f59e59f5d7c313a059ec3adac4326d06cf039ac449deebec30b39fbe9fe1f1f1

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

g4123.msi
Size

10.9MB
MD5

f14d4e129dc0ea8d968316df9c18995c
SHA1

d679be9a4b62cc5a560c641a09dc4fe2b668f261
SHA256

f59e59f5d7c313a059ec3adac4326d06cf039ac449deebec30b39fbe9fe1f1f1
SHA512

f6b02bed62191dd59eb52fbf9267c9a848e03dd020072e8e12688ca83cf3efb487f828de4b0e2302f6f8d8fcfc7575eebfa2379e47fa203787911173aeb9e1ce
SSDEEP

196608:68aXjDEAkJVjG2lnKOHCe0BvxJ4uY+QkHyxomkJiEBLS6A4p6625d0XL:+XPEzVjG2oICvBJJ4uckIomIa41XL

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

pyexec.exe

description	pid	Process	procid_target
PID 676 set thread context of 2252	676	pyexec.exe	44

Executes dropped EXE 12 IoCs

Processes:

ISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exepyexec.exepyexec.exe

pid	Process
2772	ISBEW64.exe
2608	ISBEW64.exe
2684	ISBEW64.exe
2460	ISBEW64.exe
1196	ISBEW64.exe
2064	ISBEW64.exe
532	ISBEW64.exe
1724	ISBEW64.exe
2952	ISBEW64.exe
2508	ISBEW64.exe
1616	pyexec.exe
676	pyexec.exe

Loads dropped DLL 21 IoCs

Processes:

MsiExec.exepyexec.exepyexec.execmd.exeArchiveUninstall_up_dbg.exe

pid	Process
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
1616	pyexec.exe
1616	pyexec.exe
676	pyexec.exe
2252	cmd.exe
2252	cmd.exe
600	ArchiveUninstall_up_dbg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

Processes:

msiexec.exe

pid	Process
2468	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

pyexec.execmd.exeMsiExec.exepyexec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pyexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pyexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

pyexec.exepyexec.execmd.exe

pid	Process
1616	pyexec.exe
676	pyexec.exe
676	pyexec.exe
2252	cmd.exe
2252	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

pyexec.execmd.exe

pid	Process
676	pyexec.exe
2252	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	Process
Token: SeShutdownPrivilege	2468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2316	msiexec.exe
Token: SeTakeOwnershipPrivilege	2316	msiexec.exe
Token: SeSecurityPrivilege	2316	msiexec.exe
Token: SeCreateTokenPrivilege	2468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2468	msiexec.exe
Token: SeLockMemoryPrivilege	2468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2468	msiexec.exe
Token: SeMachineAccountPrivilege	2468	msiexec.exe
Token: SeTcbPrivilege	2468	msiexec.exe
Token: SeSecurityPrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeLoadDriverPrivilege	2468	msiexec.exe
Token: SeSystemProfilePrivilege	2468	msiexec.exe
Token: SeSystemtimePrivilege	2468	msiexec.exe
Token: SeProfSingleProcessPrivilege	2468	msiexec.exe
Token: SeIncBasePriorityPrivilege	2468	msiexec.exe
Token: SeCreatePagefilePrivilege	2468	msiexec.exe
Token: SeCreatePermanentPrivilege	2468	msiexec.exe
Token: SeBackupPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeShutdownPrivilege	2468	msiexec.exe
Token: SeDebugPrivilege	2468	msiexec.exe
Token: SeAuditPrivilege	2468	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2468	msiexec.exe
Token: SeChangeNotifyPrivilege	2468	msiexec.exe
Token: SeRemoteShutdownPrivilege	2468	msiexec.exe
Token: SeUndockPrivilege	2468	msiexec.exe
Token: SeSyncAgentPrivilege	2468	msiexec.exe
Token: SeEnableDelegationPrivilege	2468	msiexec.exe
Token: SeManageVolumePrivilege	2468	msiexec.exe
Token: SeImpersonatePrivilege	2468	msiexec.exe
Token: SeCreateGlobalPrivilege	2468	msiexec.exe
Token: SeCreateTokenPrivilege	2468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2468	msiexec.exe
Token: SeLockMemoryPrivilege	2468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2468	msiexec.exe
Token: SeMachineAccountPrivilege	2468	msiexec.exe
Token: SeTcbPrivilege	2468	msiexec.exe
Token: SeSecurityPrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeLoadDriverPrivilege	2468	msiexec.exe
Token: SeSystemProfilePrivilege	2468	msiexec.exe
Token: SeSystemtimePrivilege	2468	msiexec.exe
Token: SeProfSingleProcessPrivilege	2468	msiexec.exe
Token: SeIncBasePriorityPrivilege	2468	msiexec.exe
Token: SeCreatePagefilePrivilege	2468	msiexec.exe
Token: SeCreatePermanentPrivilege	2468	msiexec.exe
Token: SeBackupPrivilege	2468	msiexec.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeShutdownPrivilege	2468	msiexec.exe
Token: SeDebugPrivilege	2468	msiexec.exe
Token: SeAuditPrivilege	2468	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2468	msiexec.exe
Token: SeChangeNotifyPrivilege	2468	msiexec.exe
Token: SeRemoteShutdownPrivilege	2468	msiexec.exe
Token: SeUndockPrivilege	2468	msiexec.exe
Token: SeSyncAgentPrivilege	2468	msiexec.exe
Token: SeEnableDelegationPrivilege	2468	msiexec.exe
Token: SeManageVolumePrivilege	2468	msiexec.exe
Token: SeImpersonatePrivilege	2468	msiexec.exe
Token: SeCreateGlobalPrivilege	2468	msiexec.exe
Token: SeCreateTokenPrivilege	2468	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid	Process
2468	msiexec.exe
2468	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exepyexec.exepyexec.execmd.exe

description	pid	Process	procid_target
PID 2316 wrote to memory of 2760	2316	msiexec.exe	31
PID 2316 wrote to memory of 2760	2316	msiexec.exe	31
PID 2316 wrote to memory of 2760	2316	msiexec.exe	31
PID 2316 wrote to memory of 2760	2316	msiexec.exe	31
PID 2316 wrote to memory of 2760	2316	msiexec.exe	31
PID 2316 wrote to memory of 2760	2316	msiexec.exe	31
PID 2316 wrote to memory of 2760	2316	msiexec.exe	31
PID 2760 wrote to memory of 2772	2760	MsiExec.exe	32
PID 2760 wrote to memory of 2772	2760	MsiExec.exe	32
PID 2760 wrote to memory of 2772	2760	MsiExec.exe	32
PID 2760 wrote to memory of 2772	2760	MsiExec.exe	32
PID 2760 wrote to memory of 2608	2760	MsiExec.exe	33
PID 2760 wrote to memory of 2608	2760	MsiExec.exe	33
PID 2760 wrote to memory of 2608	2760	MsiExec.exe	33
PID 2760 wrote to memory of 2608	2760	MsiExec.exe	33
PID 2760 wrote to memory of 2684	2760	MsiExec.exe	34
PID 2760 wrote to memory of 2684	2760	MsiExec.exe	34
PID 2760 wrote to memory of 2684	2760	MsiExec.exe	34
PID 2760 wrote to memory of 2684	2760	MsiExec.exe	34
PID 2760 wrote to memory of 2460	2760	MsiExec.exe	35
PID 2760 wrote to memory of 2460	2760	MsiExec.exe	35
PID 2760 wrote to memory of 2460	2760	MsiExec.exe	35
PID 2760 wrote to memory of 2460	2760	MsiExec.exe	35
PID 2760 wrote to memory of 1196	2760	MsiExec.exe	36
PID 2760 wrote to memory of 1196	2760	MsiExec.exe	36
PID 2760 wrote to memory of 1196	2760	MsiExec.exe	36
PID 2760 wrote to memory of 1196	2760	MsiExec.exe	36
PID 2760 wrote to memory of 2064	2760	MsiExec.exe	37
PID 2760 wrote to memory of 2064	2760	MsiExec.exe	37
PID 2760 wrote to memory of 2064	2760	MsiExec.exe	37
PID 2760 wrote to memory of 2064	2760	MsiExec.exe	37
PID 2760 wrote to memory of 532	2760	MsiExec.exe	38
PID 2760 wrote to memory of 532	2760	MsiExec.exe	38
PID 2760 wrote to memory of 532	2760	MsiExec.exe	38
PID 2760 wrote to memory of 532	2760	MsiExec.exe	38
PID 2760 wrote to memory of 1724	2760	MsiExec.exe	39
PID 2760 wrote to memory of 1724	2760	MsiExec.exe	39
PID 2760 wrote to memory of 1724	2760	MsiExec.exe	39
PID 2760 wrote to memory of 1724	2760	MsiExec.exe	39
PID 2760 wrote to memory of 2952	2760	MsiExec.exe	40
PID 2760 wrote to memory of 2952	2760	MsiExec.exe	40
PID 2760 wrote to memory of 2952	2760	MsiExec.exe	40
PID 2760 wrote to memory of 2952	2760	MsiExec.exe	40
PID 2760 wrote to memory of 2508	2760	MsiExec.exe	41
PID 2760 wrote to memory of 2508	2760	MsiExec.exe	41
PID 2760 wrote to memory of 2508	2760	MsiExec.exe	41
PID 2760 wrote to memory of 2508	2760	MsiExec.exe	41
PID 2760 wrote to memory of 1616	2760	MsiExec.exe	42
PID 2760 wrote to memory of 1616	2760	MsiExec.exe	42
PID 2760 wrote to memory of 1616	2760	MsiExec.exe	42
PID 2760 wrote to memory of 1616	2760	MsiExec.exe	42
PID 1616 wrote to memory of 676	1616	pyexec.exe	43
PID 1616 wrote to memory of 676	1616	pyexec.exe	43
PID 1616 wrote to memory of 676	1616	pyexec.exe	43
PID 1616 wrote to memory of 676	1616	pyexec.exe	43
PID 676 wrote to memory of 2252	676	pyexec.exe	44
PID 676 wrote to memory of 2252	676	pyexec.exe	44
PID 676 wrote to memory of 2252	676	pyexec.exe	44
PID 676 wrote to memory of 2252	676	pyexec.exe	44
PID 676 wrote to memory of 2252	676	pyexec.exe	44
PID 2252 wrote to memory of 600	2252	cmd.exe	47
PID 2252 wrote to memory of 600	2252	cmd.exe	47
PID 2252 wrote to memory of 600	2252	cmd.exe	47
PID 2252 wrote to memory of 600	2252	cmd.exe	47

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\g4123.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2468

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A58EDD5E96150EAD81C9A417D0E956B1 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{99029235-0356-443F-897F-1FA7EA59F15F}
    3⤵
    - Executes dropped EXE
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4E4767FF-7CE6-4237-8CDA-84D6830C9737}
    3⤵
    - Executes dropped EXE
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5283233B-A04D-4ADC-AEEC-481814841380}
    3⤵
    - Executes dropped EXE
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{43310F73-DB63-4B0B-8E23-BA75837F4DDD}
    3⤵
    - Executes dropped EXE
    PID:2460
- - C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EAB2BC80-83D7-40EC-87C5-C6E1567117C4}
    3⤵
    - Executes dropped EXE
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B327E12F-1265-4B80-AC48-BCBB44BCE8AD}
    3⤵
    - Executes dropped EXE
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8689C865-C9AB-4EF3-8B19-0587A63DD600}
    3⤵
    - Executes dropped EXE
    PID:532
- - C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{93EE70CD-BAC4-4C93-9199-8610B7CE3A30}
    3⤵
    - Executes dropped EXE
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8F591F5F-DBD8-4EB9-A967-0B0C867EFC71}
    3⤵
    - Executes dropped EXE
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C336D83C-F959-44A7-A110-CECC83C6B042}
    3⤵
    - Executes dropped EXE
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\{3E0FCA78-AF85-4F0A-B9E7-D3DED7532620}\pyexec.exe
    C:\Users\Admin\AppData\Local\Temp\{3E0FCA78-AF85-4F0A-B9E7-D3DED7532620}\pyexec.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Users\Admin\AppData\Roaming\BackupMakeLu_debug\pyexec.exe
      C:\Users\Admin\AppData\Roaming\BackupMakeLu_debug\pyexec.exe
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:676
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\ArchiveUninstall_up_dbg.exe
        
        C:\Users\Admin\AppData\Local\Temp\ArchiveUninstall_up_dbg.exe
        6⤵
        Loads dropped DLL
        
        PID:600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\87577998

Filesize
5.6MB

MD5
74660dfd146922a321a2a47b2a948a6f

SHA1
160611fcf69da1bb4af10f3bc27c3b70c423bb9b

SHA256
6c19d6530217dae9c45762086afa6828352c653084dc4c9fb42dc5c3b6fc91c4

SHA512
337539b423f008bec72e0bc0f5fe1d0aacac1d08b3d49b12e90809e62ee5220ce7748171f3f82d4258622cb024c47a80407c54cd38176c5ad6567fe63d6842b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8141.tmp

Filesize
171KB

MD5
a0e940a3d3c1523416675125e3b0c07e

SHA1
2e29eeba6da9a4023bc8071158feee3b0277fd1b

SHA256
b8fa7aa425e4084ea3721780a13d11e08b8d53d1c5414b73f22faeca1bfd314f

SHA512
736ea06824388372aeef1938c6b11e66f4595e0b0589d7b4a87ff4abbabe52e82dff64d916293eab47aa869cf372ced2c66755dd8a8471b2ab0d3a37ba91d0b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI822C.tmp

Filesize
2.5MB

MD5
614b21ec901d523e58aec4f6d95f12f8

SHA1
31ee88bb3b18ad109e06eede5b787798f78b3c6c

SHA256
0f7044a12746a2a0b5d2f5e6ef6eda631b37a8c5d6e16715cfd932fbe2479f22

SHA512
7fe6059afa1379c878200d4e3becc7287289bb6f90be304e12d5a7c45aa680516c3d65427b4be3998bea12254557c6297617d58d4538a992925711cedcd80c5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3E0FCA78-AF85-4F0A-B9E7-D3DED7532620}\PYTHON27.DLL

Filesize
2.5MB

MD5
97ba4f023eef94417adcb77b044830c4

SHA1
d071a2c68256a36a1c2504d6c931ced63d676c4f

SHA256
357aedc478d8c1c6e85874c25a6a76b3801413fd71aaa641b31905e19b6cc7bd

SHA512
3a165eecbbee200f67476709e453254fcb131441f4a1737b820826fcb6fead4f3a8bdbf4c6bd8a22e81dee3b7e8b8de548f655c2e30c2e3568ef68625cd05365

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3E0FCA78-AF85-4F0A-B9E7-D3DED7532620}\kkfpps

Filesize
4.5MB

MD5
69b0b17f58499aec5d3134e432bf8189

SHA1
f041e671adc878ce1835a4b9511f02e47bb054c5

SHA256
a25519734407988f82ce2989999ba88577a1b861067cf222bee154efd6f83cbf

SHA512
5ad474b985812ed043625697c4c3f61f87556e9986e9caba649de7c099ad32d77e15624a8eb207888f46587fadb24748bd160d6dcce6d8ac3da1052ea79debc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3E0FCA78-AF85-4F0A-B9E7-D3DED7532620}\msvcr90.dll

Filesize
638KB

MD5
11d49148a302de4104ded6a92b78b0ed

SHA1
fd58a091b39ed52611ade20a782ef58ac33012af

SHA256
ceb0947d898bc2a55a50f092f5ed3f7be64ac1cd4661022eefd3edd4029213b0

SHA512
fdc43b3ee38f7beb2375c953a29db8bcf66b73b78ccc04b147e26108f3b650c0a431b276853bb8e08167d34a8cc9c6b7918daef9ebc0a4833b1534c5afac75e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3E0FCA78-AF85-4F0A-B9E7-D3DED7532620}\oqie

Filesize
18KB

MD5
1b460253d49274b10fbb004dfb9747fc

SHA1
e7eeb198a3bfd9e5977eca69940754aa6d065ee0

SHA256
ea375e1438be7cbd7841956e11c8b5749bea413fd9d6b8044c2204e8e7c2e209

SHA512
2d3f22b67b702c68491aa8b66081bf02ba6e94dc4cfb352a41810c479807b149f4bd698abbcc1e41287640c0376ad099e932bcfdb6790c7f099f67625a77c390

Download Submit
\Users\Admin\AppData\Local\Temp\ArchiveUninstall_up_dbg.exe

Filesize
2.3MB

MD5
967f4470627f823f4d7981e511c9824f

SHA1
416501b096df80ddc49f4144c3832cf2cadb9cb2

SHA256
b22bf1210b5fd173a210ebfa9092390aa0513c41e1914cbe161eb547f049ef91

SHA512
8883ead428c9d4b415046de9f8398aa1f65ae81fe7945a840c822620e18f6f9930cce2e10acff3b5da8b9c817ade3dabc1de576cbd255087267f77341900a41c

Download Submit
\Users\Admin\AppData\Local\Temp\{3E0FCA78-AF85-4F0A-B9E7-D3DED7532620}\pyexec.exe

Filesize
28KB

MD5
b6f6c3c38568ee26f1ac70411a822405

SHA1
5b94d0adac4df2d7179c378750c4e3417231125f

SHA256
a73454c7fad23a80a3f6540afdb64fc334980a11402569f1986aa39995ae496d

SHA512
5c0a5e9a623a942aff9d58d6e7a23b7d2bba6a4155824aa8bb94dbd069a8c15c00df48f12224622efcd5042b6847c8fb476c43390e9e576c42efc22e3c02a122

Download Submit
\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISBEW64.exe

Filesize
178KB

MD5
40f3a092744e46f3531a40b917cca81e

SHA1
c73f62a44cb3a75933cecf1be73a48d0d623039b

SHA256
561f14cdece85b38617403e1c525ff0b1b752303797894607a4615d0bd66f97f

SHA512
1589b27db29051c772e5ba56953d9f798efbf74d75e0524fa8569df092d28960972779811a7916198d0707d35b1093d3e0dd7669a8179c412cfa7df7120733b2

Download Submit
\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\ISRT.dll

Filesize
426KB

MD5
8af02bf8e358e11caec4f2e7884b43cc

SHA1
16badc6c610eeb08de121ab268093dd36b56bf27

SHA256
58a724d23c63387a2dda27ccfdbc8ca87fd4db671bea8bb636247667f6a5a11e

SHA512
d0228a8cc93ff6647c2f4ba645fa224dc9d114e2adb5b5d01670b6dafc2258b5b1be11629868748e77b346e291974325e8e8e1192042d7c04a35fc727ad4e3fd

Download Submit
\Users\Admin\AppData\Local\Temp\{90CEBC28-A207-4996-AA21-C4EF21385DB9}\_isres_0x0409.dll

Filesize
1.8MB

MD5
7de024bc275f9cdeaf66a865e6fd8e58

SHA1
5086e4a26f9b80699ea8d9f2a33cead28a1819c0

SHA256
bd32468ee7e8885323f22eabbff9763a0f6ffef3cc151e0bd0481df5888f4152

SHA512
191c57e22ea13d13806dd390c4039029d40c7532918618d185d8a627aabc3969c7af2e532e3c933bde8f652b4723d951bf712e9ba0cc0d172dde693012f5ef1a

Download Submit
memory/600-149-0x0000000000160000-0x0000000000470000-memory.dmp

Filesize
3.1MB

Download
memory/600-147-0x000007FFFFFD5000-0x000007FFFFFD6000-memory.dmp

Filesize
4KB

Download
memory/600-146-0x000007FFFFFD5000-0x000007FFFFFD6000-memory.dmp

Filesize
4KB

Download
memory/600-150-0x0000000000160000-0x0000000000470000-memory.dmp

Filesize
3.1MB

Download
memory/676-89-0x0000000074CE0000-0x0000000074E54000-memory.dmp

Filesize
1.5MB

Download
memory/676-90-0x00000000774D0000-0x0000000077679000-memory.dmp

Filesize
1.7MB

Download
memory/676-91-0x0000000074CE0000-0x0000000074E54000-memory.dmp

Filesize
1.5MB

Download
memory/1616-73-0x00000000774D0000-0x0000000077679000-memory.dmp

Filesize
1.7MB

Download
memory/1616-72-0x0000000074D80000-0x0000000074EF4000-memory.dmp

Filesize
1.5MB

Download
memory/2252-94-0x00000000774D0000-0x0000000077679000-memory.dmp

Filesize
1.7MB

Download
memory/2252-142-0x0000000074CE0000-0x0000000074E54000-memory.dmp

Filesize
1.5MB

Download
memory/2760-40-0x0000000002F20000-0x00000000030E7000-memory.dmp

Filesize
1.8MB

Download
memory/2760-37-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download