floxif | 44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995a

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
Size

671KB
MD5

09b9bb98de6b332dc3f24a3716e1e200
SHA1

42a2fff6f9128f4f455ca80b1b4fe5d98e42f36b
SHA256

44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995a
SHA512

eafe6bcec569097ab417d59286d9463faef6325a9de37e27fc1e5e0607af845f24588df80cb2d4cf70b76b9060924cebabef7fba0ff8ce843b60ed047c1129a2
SSDEEP

12288:Cm004ZpqVpP0uoODHYStSaO4/Yt0jYize5uPwsdODjGrn9BjvrEH7U:0IPbo//4/20MizOuPNOWrnTrEH7U

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000c000000023b10-2.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c000000023b10-2.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
4744	mint64.exe

Loads dropped DLL 7 IoCs

pid	Process
4084	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
1440	REGSVR32.EXE
1440	REGSVR32.EXE
1120	REGSVR32.EXE
1120	REGSVR32.EXE
1992	REGSVR32.EXE
816	REGSVR32.EXE

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SYSTEM32\CmdRtr64.DLL	mint64.exe
File opened for modification	C:\Windows\SysWOW64\APOMngr.DLL	mint64.exe
File created	C:\Windows\SysWOW64\APOMngr.DLL	mint64.exe
File opened for modification	C:\Windows\SysWOW64\CmdRtr.DLL	mint64.exe
File created	C:\Windows\SysWOW64\CmdRtr.DLL	mint64.exe
File opened for modification	C:\Windows\SYSTEM32\APOMgr64.DLL	mint64.exe
File created	C:\Windows\SYSTEM32\APOMgr64.DLL	mint64.exe
File opened for modification	C:\Windows\SYSTEM32\CmdRtr64.DLL	mint64.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b10-2.dat	upx
behavioral2/memory/4084-5-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1440-86-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1440-90-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1120-92-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1120-96-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4084-112-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ctfile.rfc	mint64.exe
File opened for modification	C:\Windows\ctfile.rfc	mint64.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REGSVR32.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REGSVR32.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\ProgID\ = "APOManager.EndpointEnumeration.1"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\VersionIndependentProgID\ = "APOManager.EndpointEnumeration"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\FLAGS	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration.1\CLSID\ = "{32CD1956-569B-432f-BA27-F0BFEA458D1B}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration\ = "APOManager Enumerator Class"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32\ThreadingModel = "Apartment"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\0	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\HELPDIR	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration\ = "CommandRouter Enumerator Class"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\InprocServer32\ThreadingModel = "Apartment"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\VersionIndependentProgID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration\ = "CommandRouter Enumerator Class"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\ProgID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\ = "APOManager Enumerator Class"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\FLAGS	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\HELPDIR\ = "C:\\Windows\\System32"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\InprocServer32	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration\ = "APOManager Enumerator Class"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\ProgID\ = "APOManager.EndpointEnumeration.1"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\TypeLib\ = "{F852C901-1A8C-4c74-A4CF-DDCBB12D6702}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\ProgID\ = "CommandRouter.EndpointEnumeration.1"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\TypeLib\ = "{5F21BC6D-4756-44ff-BDF7-EF7C4B34F216}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration\CLSID	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\TypeLib	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\FLAGS\ = "0"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\VersionIndependentProgID\ = "APOManager.EndpointEnumeration"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\InprocServer32\ThreadingModel = "Apartment"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration.1\CLSID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\ProgID\ = "CommandRouter.EndpointEnumeration.1"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\InprocServer32\ = "C:\\Windows\\SysWow64\\CmdRtr.DLL"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\HELPDIR\ = "C:\\Windows\\System32"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration.1\ = "APOManager Enumerator Class"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\0\win64\ = "C:\\Windows\\SYSTEM32\\APOMgr64.DLL"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration.1\ = "CommandRouter Enumerator Class"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\TypeLib	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\VersionIndependentProgID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F852C901-1A8C-4C74-A4CF-DDCBB12D6702}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\APOMngr.DLL"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration.1\CLSID\ = "{32CD1956-569B-432f-BA27-F0BFEA458D1B}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\ProgID	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\0\win32	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration\CLSID\ = "{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration\CLSID\ = "{32CD1956-569B-432f-BA27-F0BFEA458D1B}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\InprocServer32	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\APOManager.EndpointEnumeration.1\ = "APOManager Enumerator Class"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration.1\CLSID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32\ThreadingModel = "Apartment"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration\CLSID\ = "{32CD1956-569B-432f-BA27-F0BFEA458D1B}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CommandRouter.EndpointEnumeration.1	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\CmdRtr.DLL"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0\HELPDIR	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\TypeLib	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA9E54D5-17B5-4cf7-8FD8-1F7119BB72D4}\InprocServer32\ = "C:\\Windows\\SysWow64\\APOMngr.DLL"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\ = "CommandRouter Enumerator Class"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32CD1956-569B-432f-BA27-F0BFEA458D1B}\VersionIndependentProgID\ = "CommandRouter.EndpointEnumeration"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F21BC6D-4756-44FF-BDF7-EF7C4B34F216}\1.0	REGSVR32.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4084	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
4084	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4084	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
Token: SeLoadDriverPrivilege	4744	mint64.exe
Token: SeDebugPrivilege	1440	REGSVR32.EXE
Token: SeDebugPrivilege	1120	REGSVR32.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4744	4084	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe	83
PID 4084 wrote to memory of 4744	4084	44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe	83
PID 4744 wrote to memory of 1440	4744	mint64.exe	84
PID 4744 wrote to memory of 1440	4744	mint64.exe	84
PID 4744 wrote to memory of 1440	4744	mint64.exe	84
PID 4744 wrote to memory of 1120	4744	mint64.exe	85
PID 4744 wrote to memory of 1120	4744	mint64.exe	85
PID 4744 wrote to memory of 1120	4744	mint64.exe	85
PID 4744 wrote to memory of 1992	4744	mint64.exe	86
PID 4744 wrote to memory of 1992	4744	mint64.exe	86
PID 4744 wrote to memory of 816	4744	mint64.exe	87
PID 4744 wrote to memory of 816	4744	mint64.exe	87

C:\Users\Admin\AppData\Local\Temp\44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe
"C:\Users\Admin\AppData\Local\Temp\44a8c9c0d52dd54e13559237a0e355ed106e9368db1db5dac579f971065d995aN.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\temp\CRF000\mint64.exe
  "C:\Windows\temp\CRF000\mint64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\REGSVR32.EXE
    C:\Windows\SysWOW64\REGSVR32.EXE /S APOMngr.DLL
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\SysWOW64\REGSVR32.EXE
    C:\Windows\SysWOW64\REGSVR32.EXE /S CmdRtr.DLL
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Windows\SYSTEM32\REGSVR32.EXE
    C:\Windows\SYSTEM32\REGSVR32.EXE /S APOMgr64.DLL
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:1992
- - C:\Windows\SYSTEM32\REGSVR32.EXE
    C:\Windows\SYSTEM32\REGSVR32.EXE /S CmdRtr64.DLL
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\86C4AACFF4.tmp

Filesize
595KB

MD5
067393d41f77ddd66f95f1f216b2c708

SHA1
9c2e85dadf8ab2aa0a16448f1d267338fb375827

SHA256
eeda22bf24d1445e1960dd4d80657cbc5861abc342567905e955b9660e044400

SHA512
d64e248136b0756242dcb11c1e4b4beaba1cd43316530ae5553a8f635b958e6a111dcfd895f379b56a83b7627819bd953ded367213f7c7148811dbe5ebe3236d

Download Submit
C:\Windows\Temp\CRF000\creaf_ms.cab

Filesize
499KB

MD5
0b6c73cfdc72e47cbc8d53a2193dabf7

SHA1
7d4daabd634dbc7fadbe8750ac0f5a309af1b6be

SHA256
d1a019bb6517ad892dbf8483c71401b5f2cae3963a3430c8c0e24986342883f6

SHA512
e02e70ecb004075facfb5d11ab1dc93d95d4831341b9af1111d9a62a07452417a419f5aa959b2b4f80475266294f307497d426ce4c09dd65c8a113855c783302

Download Submit
C:\Windows\Temp\CRF000\mint64.exe

Filesize
278KB

MD5
4e347c53d17096950ca6e29de7c8b048

SHA1
c401d688f13553484c42981b2832d8e15a40ac99

SHA256
c7684779dd89a02ac48c331d03d74e7ee1e297921fb84c3583e52fc3aac654da

SHA512
dd3842774c0ace137ec3c657b6798a723078ca2a002180ec269fe7d12dc223705e0bdfdec95cad17c1273d25130a27eb20ca1004f719f12d77c7870dd41af56f

Download Submit
C:\Windows\temp\CRF000\APOIM.ini

Filesize
9KB

MD5
74658b1bec847c67f9993225827fc83e

SHA1
ea8aea408884cd3f60c6f4ef88ee8708768637b4

SHA256
06ff5f1bda249eea6f8e84d34205800a5c817c4e481ffb60407770b74c8c9b16

SHA512
3fa8cef70211ce9444fd8f57487c4eb964dd959593f6850a47c8c124e92cf4bdd3629915a659072a9a6636c4f984aa7c56faa1260bac7c65762afed821dacbd7

Download Submit
C:\Windows\temp\CRF000\APOMgr64.DLL

Filesize
186KB

MD5
7c35c85de2ce3c74bb432301c53d7a87

SHA1
149d0a61629f93ce8aa8ca18fd337ff25ef25508

SHA256
55ec26c01213e51a246e192540483fe343e81d466224086cafef4b662d9bee85

SHA512
044baab1a9f76891467704f26303995075fccd5d9d5688f844cc46654c9aa2b93abeed83441061bc63cbb3b3c9ffbbbc9b845e1c2b673b0953a0ddd560c3a6bc

Download Submit
C:\Windows\temp\CRF000\APOMngr.DLL

Filesize
145KB

MD5
eeb2cef869a786ae94bf85340ba3168c

SHA1
257a6828db4aa755b1d526ffba34a5e5a1fcc97e

SHA256
88df120a60ca4882534e652c53d2742dd6f3ae93d71d18035aa080d2b3f5a4ea

SHA512
df4aa9159bfa72d8ffbaa6cf393843e4150e2753e0c12e63501e35af54d0407e57255326d4c4ad44674ca4fc908e9065f895e14f763cc9587228efd27838cc14

Download Submit
C:\Windows\temp\CRF000\CmdRtr.DLL

Filesize
72KB

MD5
45f681a6de7ccd2e2cc3bae71fc1cb51

SHA1
cc5048c6310a1f3bd1d4793c45605b31e88c3974

SHA256
d2957e66d1fc7252a9c715fe457e04cd0d4aa9ea0cc62d7c87f21c16a7cf372a

SHA512
3eac9267abd1ea3e3038d2ac8302b63c6761c90845728362a0ce5fb9b1b183f686c77ca0587c11b316783b9c5945365a921a15adeee7ca6d58be251cb6e04e9f

Download Submit
C:\Windows\temp\CRF000\CmdRtr64.DLL

Filesize
87KB

MD5
86f38bb08db7722d38f98eded13ee292

SHA1
c8c8ba335626a03209de6c7cc0f42e82834b31b7

SHA256
e8de437844a6beab521634069aa842e200d64026f1fb68d2305fc217b69fed6a

SHA512
40f5d10324333c6154ea7180bc16e1bf5abbf217fbda5076dc8d171b2754197290438ab71838eafe121728ce9b920f7737cb911bfe713997bb090f14e15be266

Download Submit
C:\Windows\temp\CRF000\mint.ini

Filesize
35B

MD5
f2f26bc7073a90038bbbbb77f857da63

SHA1
2535bc841a92c76ce679f95bea46fdb052355f4a

SHA256
e0cb99676289a6839134a420f73d16ab87e7fcc7eebdbe632b4c3fa6b76e25dc

SHA512
02dedebce961ec8013e8c40941ee83d366c6ef474ad1308f0fb8beb6c882de7e84769c49209183ddbee29a2461ff9bc4e8e6c37921aefe13768133891da323ad

Download Submit
memory/1120-96-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1120-92-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1440-86-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1440-90-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4084-0-0x000000000040A000-0x000000000040B000-memory.dmp

Filesize
4KB

Download
memory/4084-7-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4084-5-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4084-113-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4084-112-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download