floxif | 69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Size

295KB
MD5

52df9cab71705d8d32c8ca7a96512048
SHA1

db1d09febfdc83b7596a69662a7fb399a0c1a09e
SHA256

69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97
SHA512

ba111aec77fc17e531601edd86c1f3fd889fb7fa83a8015c289380c59c2b7f156f9cc83f97070f3862a64e2ecd4a202dd9cfc909135194a0aeae0d9c3f863a3b
SSDEEP

6144:XpLqdufVUEAkC5sqDgJqBV+UdvrEFp7hKXc:5FUEAf2qBjvrEH7uc

Score

10^/10

floxif backdoor discovery evasion persistence trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000c000000023ba8-2.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c000000023ba8-2.dat	acprotect

Executes dropped EXE 6 IoCs

pid	Process
396	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
212	icsys.icn.exe
1692	explorer.exe
1460	spoolsv.exe
2576	svchost.exe
1740	spoolsv.exe

Loads dropped DLL 1 IoCs

pid	Process
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023ba8-2.dat	upx
behavioral2/memory/1032-5-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1032-68-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4840	396	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe
212	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1692	explorer.exe
2576	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
212	icsys.icn.exe
212	icsys.icn.exe
1692	explorer.exe
1692	explorer.exe
1460	spoolsv.exe
1460	spoolsv.exe
2576	svchost.exe
2576	svchost.exe
1740	spoolsv.exe
1740	spoolsv.exe
396	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
396	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 396	1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe	83
PID 1032 wrote to memory of 396	1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe	83
PID 1032 wrote to memory of 396	1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe	83
PID 1032 wrote to memory of 212	1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe	84
PID 1032 wrote to memory of 212	1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe	84
PID 1032 wrote to memory of 212	1032	69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe	84
PID 212 wrote to memory of 1692	212	icsys.icn.exe	85
PID 212 wrote to memory of 1692	212	icsys.icn.exe	85
PID 212 wrote to memory of 1692	212	icsys.icn.exe	85
PID 1692 wrote to memory of 1460	1692	explorer.exe	86
PID 1692 wrote to memory of 1460	1692	explorer.exe	86
PID 1692 wrote to memory of 1460	1692	explorer.exe	86
PID 1460 wrote to memory of 2576	1460	spoolsv.exe	87
PID 1460 wrote to memory of 2576	1460	spoolsv.exe	87
PID 1460 wrote to memory of 2576	1460	spoolsv.exe	87
PID 2576 wrote to memory of 1740	2576	svchost.exe	88
PID 2576 wrote to memory of 1740	2576	svchost.exe	88
PID 2576 wrote to memory of 1740	2576	svchost.exe	88

C:\Users\Admin\AppData\Local\Temp\69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
"C:\Users\Admin\AppData\Local\Temp\69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032
- \??\c:\users\admin\appdata\local\temp\69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
  c:\users\admin\appdata\local\temp\69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 2104
    3⤵
    - Program crash
    PID:4840
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:212
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1460
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2576
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 396 -ip 396
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\69f5f142de756ad4c292fb7d2006806c1482a7571c0402861d7485d7b1bedc97.exe

Filesize
84KB

MD5
db88cea04959ef0e922c90b53738f37a

SHA1
cdc9e0c6ed27bfc798221cfc7a5316bf45e44493

SHA256
6031b6caa61889583058cfb76401cb7b26c8c739e013835cee9747c0634e9bd8

SHA512
61b69861844e45a671f156f7c391f749a414bd1726e3ab9b80644bc09c4d88941b7cade1b3ccd1a4eb6adf8fa34d9dc20fb0ad34981c5ccc00479d2fb259dd91

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
fd7f07ce3782f1174ed287d8c64cae2a

SHA1
aa50287c550d501d10166652355d8c7353c1bc39

SHA256
a0850d54d9c7ae00f91b82f8ede3a7b868640ccb8013fa7f9ddee3ac97811adf

SHA512
41012bf68924e588fbc69ad740578e35cdaf1b0c520ae2fac00ee069cfd054765d856b766b768d1c961f4a3f4f743ede0dbb698b946996f2eb537cc0d8d8c654

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
fe723689e869e5b10596af9e1be9c651

SHA1
676e1877b0c836467e8dc866b22572824500c289

SHA256
dcf99c0176341d8a93599d7baef3b9c18882a58832d76c2a996331f36267a855

SHA512
c55218b5a321ae5f71d513d673c6f53d4f7e5bb8ee2721609142dee2ec175aad5528a8cc6fb9f1539c29595c09219332ca0ac3ebcb9465ccaa33961d76c86730

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
5e1af2d2c3b4099080bb344b30849e06

SHA1
57c36033b9920eae394f52348c07cc9114438ab1

SHA256
897f29f0549cf7824eb3eeecf6c4a023eaf41b24fe7198640dc081e2d8524004

SHA512
95f2446c2acd9ca4bc8fa464429976a567f3a6eeae9be95aeb319319ae78c716ac1fd23ed65ac61e7165e55efa17980122fc9882c91b64afa546e0c8380f8014

Download Submit
\??\c:\windows\resources\themes\explorer.exe

Filesize
135KB

MD5
7689bc1fcb60f8ccc14250b3e9c7b0a4

SHA1
0da75311f85951f36e157c3262ba59ed191b6c09

SHA256
3fea267c34e140b06ec6fb1271a724bb201ef929096b6afceb2c40dd1d21ecf6

SHA512
ea5d332aa11144919b5c538132457ba74557d6826daef41422e92a965a3b1a4a690436c53fbbf8cff5a5bba62b36f80bd2a2169c7c23c57de69d9db481fa2fba

Download Submit
memory/212-63-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/212-19-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1032-5-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1032-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1032-68-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1032-67-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1460-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1460-62-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1692-72-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1740-61-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2576-73-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download