6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b

General

Target

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
Size

10.0MB
MD5

f08fc668957c17905520d63bae85114a
SHA1

a802235e8e390cb700396f7ee6eda73c27289484
SHA256

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b
SHA512

cedc25745fbd376627c119cfc481627ac574ae3d92f4d888538d88a344b57a66e47ca3f6ae7580ff154a5c11fd2325057cf194784c1e357f0756884d37e1da9e
SSDEEP

98304:He5x6c1NogP2NhS9Yw8ywowUUIGYlFlehRC4tNuTBp8BzB+0LuxttZiSELtebmab:gJawfwVs3TehREvjD8th9VzW

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

description	ioc	process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe"	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

Drops file in Program Files directory 64 IoCs

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\WallpaperStyle = "2"	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\TileWallpaper = "2"	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

pid	process
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

pid	process
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
4816	6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe

C:\Users\Admin\AppData\Local\Temp\6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe
"C:\Users\Admin\AppData\Local\Temp\6dff4cafebd4bb246488526e09dc6aa1d2aa25681eb024439c08fda39a10367b.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Uninstall.exe

Filesize
10.0MB

MD5
1681b33bfc4ac7aeac92aa731574f38a

SHA1
73366c193c78a726ff2cae3c898a8b08b1b31b31

SHA256
28e22365ef1163cb5832603428836d5e81db3d589b826b49107a0bfa22d791e0

SHA512
085f96df6670f542a570147fab0883680080d84ccdb2876e3955db0831465ba16664311749e16a685e9dd9df24997c2138fb1842a0e7f9bd30bb845e826d0227

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads