blackmoon | 371c685d9b8f71da804ec0de71fcd8c41a02928a64fffa9601999e77d810ede4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chromestup翻译插件.msi
Size

6.4MB
MD5

5e95a04a874d801f406b1f2531056131
SHA1

66caf403d62d69f065a20ee71d8699456319893d
SHA256

b59cb81b4ea7d8e84a5738b9095d63670362380d0fb16feaa13badc4308c4dc5
SHA512

97c028d9ff9792234b2c5c1551e34c9b68df2bc489b0bdb2389a60021b2a28adb5a931d2f2973fb09194d5e538832bd20b5ed2a9c1cc3919a4119cfc27eceabd
SSDEEP

98304:/PBflMPzidUtZX3GcYXhDpjRPuZ+ksUmz6e30YhLUuunN/A0sO0vcap:HBfMDXXYXlsMz6evpjunNI0x0v

Score

10^/10

blackmoon fatalrat aspackv2 banker discovery infostealer persistence privilege_escalation rat trojan vmprotect

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/1152-58-0x0000000000400000-0x0000000000441000-memory.dmp	family_blackmoon

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat
Fatalrat family
fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/5048-50-0x0000000010000000-0x000000001002D000-memory.dmp	fatalrat

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000023ccc-42.dat	aspack_v212_v242

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0007000000023cce-56.dat	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVDisplay = "C:\\ProgramData\\Smart\\csrss.exe"	setup.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57f7ae.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7FC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F18B03A5-83F7-48AF-8FB0-DBC5D3BCE650}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFAC2.tmp	msiexec.exe
File created	C:\Windows\Installer\e57f7ae.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF926.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF956.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF967.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF996.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9B8.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1152	setup.exe
5048	svchost.exe

Loads dropped DLL 7 IoCs

pid	Process
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3412	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001d4141155d34ac580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001d4141150000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001d414115000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1d414115000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001d41411500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Group = "Fatal"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\InstallTime = "2024-12-05 03:24"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files\Microvirt\MEmuHyperv\mesvc.exe = "~ RUNASADMIN "	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\ProgramData\Smart\csrss.exe = "~ RUNASADMIN "	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\ProgramData\NVIDIARV\svchost.exe = "~ RUNASADMIN "	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3700	msiexec.exe
3700	msiexec.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe
5048	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3412	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3412	msiexec.exe
Token: SeSecurityPrivilege	3700	msiexec.exe
Token: SeCreateTokenPrivilege	3412	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3412	msiexec.exe
Token: SeLockMemoryPrivilege	3412	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3412	msiexec.exe
Token: SeMachineAccountPrivilege	3412	msiexec.exe
Token: SeTcbPrivilege	3412	msiexec.exe
Token: SeSecurityPrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeLoadDriverPrivilege	3412	msiexec.exe
Token: SeSystemProfilePrivilege	3412	msiexec.exe
Token: SeSystemtimePrivilege	3412	msiexec.exe
Token: SeProfSingleProcessPrivilege	3412	msiexec.exe
Token: SeIncBasePriorityPrivilege	3412	msiexec.exe
Token: SeCreatePagefilePrivilege	3412	msiexec.exe
Token: SeCreatePermanentPrivilege	3412	msiexec.exe
Token: SeBackupPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeShutdownPrivilege	3412	msiexec.exe
Token: SeDebugPrivilege	3412	msiexec.exe
Token: SeAuditPrivilege	3412	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3412	msiexec.exe
Token: SeChangeNotifyPrivilege	3412	msiexec.exe
Token: SeRemoteShutdownPrivilege	3412	msiexec.exe
Token: SeUndockPrivilege	3412	msiexec.exe
Token: SeSyncAgentPrivilege	3412	msiexec.exe
Token: SeEnableDelegationPrivilege	3412	msiexec.exe
Token: SeManageVolumePrivilege	3412	msiexec.exe
Token: SeImpersonatePrivilege	3412	msiexec.exe
Token: SeCreateGlobalPrivilege	3412	msiexec.exe
Token: SeBackupPrivilege	4312	vssvc.exe
Token: SeRestorePrivilege	4312	vssvc.exe
Token: SeAuditPrivilege	4312	vssvc.exe
Token: SeBackupPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeDebugPrivilege	5048	svchost.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeBackupPrivilege	3668	srtasks.exe
Token: SeRestorePrivilege	3668	srtasks.exe
Token: SeSecurityPrivilege	3668	srtasks.exe
Token: SeTakeOwnershipPrivilege	3668	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3412	msiexec.exe
3412	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1152	setup.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3668	3700	msiexec.exe	94
PID 3700 wrote to memory of 3668	3700	msiexec.exe	94
PID 3700 wrote to memory of 2008	3700	msiexec.exe	96
PID 3700 wrote to memory of 2008	3700	msiexec.exe	96
PID 3700 wrote to memory of 2008	3700	msiexec.exe	96
PID 3700 wrote to memory of 1152	3700	msiexec.exe	97
PID 3700 wrote to memory of 1152	3700	msiexec.exe	97
PID 3700 wrote to memory of 1152	3700	msiexec.exe	97
PID 1152 wrote to memory of 5048	1152	setup.exe	98
PID 1152 wrote to memory of 5048	1152	setup.exe	98
PID 1152 wrote to memory of 5048	1152	setup.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chromestup翻译插件.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3412

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 33459D3303140BD4B7AB0EE0F491ED6C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2008
- C:\ProgramData\Smart\setup.exe
  "C:\ProgramData\Smart\setup.exe"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\ProgramData\NVIDIARV\svchost.exe
    C:\ProgramData\NVIDIARV\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57f7b1.rbs

Filesize
1KB

MD5
b0c452f6cd651b1ecbab9d4d8abcb3bf

SHA1
f6e350e7a735dcc9a3c96add4e3a733d86252532

SHA256
cab626d4c5b1897d53e9e9eda9582b47b97ebb1e8c2e12292745080b99bcdb62

SHA512
4ff928e0a4ca5e7ce1c938d2d8aadf933b6ffc3f2c36865d3931978f968c22271835356cacb75a68c0880f124ca16bb020c2084efa8b90d67a76fdf393ff15a3

Download Submit
C:\ProgramData\NVIDIARV\svchost.exe

Filesize
3.4MB

MD5
e06b6a425c32bafc08908f7364b4f153

SHA1
3804397a1f2997db63c8d0133fd90b16a995f4eb

SHA256
1cd4f79327c883ad9b869b2dbb93396e283663613065613421b6f3f43eaf8cdb

SHA512
c7613d95eb1bab7f5487106686e21b95d240cf1608cb96f1da17b6f11507f38474695ffb76d143d29f4e83931ebfe418fa3bed5f9d74e353e2fcd69bbea3bb5b

Download Submit
C:\ProgramData\Smart\csrss.exe

Filesize
978KB

MD5
8e945aaf7128bb3db83e51f3c2356637

SHA1
bcc64335efc63cb46e14cc330e105520391e2b00

SHA256
4fcf6394b14e24d830b04209a0ede1dcc911d199740a55d12c8ab8aeabb84073

SHA512
150636eea0cab3e738f5e94ae910d189622fa3221aca1cecc05bf0f5a80f2fab055adeafd99eab7a2a1d3911ff2784cf521a2681e5ddf7737f4363b915b8c2a8

Download Submit
C:\ProgramData\Smart\libcef.dll

Filesize
756KB

MD5
48fbee27eabd6b592e96fe5ff4086077

SHA1
f9210d906a7db652c1487af704b065b641ed4f8c

SHA256
03115d392d4d012975476906fa61722b8845bdc8aad603021e766864458f9e08

SHA512
772375425457d15ac05376ae92bdc76582a6a538f2f9e0d4838396ae08c8ec5206b43e088604e8888440a227c5663035d6bbdff897353d39c339148425727bcf

Download Submit
C:\ProgramData\Smart\setup.exe

Filesize
77KB

MD5
40e9f7352914f047d2a38c499260be39

SHA1
38a327ba8682cf7991b6a10f80d7d747aab4d998

SHA256
1063f82b25d035d9027456569bfc08ba436132a36c519ecebe4b7fd7ad1cd34c

SHA512
aea8a8a7b62bf3c7712decef260138ed376956cc6aef5e58f9001ddf3e7acd04d4084be3b9a2990fa7486e6842a2c400e1e138358ea08916bade3dd4d159f19a

Download Submit
C:\Windows\Installer\MSIF7FC.tmp

Filesize
587KB

MD5
c7fbd5ee98e32a77edf1156db3fca622

SHA1
3e534fc55882e9fb940c9ae81e6f8a92a07125a0

SHA256
e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6

SHA512
8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

Download Submit
C:\Windows\Installer\MSIF996.tmp

Filesize
1.1MB

MD5
ae463676775a1dd0b7a28ddb265b4065

SHA1
dff64c17885c7628b22631a2cdc9da83e417d348

SHA256
83fbfcaff3da3eb89f9aec29e6574cf15502fd670cbb2ab0c8a84451b2598b22

SHA512
e47c2db249e7a08c5d2864671fbc235e48aebecbe0b2c2334d1a4cba1b5b3037522ff89408589f3559b3a1eaf507bd338645387d55800029bb3b941d4c7744d6

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
04c1d74f04a5e28b98706aeaf7efeef5

SHA1
907fe3408f871b9f2d0406a7bbd70c076938e4f8

SHA256
02030e7fb183f2643a1691f1658ac1ad54d57b02c94d94c46f3aa3577a9c2a1e

SHA512
932cde0e58a45a42fd49f3a8e2e6ff5ef47eab3bb283c7fa4bedaa6eef483b63456fd3f5a3e0dcf3ae221c2af4e9bb133fa08dcf5f2336fa434efad5cf71ec9d

Download Submit
\??\Volume{1541411d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c1334c70-fd02-43bf-973e-76ae049aa570}_OnDiskSnapshotProp

Filesize
6KB

MD5
f63c867aa560dc950fc993775f78f538

SHA1
5d0c06763bfa3f56769fd18a781b681fa28fa325

SHA256
838cc7df684f1cbd53544f8769b4e25e4516f5ff7da121f4dc54c7c302ab45d0

SHA512
61747e2b2fdce34bc775b4705ad922849f1d430f41e56cda600c4e804806e201dd3ffafbd20a91f770632c70cd867462897781ea8f88724849a0917cd3c6013e

Download Submit
memory/1152-43-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1152-58-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5048-50-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/5048-48-0x0000000000400000-0x0000000000911000-memory.dmp

Filesize
5.1MB

Download