Path C:\Users\Admin\AppData\Local\Temp\eizddajifs.exe
Size 23KB
SHA256 4deea5f53cecd04364ac0d6ecdc97e5c3909fe85ab72df8a0be2c93acbe70d21
MD5 6dcffb3265fd77fe158d3f5add751933
SHA1 72298838677c87daca885d39d0227a6ae3531812
SHA512 d901570626d889c4e5e4e5e16340dd5af67864b277d06ac8eea46b1deff876a363cdafde9ee99954a39c3b71e032b8048077a83ddb96e65356ee5bb82f6198bf
SSDEEP 384:nxN9L5HQd3XS9jJBBvegSRcF1xVkL47ecyJl7bLTHiPN/ao9e/+Y905/DV5IdMQb:nx/mdH+jJ7vTbrkR7HTHi1/ao9O+6053
MD5 SHA1 SHA512 SSDEEP

Submit Download

kjugxhqbaq.exe

Path C:\Users\Admin\AppData\Local\Temp\kjugxhqbaq.exe
Size 305KB
SHA256 befd85ba454f749429f6118dfe6ff3504c502e45ffdda9aaa4cab018ca43b32a
MD5 fc8c24025d14d38856c77082225dd0fe
SHA1 dfbaaa37b620b7e54e78a63a5151b194504e9a56
SHA512 31a714961974868361eeebd6739359f42eecf110f96398d3d5ea8aa36c0c7aacab9107ce9047c919faadbd5d013758c23b3f665e22222f65488b629579e784b3
SSDEEP 3072:nvebTRH8BGwJoFPxfpk8gXEDbmKsZUTc7vsDT9hWaGOSRi24EktCV3WMNe25Q:vWTRHs2VpCH0DiDM9fGOSMCkCq25Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

zmwvwgzxrg.exe

Path C:\Users\Admin\AppData\Local\Temp\zmwvwgzxrg.exe
Size 567KB
SHA256 e6743de7d8521cb5d92e7b10cf0b41aa2d38c2912d3f24b678eb5d9a0f52ffd9
MD5 ab8da511c456e5e3f72f1af2cda84651
SHA1 64b56af80fcaf2de6d0cb1859fcfbc677b06f9da
SHA512 e7cbfd5deddf8e5393ee963da4ce7e587aaa92e8aee689c21417d0d5082b42ad382073241fb9c1759c20228d62fb1f9f95a28cb820495b6cdbaaaf4e86a52ee3
SSDEEP 12288:P+mxp/L5/aq3ViHroSkso2+hFj4iYvb+SmHYbUw:P+m/1/aq3AHrF+hFj4iD/An
MD5 SHA1 SHA512 SSDEEP

Submit Download

ApproveStop.docx

Path C:\Users\Admin\AppData\Roaming\Microsoft\Word\ApproveStop.docx
Size 13KB
SHA256 f0f6b9d5755f4cc13678f481c15449641273b04cdaddd8ed6f56b91317f64782
MD5 648a1408e4b29d11fbcd4a9a3f68b39c
SHA1 5a18e29c3d7eac38555bda9b2452cc25a690b3e8
SHA512 e0898545853c82856d8b8a7ff1a64b5c6d1e70ef7333e65bc668aa2453014490f57d8ea3eb66fabff2b386f749d9e6eeebaa48338f0bb25797b372085815a0d4
SSDEEP 192:CtXn93ZQfyCCNxtpgoZ22NNuUOseTWNGFHBEwyHLc:aRZQKdNxt/ZtNNTIFH5yHLc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ApproveStop.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Word\ApproveStop.txt
Size 3KB
SHA256 f38fc3744e750d4747d0870c6e01155bcdfb6b842e5ebb87b61674dfbde5cece
MD5 7d544daef5b9763c578edfe7c8905ed4
SHA1 51c228bdfd0ab622cbe128ec0fc577c70bc31f3a
SHA512 69b91a28323e435793dca4ab8ea4b6e433bc3b0422b1a6be865ecf88876158b48965ea7dfc3dc4f08742d7084a896efcaa91629ff27d9424767640ed2a84d1f8
MD5 SHA1 SHA512

Submit Download

HidePublish.docx

Path C:\Users\Admin\AppData\Roaming\Microsoft\Word\HidePublish.docx
Size 15KB
SHA256 743ef9950936929bcd46b3746d0093630829107d8cb23c16cb3c73dac712a2cf
MD5 1e038fa7674fa5ebaa1c4d82834eb553
SHA1 ee7b018a0c2b9f6126660bf135eab371f9ee7253
SHA512 a1e04d9cb42ec6f3a5201b51360ef93fcbbfd77abb01743ca77bdfb662010112ffb13b8a518b46880edc7d039e2cf71897a29891dc99e5cdd250e5daa744c850
SSDEEP 192:CtBkLviVDf9i//h8dD47g7SKhCCNxtpgoZ22NNhBTXeTWNGFHBEwgJivqa:amif9rigBhdNxt/ZtNNhDIFH5gJivqa
MD5 SHA1 SHA512 SSDEEP

Submit Download

HidePublish.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Word\HidePublish.txt
Size 5KB
SHA256 8c16c909ba3534279814d5695e24f747be4cd32f456996e05f3038967459a248
MD5 203678ec1196134724172b6a77f785a7
SHA1 2aeda58f4d496aa1525e67a970060826cd857893
SHA512 53c3dd507cb79866bc66673e382c7012ba1df2d06b5b458971d2a502aa00d90905582df6d4e29da3d427697adae25666dd5291fd1f37c47e6bff418349761a7d
SSDEEP 96:AM4teb7vzKrhBuBHoaW5vGrBXKofbk1JWzRbnHlrPAq1QOO3E/iNKOYIRE6a3+yw:EebKr0COllfGJWZHJUOOU/ic6RE61F
MD5 SHA1 SHA512 SSDEEP

Submit Download

winword.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Word\winword.vbs
Size 1KB
SHA256 6484a02c2db6c9afb5659ede4047cad10b7102c2bbc4c94bf8482f88d8fd83a8
MD5 3439318cedcf37c1bf5fe6d49ddbb2cb
SHA1 e075965bb3b38abdd80668fb6101a0d10b30f080
SHA512 3dffcf24b052a7fffd50ab6c76d081b1c47ba64c20f21650e4bdcf19106518e8b342691711230ba9eea5489994b8ccec8ad11f54b1509b1cd518616254176b61
MD5 SHA1 SHA512

Submit Download

memory/548-324-0x0000000000780000-0x00000000008DB000-memory.dmp

Download

memory/548-71-0x0000000000780000-0x00000000008DB000-memory.dmp

Download

memory/548-17-0x0000000000780000-0x00000000008DB000-memory.dmp

Download

memory/548-416-0x0000000000780000-0x00000000008DB000-memory.dmp

Download

memory/548-574-0x0000000000780000-0x00000000008DB000-memory.dmp

Download

memory/548-669-0x0000000000780000-0x00000000008DB000-memory.dmp

Download

memory/548-764-0x0000000000780000-0x00000000008DB000-memory.dmp

Download

memory/548-773-0x0000000000780000-0x00000000008DB000-memory.dmp

Download

memory/1980-73-0x00000000001A0000-0x00000000001D8000-memory.dmp

Download

memory/1980-28-0x00000000001A0000-0x00000000001D8000-memory.dmp

Download

memory/1980-722-0x00000000001A0000-0x00000000001D8000-memory.dmp

Download

memory/2324-46-0x0000000000240000-0x0000000000253000-memory.dmp

Download

memory/2324-9-0x0000000000240000-0x0000000000253000-memory.dmp

Download