floxif | 5e25bc1819573769183a0a16c5f5c92e66ce927dcd87386f378a0db530f6fe0b

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2025, 10:13 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
Size

127KB
MD5

51190fd8f396a08400f23e794aebc62d
SHA1

bb9d60b6ffb5fd150ecd875d06aea77de775f384
SHA256

5e25bc1819573769183a0a16c5f5c92e66ce927dcd87386f378a0db530f6fe0b
SHA512

c22b4a99e77eba24d3629437c6f3a1a8d8c6871a3d375cbe8c9f1edf9d34e0e700315654c6ba93a1698c734829462a76a98394e3424bb1108ed005cf6745e9dd
SSDEEP

3072:zIQggkXHMoyo02lQBV+UdE+rECWp7hKO6:zIGk8oyoSBV+UdvrEFp7hKO6

Score

10^/10

floxif backdoor discovery evasion persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	winsvcs.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winsvcs.exe

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000c000000023b32-2.dat	floxif

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winsvcs.exe

Disables Task Manager via registry modification
evasion
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c000000023b32-2.dat	acprotect

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\winupdsvcs.exe	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\winupdsvcs.exe	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\winupdsvcs.exe	winsvcs.exe

Executes dropped EXE 1 IoCs

pid	Process
1056	winsvcs.exe

Loads dropped DLL 4 IoCs

pid	Process
1616	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
1056	winsvcs.exe
5040	WerFault.exe
4808	WerFault.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winsvcs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\780873646070850\\winsvcs.exe"	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\780873646070850\\winsvcs.exe"	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1616-0-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/files/0x000c000000023b32-2.dat	upx
behavioral2/memory/1616-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1616-16-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1616-18-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1616-20-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1616-29-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x0009000000023bbf-38.dat	upx
behavioral2/memory/1056-50-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1616-59-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1056-60-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1056-63-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1056-70-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1056-76-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\780873646070850	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
File opened for modification	C:\Windows\780873646070850\winsvcs.exe	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
File created	C:\Windows\780873646070850\winsvcs.exe	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4808	1616	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsvcs.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1616	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
1616	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
1056	winsvcs.exe
1056	winsvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
Token: SeDebugPrivilege	1056	winsvcs.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1056	1616	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe	93
PID 1616 wrote to memory of 1056	1616	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe	93
PID 1616 wrote to memory of 1056	1616	JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe	93

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\780873646070850\winsvcs.exe
  C:\Windows\780873646070850\winsvcs.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 460
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1616 -ip 1616
1⤵
- Loads dropped DLL
PID:5040

Network

DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR

Response
DNS

182.129.81.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

182.129.81.91.in-addr.arpa

IN PTR

Response
DNS

5isohu.com

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Remote address:

8.8.8.8:53

Request

5isohu.com

IN A

Response
DNS

www.aieov.com

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Remote address:

8.8.8.8:53

Request

www.aieov.com

IN A

Response

www.aieov.com

IN A

173.255.194.134

www.aieov.com

IN A

45.56.79.23

www.aieov.com

IN A

72.14.185.43

www.aieov.com

IN A

45.33.20.235

www.aieov.com

IN A

96.126.123.244

www.aieov.com

IN A

45.33.18.44

www.aieov.com

IN A

72.14.178.174

www.aieov.com

IN A

45.33.23.183

www.aieov.com

IN A

45.33.2.79

www.aieov.com

IN A

198.58.118.167

www.aieov.com

IN A

45.33.30.197

www.aieov.com

IN A

45.79.19.196
GET

http://www.aieov.com/logo.gif

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Remote address:

173.255.194.134:80

Request

GET /logo.gif HTTP/1.1
Accept: */*
Host: www.aieov.com

Response

HTTP/1.1 403 Forbidden

server: openresty/1.13.6.1
date: Wed, 01 Jan 2025 10:13:48 GMT
content-type: text/html
content-length: 175
x-fail-reason: Bad Actor
connection: close
DNS

64.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.159.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

134.194.255.173.in-addr.arpa

Remote address:

8.8.8.8:53

Request

134.194.255.173.in-addr.arpa

IN PTR

Response

134.194.255.173.in-addr.arpa

IN PTR

li204-134memberslinodecom
GET

http://www.aieov.com/logo.gif

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Remote address:

173.255.194.134:80

Request

GET /logo.gif HTTP/1.1
Accept: */*
Host: www.aieov.com

Response

HTTP/1.1 403 Forbidden

server: openresty/1.13.6.1
date: Wed, 01 Jan 2025 10:13:52 GMT
content-type: text/html
content-length: 175
x-fail-reason: Bad Actor
connection: close
DNS

5isohu.com

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Remote address:

8.8.8.8:53

Request

5isohu.com

IN A

Response
DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
GET

http://www.aieov.com/logo.gif

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Remote address:

173.255.194.134:80

Request

GET /logo.gif HTTP/1.1
Accept: */*
Host: www.aieov.com

Response

HTTP/1.1 403 Forbidden

server: openresty/1.13.6.1
date: Wed, 01 Jan 2025 10:13:57 GMT
content-type: text/html
content-length: 175
connection: close
DNS

5isohu.com

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Remote address:

8.8.8.8:53

Request

5isohu.com

IN A

Response
GET

http://www.aieov.com/logo.gif

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Remote address:

173.255.194.134:80

Request

GET /logo.gif HTTP/1.1
Accept: */*
Host: www.aieov.com

Response

HTTP/1.1 403 Forbidden

server: openresty/1.13.6.1
date: Wed, 01 Jan 2025 10:14:02 GMT
content-type: text/html
content-length: 175
x-fail-reason: Bad Actor
connection: close
DNS

13.86.106.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.86.106.20.in-addr.arpa

IN PTR

Response
DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

5isohu.com

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Remote address:

8.8.8.8:53

Request

5isohu.com

IN A

Response
GET

http://www.aieov.com/logo.gif

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

Remote address:

173.255.194.134:80

Request

GET /logo.gif HTTP/1.1
Accept: */*
Host: www.aieov.com

Response

HTTP/1.1 403 Forbidden

server: openresty/1.13.6.1
date: Wed, 01 Jan 2025 10:14:07 GMT
content-type: text/html
content-length: 175
x-fail-reason: Bad Actor
connection: close
DNS

197.87.175.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

197.87.175.4.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

134.71.91.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

134.71.91.104.in-addr.arpa

IN PTR

Response

134.71.91.104.in-addr.arpa

IN PTR

a104-91-71-134deploystaticakamaitechnologiescom
DNS

180.129.81.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

180.129.81.91.in-addr.arpa

IN PTR

Response
DNS

43.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.229.111.52.in-addr.arpa

IN PTR

Response

173.255.194.134:80

http://www.aieov.com/logo.gif

http

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

336 B
529 B
6
4

HTTP Request

GET http://www.aieov.com/logo.gif

HTTP Response

403
173.255.194.134:80

http://www.aieov.com/logo.gif

http

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

336 B
529 B
6
4

HTTP Request

GET http://www.aieov.com/logo.gif

HTTP Response

403
173.255.194.134:80

http://www.aieov.com/logo.gif

http

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

336 B
503 B
6
4

HTTP Request

GET http://www.aieov.com/logo.gif

HTTP Response

403
173.255.194.134:80

http://www.aieov.com/logo.gif

http

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

336 B
529 B
6
4

HTTP Request

GET http://www.aieov.com/logo.gif

HTTP Response

403
173.255.194.134:80

http://www.aieov.com/logo.gif

http

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

336 B
529 B
6
4

HTTP Request

GET http://www.aieov.com/logo.gif

HTTP Response

403
92.63.197.153:80

winsvcs.exe

260 B
5
92.63.197.153:80

winsvcs.exe

260 B
5
92.63.197.153:80

winsvcs.exe

260 B
5
92.63.197.153:80

winsvcs.exe

260 B
5
92.63.197.153:80

winsvcs.exe

208 B
4

8.8.8.8:53

196.249.167.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

196.249.167.52.in-addr.arpa
8.8.8.8:53

182.129.81.91.in-addr.arpa

dns

72 B
147 B
1
1

DNS Request

182.129.81.91.in-addr.arpa
8.8.8.8:53

5isohu.com

dns

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

56 B
117 B
1
1

DNS Request

5isohu.com
8.8.8.8:53

www.aieov.com

dns

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

59 B
251 B
1
1

DNS Request

www.aieov.com

DNS Response

173.255.194.134

45.56.79.23

72.14.185.43

45.33.20.235

96.126.123.244

45.33.18.44

72.14.178.174

45.33.23.183

45.33.2.79

198.58.118.167

45.33.30.197

45.79.19.196
8.8.8.8:53

64.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

64.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

134.194.255.173.in-addr.arpa

dns

74 B
116 B
1
1

DNS Request

134.194.255.173.in-addr.arpa
8.8.8.8:53

5isohu.com

dns

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

56 B
117 B
1
1

DNS Request

5isohu.com
8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

5isohu.com

dns

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

56 B
117 B
1
1

DNS Request

5isohu.com
8.8.8.8:53

13.86.106.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

13.86.106.20.in-addr.arpa
8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

5isohu.com

dns

JaffaCakes118_51190fd8f396a08400f23e794aebc62d.exe

56 B
117 B
1
1

DNS Request

5isohu.com
8.8.8.8:53

197.87.175.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

197.87.175.4.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

134.71.91.104.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

134.71.91.104.in-addr.arpa
8.8.8.8:53

180.129.81.91.in-addr.arpa

dns

72 B
147 B
1
1

DNS Request

180.129.81.91.in-addr.arpa
8.8.8.8:53

43.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\CA551260650.tmp

Filesize
51KB

MD5
88e51db0cef4ff83abffa4a3691a6c8b

SHA1
b5046fe9eeacad64cb6b908255e0eafed68f5d27

SHA256
7e9a4439cd642e21bd82af4dc18dcc624c93c66262705ae4a73f4f098df259de

SHA512
6c1e82acb79bc2a07eda74f181d45282cf6dd374d9e055da5cca198105f14c74322b0bf4114e1b7c38653ece614c4611ce65e8da76105bdee0479b8a2f063c1a

Download Submit
memory/1056-76-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1056-69-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1056-70-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1056-68-0x00000000764B0000-0x0000000076513000-memory.dmp

Filesize
396KB

Download
memory/1056-66-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1056-65-0x00000000764B0000-0x0000000076513000-memory.dmp

Filesize
396KB

Download
memory/1056-63-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1056-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1056-50-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1616-30-0x00000000764B0000-0x0000000076513000-memory.dmp

Filesize
396KB

Download
memory/1616-20-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1616-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1616-27-0x00000000764B0000-0x0000000076513000-memory.dmp

Filesize
396KB

Download
memory/1616-24-0x00000000764B0000-0x0000000076513000-memory.dmp

Filesize
396KB

Download
memory/1616-59-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1616-58-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1616-29-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1616-21-0x00000000764C5000-0x00000000764C6000-memory.dmp

Filesize
4KB

Download
memory/1616-18-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1616-16-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1616-17-0x00000000764B0000-0x0000000076513000-memory.dmp

Filesize
396KB

Download
memory/1616-13-0x00000000764B0000-0x0000000076513000-memory.dmp

Filesize
396KB

Download
memory/1616-12-0x00000000764C5000-0x00000000764C6000-memory.dmp

Filesize
4KB

Download
memory/1616-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.