blustealer | c42c871cd29b62344d701a854d15b370e7987d7daad60a8574d4e6b5a5636678

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
Size

881KB
MD5

dc7995dba8cf2cbaee063c4a1b54a058
SHA1

de07f4dd4bb61cea6f058addaa0b6ad922e1790b
SHA256

c42c871cd29b62344d701a854d15b370e7987d7daad60a8574d4e6b5a5636678
SHA512

bb2242fce06e808b7547fc27bf2459c7f0d2e1c3b64c2c20110ef9da093945622697cb2c9496ffe9760c4fa42ced6f9238992bab997a7acdcc78348f9655b9f8
SSDEEP

12288:wu+c+R2Swz+EHJh8LlWDoLaMVR3obhwxDzKQUwSIHvHq+luKwyB:r+gSe7h8LnXJo9iDzKBwSIy+lgyB

Score

10^/10

blustealer discovery stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
budgetn.xyz
Port:
587
Username:
[email protected]
Password:
Q0c,S{Hd]%aL

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer
Blustealer family
blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2480 set thread context of 2024	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	71

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2084	powershell.exe
2692	powershell.exe
2852	powershell.exe
1660	powershell.exe
652	powershell.exe
2788	powershell.exe
2364	powershell.exe
2892	powershell.exe
3056	powershell.exe
1628	powershell.exe
1968	powershell.exe
604	powershell.exe
1400	powershell.exe
1256	powershell.exe
2436	powershell.exe
1568	powershell.exe
924	powershell.exe
2072	powershell.exe
2372	powershell.exe
2056	powershell.exe
2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	604	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2024	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2084	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	31
PID 2480 wrote to memory of 2084	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	31
PID 2480 wrote to memory of 2084	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	31
PID 2480 wrote to memory of 2084	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	31
PID 2480 wrote to memory of 2692	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	33
PID 2480 wrote to memory of 2692	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	33
PID 2480 wrote to memory of 2692	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	33
PID 2480 wrote to memory of 2692	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	33
PID 2480 wrote to memory of 2852	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2852	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2852	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	35
PID 2480 wrote to memory of 2852	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	35
PID 2480 wrote to memory of 1660	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	37
PID 2480 wrote to memory of 1660	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	37
PID 2480 wrote to memory of 1660	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	37
PID 2480 wrote to memory of 1660	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	37
PID 2480 wrote to memory of 652	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	39
PID 2480 wrote to memory of 652	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	39
PID 2480 wrote to memory of 652	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	39
PID 2480 wrote to memory of 652	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	39
PID 2480 wrote to memory of 2788	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	41
PID 2480 wrote to memory of 2788	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	41
PID 2480 wrote to memory of 2788	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	41
PID 2480 wrote to memory of 2788	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	41
PID 2480 wrote to memory of 2364	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	43
PID 2480 wrote to memory of 2364	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	43
PID 2480 wrote to memory of 2364	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	43
PID 2480 wrote to memory of 2364	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	43
PID 2480 wrote to memory of 2892	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	45
PID 2480 wrote to memory of 2892	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	45
PID 2480 wrote to memory of 2892	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	45
PID 2480 wrote to memory of 2892	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	45
PID 2480 wrote to memory of 3056	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	47
PID 2480 wrote to memory of 3056	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	47
PID 2480 wrote to memory of 3056	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	47
PID 2480 wrote to memory of 3056	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	47
PID 2480 wrote to memory of 1628	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	49
PID 2480 wrote to memory of 1628	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	49
PID 2480 wrote to memory of 1628	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	49
PID 2480 wrote to memory of 1628	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	49
PID 2480 wrote to memory of 1968	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	51
PID 2480 wrote to memory of 1968	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	51
PID 2480 wrote to memory of 1968	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	51
PID 2480 wrote to memory of 1968	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	51
PID 2480 wrote to memory of 604	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	53
PID 2480 wrote to memory of 604	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	53
PID 2480 wrote to memory of 604	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	53
PID 2480 wrote to memory of 604	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	53
PID 2480 wrote to memory of 1400	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	55
PID 2480 wrote to memory of 1400	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	55
PID 2480 wrote to memory of 1400	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	55
PID 2480 wrote to memory of 1400	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	55
PID 2480 wrote to memory of 1256	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	57
PID 2480 wrote to memory of 1256	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	57
PID 2480 wrote to memory of 1256	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	57
PID 2480 wrote to memory of 1256	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	57
PID 2480 wrote to memory of 2436	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	59
PID 2480 wrote to memory of 2436	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	59
PID 2480 wrote to memory of 2436	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	59
PID 2480 wrote to memory of 2436	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	59
PID 2480 wrote to memory of 1568	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	61
PID 2480 wrote to memory of 1568	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	61
PID 2480 wrote to memory of 1568	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	61
PID 2480 wrote to memory of 1568	2480	dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe	61

C:\Users\Admin\AppData\Local\Temp\dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:604
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Users\Admin\AppData\Local\Temp\dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
15d69822dbe1260ff3c753b9c97c113c

SHA1
074ad9a9774ef3252547dd949faa07f9406aa5f7

SHA256
d0d16829d353f862c7342b3e0a8922a12d9a2f60699e25ed60446287b3654a26

SHA512
1159f26e0de1329d5bc8c112ee72584d337fa8ce736da5d4e4e12b0e498529a95fb4f6ac9cabaa9b517829ff9c9472912b93f08e33f17862b72199d2bd4c5724

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
52e17a616f21d5671164859750b7ce8d

SHA1
f16bd74aeb3f866485602c15621cddaacc00f20f

SHA256
db40d7d5167d1028a86311946134fdeb77cfd5b6f85ad70a82d1aca186e91b41

SHA512
2865c5a94cb273546e1d7fa9f37aa6997612631e71c31604646130ee04e5dd9c5a70b2049c824243431ce4e3d5f9cbb0e70a5fe35e86c7a3f71243e2fba52cc2

Download Submit
memory/2024-115-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2024-121-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2024-113-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2024-119-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2024-120-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2024-111-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2084-4-0x0000000002CF0000-0x0000000002D30000-memory.dmp

Filesize
256KB

Download
memory/2480-38-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

Filesize
4KB

Download
memory/2480-110-0x0000000005660000-0x00000000056C4000-memory.dmp

Filesize
400KB

Download
memory/2480-108-0x00000000055E0000-0x0000000005664000-memory.dmp

Filesize
528KB

Download
memory/2480-1-0x00000000000B0000-0x0000000000192000-memory.dmp

Filesize
904KB

Download
memory/2480-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

Filesize
4KB

Download