lumma | d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Size

19.2MB
MD5

bb0ca87d28e7c1bfd53e3e592e75e684
SHA1

23be4528fe7dd78243845a6a08a88ce68200d59a
SHA256

d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea
SHA512

217effd932ae2b5e21527bcc7a22c0f8a8ae0d89902ef00669ef9cc11463995c8c48d34d0b75b55dd50421c2abf19e8b72289abfbb7757339f825fe6ccdb59a7
SSDEEP

393216:kxVUrUl7eOos7orHgF4n5tZkk5b4EMqbfhYwWMr220ItXVca6cjL6OcaAeEKQHeg:CVUrUl7eOuTg4VkDEMq1YpItB6YOO1Af

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
2952	MSI9AFE.tmp

Loads dropped DLL 15 IoCs

pid	Process
2768	MsiExec.exe
2768	MsiExec.exe
2768	MsiExec.exe
2768	MsiExec.exe
2768	MsiExec.exe
2768	MsiExec.exe
2768	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2244	msiexec.exe
2768	MsiExec.exe
2768	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\R:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\T:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\H:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\J:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\M:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\S:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\X:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\K:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\U:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\W:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\Y:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
File opened (read-only)	\??\N:	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2952 set thread context of 2864	2952	MSI9AFE.tmp	35

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI9AFE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9733.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9667.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI987C.tmp	msiexec.exe
File created	C:\Windows\Installer\f769540.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9ADE.tmp	msiexec.exe
File created	C:\Windows\Installer\f76953d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76953d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f769540.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiag.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2244	msiexec.exe
2244	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2244	msiexec.exe
Token: SeTakeOwnershipPrivilege	2244	msiexec.exe
Token: SeSecurityPrivilege	2244	msiexec.exe
Token: SeCreateTokenPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeAssignPrimaryTokenPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeLockMemoryPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeIncreaseQuotaPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeMachineAccountPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeTcbPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeSecurityPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeTakeOwnershipPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeLoadDriverPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeSystemProfilePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeSystemtimePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeProfSingleProcessPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeIncBasePriorityPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeCreatePagefilePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeCreatePermanentPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeBackupPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeRestorePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeShutdownPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeDebugPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeAuditPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeSystemEnvironmentPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeChangeNotifyPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeRemoteShutdownPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeUndockPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeSyncAgentPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeEnableDelegationPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeManageVolumePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeImpersonatePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeCreateGlobalPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeCreateTokenPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeAssignPrimaryTokenPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeLockMemoryPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeIncreaseQuotaPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeMachineAccountPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeTcbPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeSecurityPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeTakeOwnershipPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeLoadDriverPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeSystemProfilePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeSystemtimePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeProfSingleProcessPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeIncBasePriorityPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeCreatePagefilePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeCreatePermanentPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeBackupPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeRestorePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeShutdownPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeDebugPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeAuditPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeSystemEnvironmentPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeChangeNotifyPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeRemoteShutdownPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeUndockPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeSyncAgentPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeEnableDelegationPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeManageVolumePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeImpersonatePrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeCreateGlobalPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeCreateTokenPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeAssignPrimaryTokenPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
Token: SeLockMemoryPrivilege	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2768	2244	msiexec.exe	31
PID 2244 wrote to memory of 2768	2244	msiexec.exe	31
PID 2244 wrote to memory of 2768	2244	msiexec.exe	31
PID 2244 wrote to memory of 2768	2244	msiexec.exe	31
PID 2244 wrote to memory of 2768	2244	msiexec.exe	31
PID 2244 wrote to memory of 2768	2244	msiexec.exe	31
PID 2244 wrote to memory of 2768	2244	msiexec.exe	31
PID 2372 wrote to memory of 2900	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe	32
PID 2372 wrote to memory of 2900	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe	32
PID 2372 wrote to memory of 2900	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe	32
PID 2372 wrote to memory of 2900	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe	32
PID 2372 wrote to memory of 2900	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe	32
PID 2372 wrote to memory of 2900	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe	32
PID 2372 wrote to memory of 2900	2372	d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe	32
PID 2244 wrote to memory of 2136	2244	msiexec.exe	33
PID 2244 wrote to memory of 2136	2244	msiexec.exe	33
PID 2244 wrote to memory of 2136	2244	msiexec.exe	33
PID 2244 wrote to memory of 2136	2244	msiexec.exe	33
PID 2244 wrote to memory of 2136	2244	msiexec.exe	33
PID 2244 wrote to memory of 2136	2244	msiexec.exe	33
PID 2244 wrote to memory of 2136	2244	msiexec.exe	33
PID 2244 wrote to memory of 2952	2244	msiexec.exe	34
PID 2244 wrote to memory of 2952	2244	msiexec.exe	34
PID 2244 wrote to memory of 2952	2244	msiexec.exe	34
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35
PID 2952 wrote to memory of 2864	2952	MSI9AFE.tmp	35

C:\Users\Admin\AppData\Local\Temp\d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
"C:\Users\Admin\AppData\Local\Temp\d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\msit\msit 1.0.1\install\C07CAF6\msit.msi" /qn /norestart AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1736564839 "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D0030034811586C4428585B8C2209131 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C12439DCB6DCA7DF605400D90017A727
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2136
- C:\Windows\Installer\MSI9AFE.tmp
  "C:\Windows\Installer\MSI9AFE.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\dxdiag.exe
    "C:\Windows\SysWOW64\dxdiag.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f769541.rbs

Filesize
1KB

MD5
9de135d45db4acbd1b181741cf3b0a3a

SHA1
8eb7d54cbae8806543c6c9a04aea12497852a732

SHA256
cd59cf4e46d86fdc0b35cda8722decda7fdd8c4d94df818713c82e8808bb3e1f

SHA512
c35be297166a1058f4c37ef6f6f6c5a7d66c16dd72823091daffdc345a8963a407286a87d2471a15466683074306b5edf6938562d8d17e2c32b254d3b314007e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCEB6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8F35.tmp

Filesize
997KB

MD5
ec6ebf65fe4f361a73e473f46730e05c

SHA1
01f946dfbf773f977af5ade7c27fffc7fe311149

SHA256
d3614d7bece53e0d408e31da7d9b0ff2f7285a7dd544c778847ed0c5ded5d52f

SHA512
e4d7aafa75d07a3071d2739d18b4c2b0a3798f754b339c349db9a6004d031bf02f3970b030cec4a5f55b4c19f03794b0ce186a303d936c222e7e6e8726fffff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI909D.tmp

Filesize
1.1MB

MD5
03cc8828bb0e0105915b7695b1ec8d88

SHA1
cbf8ec531ea7e3ee58b51bd642f8bfabdc759ee1

SHA256
0e1491ae7344f3a5ec824732648ccdda19b271d6f01471793bf292840fc83b5e

SHA512
593a76166eb6ce2e3537b0d93e216daef12e4ab5b181a194b55a90b39a1af2e0374c4ec3833a000530425319a003cd1a648489640fccaf108061ebea1d9cb1e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCED8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\msit\msit 1.0.1\install\C07CAF6\TeleportPresets.txt

Filesize
740B

MD5
dba29b1cc6a0ac337a02a1b600e59e60

SHA1
efeff3878b981326da4c70be8f9396f0b6020247

SHA256
9331ea0e713c45e2439d7d12709fdd0e1528137c0ef89ae96fb03150d0d9a5de

SHA512
e67a41bec75514ecb47ef2b0fe477cb2240ce9254d1656488f1f0e83b86e43e32b316f9deda9a67e731773928f9479cf80dabcefe88c99ac1f7de5dca795109e

Download Submit
C:\Users\Admin\AppData\Roaming\msit\msit 1.0.1\install\C07CAF6\msit.msi

Filesize
47.1MB

MD5
71b30f6890f9ecf0fabbf1cbbc2427f8

SHA1
41c12abedf033ca0e5d0114520b40f4160a20029

SHA256
5fe2cd05a7cd3783644e141058408f08427f02ddba6b7bc4220f191a43523a85

SHA512
2968e78f4ff28a77b2a6013d70774fed98df3b0cc6496f5d937cf046f37825027e4c2832f9342f0fd61eefda89dd4e1067fd602b9056d9b893be8d0f10628be1

Download Submit
C:\Windows\Installer\MSI9AFE.tmp

Filesize
12.5MB

MD5
4d82074854750fdba89d76624cc1e6f6

SHA1
1cab8150956317418f64e67692072cac8472b75b

SHA256
019cf1aad1f8d4f1b5dae3aa609b2b53cffc3c7894b58b9f0b225868aed7342d

SHA512
068bd8c1db17c4def612618d463239f002e8f4712691a8fc9163215bdaa7bc5306aa861c396438c647e7b839c2c67c5709b25e0695e1baa668aa100310255f9d

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9149.tmp

Filesize
886KB

MD5
accd9092a35e468e8af934accd81e9f6

SHA1
3751384e5e586481618002469190e3c1f271ce6d

SHA256
8339a5ee92e53a155828e58e7700fc17d4f3f8ecb11daeb52aa1118ba3141ecd

SHA512
18e49e56ad2f78db7f4bfabab25cc3ecfcc8180beea8ff162a5d80bd0a6db9eb598f9fa1d5167f078a12f382663a2b205d7e512370e4873a60955a174826e8e3

Download Submit
memory/2864-94-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2864-90-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2864-88-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2864-86-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2864-98-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2864-99-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2864-100-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2864-92-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2864-96-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download