floxif | 27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2024 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe
Size

2.5MB
MD5

d8af704b6de9cd7b2bd4d84cb29e8caa
SHA1

d400409c90f82f6593ab50c924c6ad9a1a0d5b68
SHA256

27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4
SHA512

56efaa823980496547b6cb33903a746c57aa3628c626b321ecf61a97a1e3351843009b685aebb09317449f941799a823b5f6af6d959da0287760e5d4cdd7780d
SSDEEP

49152:NQi1Dm59Z9mam7Lv+7edYBwY/h6yGLhjPSHU:SoDm4am7L+7AYuY3ih+HU

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x00040000000229c7-2.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00040000000229c7-2.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3260	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
4024	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe
5068	explorer.exe
3260	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\W32Time = "C:\\Windows\\Inf\\svchost.exe"	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\W32Time = "C:\\Windows\\Inf\\svchost.exe"	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	svchost.exe

Drops autorun.inf file 1 TTPs 22 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\I:\AutoRun.inf	svchost.exe
File opened for modification	\??\O:\AutoRun.inf	svchost.exe
File opened for modification	\??\Y:\AutoRun.inf	svchost.exe
File opened for modification	\??\H:\AutoRun.inf	svchost.exe
File opened for modification	\??\J:\AutoRun.inf	svchost.exe
File opened for modification	\??\M:\AutoRun.inf	svchost.exe
File opened for modification	\??\N:\AutoRun.inf	svchost.exe
File opened for modification	\??\P:\AutoRun.inf	svchost.exe
File opened for modification	\??\Q:\AutoRun.inf	svchost.exe
File opened for modification	\??\W:\AutoRun.inf	svchost.exe
File opened for modification	\??\Z:\AutoRun.inf	svchost.exe
File opened for modification	\??\E:\AutoRun.inf	svchost.exe
File opened for modification	\??\G:\AutoRun.inf	svchost.exe
File opened for modification	\??\K:\AutoRun.inf	svchost.exe
File opened for modification	\??\R:\AutoRun.inf	svchost.exe
File opened for modification	\??\S:\AutoRun.inf	svchost.exe
File opened for modification	\??\T:\AutoRun.inf	svchost.exe
File opened for modification	\??\X:\AutoRun.inf	svchost.exe
File opened for modification	F:\AutoRun.inf	svchost.exe
File opened for modification	\??\U:\AutoRun.inf	svchost.exe
File opened for modification	\??\V:\AutoRun.inf	svchost.exe
File opened for modification	\??\L:\AutoRun.inf	svchost.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00040000000229c7-2.dat	upx
behavioral2/memory/4024-5-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5068-10-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5068-12-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4024-28-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3260-34-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3260-56-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3260-71-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3260-84-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3260-141-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe
File created	\??\c:\progra~1\common~1\system\symsrv.dll.000	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Inf\svchost.exe	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe
File opened for modification	C:\Windows\Inf\svchost.exe	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = ca003100000000008f5990a437003237453544367e310000b20009000400efbe8f5990a48f5990a42e000000763b020000000a00000000000000000000000000000088142c003200370065003500640036006600360064006200340033003300620035003300640062003300630035003300350035003300380035003100320062003200370062003400610065006300370064003200610066003100330039003900360061003900310031003800610065006600340065003100390035006500380062003400000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000004759f1491100557365727300640009000400efbe874f77488f5990a42e000000c70500000000010000000000000000003a00000000009c1a220055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000008f5990a4100054656d7000003a0009000400efbe4759f1498f5990a42e00000083e1010000000100000000000000000000000000000088142c00540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000004759d54e100041646d696e003c0009000400efbe4759f1498f5990a42e00000063e10100000001000000000000000000000000000000e1a69800410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000004759214c10004c6f63616c003c0009000400efbe4759f1498f5990a42e00000082e1010000000100000000000000000000000000000043b623014c006f00630061006c00000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000004759f14912004170704461746100400009000400efbe4759f1498f5990a42e0000006ee10100000001000000000000000000000000000000d06b11004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4548	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3260	svchost.exe
3260	svchost.exe
3260	svchost.exe
3260	svchost.exe
3260	svchost.exe
3260	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe
Token: SeDebugPrivilege	5068	explorer.exe
Token: SeDebugPrivilege	3260	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4024	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe
4024	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe
4548	explorer.exe
4548	explorer.exe
3260	svchost.exe
3260	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 5068	4024	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe	85
PID 4024 wrote to memory of 5068	4024	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe	85
PID 4024 wrote to memory of 5068	4024	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe	85
PID 4024 wrote to memory of 2884	4024	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe	88
PID 4024 wrote to memory of 2884	4024	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe	88
PID 4024 wrote to memory of 2884	4024	27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe	88
PID 2884 wrote to memory of 3260	2884	cmd.exe	90
PID 2884 wrote to memory of 3260	2884	cmd.exe	90
PID 2884 wrote to memory of 3260	2884	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe
"C:\Users\Admin\AppData\Local\Temp\27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe C:\Users\Admin\AppData\Local\Temp\27e5d6f6db433b53db3c535538512b27b4aec7d2af13996a9118aef4e195e8b4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Inf\svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\Inf\svchost.exe
    C:\Windows\Inf\svchost.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3260

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\COMMON~1\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\978D8A0FB8.tmp

Filesize
2.4MB

MD5
40d29684f59e04004923f604b9d40090

SHA1
65dfe6d69eb10c74ee3acd0f6e1c1b0d635c2a31

SHA256
d85acbe7b5ebb63343affba9c77f1f0cda032d32a0c80d1e96801af0dba4fe68

SHA512
daa2222fc7ec49260f0c9ccb08373a338af4acbb96bcf0847e75a3ef3b557b5a15690fa5fc97b3bda20cc0cfdb455bf410be38fdd4ce7c4351cb89a5c1b1c1cc

Download Submit
C:\boot.ima

Filesize
1.4MB

MD5
11ba9fcc7cfff6e4940abf70fb707eae

SHA1
0b2ba1b36eec932a4f0f9433bd5202c1e9a09398

SHA256
63d1deaf70ebaacec01aba35896a676e3b5bcc5d56233022b96a174b2f04a652

SHA512
dec58982880032fa36c63691a4d00b38c37dfce916c8c06a5e7211beb6f1c6b5e841f2132f2c180a5de9c78f1537b380588bca4065b7257bf70ea4cb197e909f

Download Submit
C:\boot.ini

Filesize
78B

MD5
dea0a4576217d29ba0642cc9b7553960

SHA1
e9443f50038d6ae759b85286dad3d4b367542f45

SHA256
59cd24365246d4dbf59643850323904d5b65c33b2b81b1bf9bd8ca07816ae77a

SHA512
5eae93d334b19451c8b8765857e0946c7503aea90f83a1d325bbe00de4c8661c9dce5d7394e5b833762ac34d0927e6949afd51608b4659fb20fb690300d93420

Download Submit
C:\mkldr

Filesize
212KB

MD5
de632df1f44b107d36cf3451d235ed3d

SHA1
cbb5154038adab656f74698579bef8014cb015a1

SHA256
195758963684e8aa635124f3a94d29b9fe537af164aa478375350901490e7e4f

SHA512
85d1b6d2242337e86f02284468281723093998277afbdbf13c36a13abe28c2ceebb3be7362c9d5e61edf65157d3b79cbd20f10bc5e64d8ead7d28683cedfe654

Download Submit
F:\AutoRun.inf

Filesize
69B

MD5
8e1598a9715ef3e68448813df8e82f4a

SHA1
020e696906646cffb4f5ef920e460cc603bdc867

SHA256
68cf63cd67b684da2fd0964b105bc4049dfd8723624deecabb3acc6059539cba

SHA512
5d31ac69962e83774011843eda18ac399a2d4cba82b247e60ea9f9b3327e4ca637d1ee1f0250beab1a5fbf79e35d447b89eb3de75377f0f5989e597a36a92884

Download Submit
memory/3260-56-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3260-71-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3260-34-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3260-33-0x0000000000400000-0x0000000000675000-memory.dmp

Filesize
2.5MB

Download
memory/3260-141-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3260-127-0x0000000000400000-0x0000000000675000-memory.dmp

Filesize
2.5MB

Download
memory/3260-84-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4024-7-0x0000000000460000-0x0000000000464000-memory.dmp

Filesize
16KB

Download
memory/4024-0-0x0000000000400000-0x0000000000675000-memory.dmp

Filesize
2.5MB

Download
memory/4024-28-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4024-5-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4024-27-0x0000000000400000-0x0000000000675000-memory.dmp

Filesize
2.5MB

Download
memory/5068-10-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5068-12-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download