Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

08751be484...2d.dll

windows10-ltsc 2021-x64

10

0a9f79abd4...51.exe

windows10-ltsc 2021-x64

3

0di3x.exe

windows10-ltsc 2021-x64

10

2019-09-02...10.exe

windows10-ltsc 2021-x64

10

2c01b00772...eb.exe

windows10-ltsc 2021-x64

10

31.exe

windows10-ltsc 2021-x64

10

3DMark 11 ...on.exe

windows10-ltsc 2021-x64

3

42f9729255...61.exe

windows10-ltsc 2021-x64

10

5da0116af4...18.exe

windows10-ltsc 2021-x64

10

69c56d12ed...6b.exe

windows10-ltsc 2021-x64

10

905d572f23...50.exe

windows10-ltsc 2021-x64

10

948340be97...54.exe

windows10-ltsc 2021-x64

10

95560f1a46...f9.dll

windows10-ltsc 2021-x64

3

Archive.zi...3e.exe

windows10-ltsc 2021-x64

8

DiskIntern...en.exe

windows10-ltsc 2021-x64

3

ForceOp 2....ce.exe

windows10-ltsc 2021-x64

7

HYDRA.exe

windows10-ltsc 2021-x64

10

KLwC6vii.exe

windows10-ltsc 2021-x64

1

Keygen.exe

windows10-ltsc 2021-x64

10

Lonelyscre...ox.exe

windows10-ltsc 2021-x64

3

LtHv0O2KZDK4M637.exe

windows10-ltsc 2021-x64

10

Magic_File...ja.exe

windows10-ltsc 2021-x64

3

OnlineInstaller.exe

windows10-ltsc 2021-x64

8

Remouse.Mi...cg.exe

windows10-ltsc 2021-x64

3

SecuriteIn...dE.exe

windows10-ltsc 2021-x64

10

SecuriteIn...ee.dll

windows10-ltsc 2021-x64

10

SecurityTa...up.exe

windows10-ltsc 2021-x64

4

Treasure.V...ox.exe

windows10-ltsc 2021-x64

3

VyprVPN.exe

windows10-ltsc 2021-x64

10

WSHSetup[1].exe

windows10-ltsc 2021-x64

3

Yard.dll

windows10-ltsc 2021-x64

10

b2bd3de3e5...2).exe

windows10-ltsc 2021-x64

10

Resubmissions

01/03/2025, 18:58 UTC

250301-xmhhrayp15 10

01/03/2025, 18:55 UTC

250301-xkqrcaypx7 10

Analysis

  • max time kernel
    139s
  • max time network
    128s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    17/01/2025, 20:27 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

  • Size

    80KB

  • MD5

    8152a3d0d76f7e968597f4f834fdfa9d

  • SHA1

    c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e

  • SHA256

    69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b

  • SHA512

    eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4

  • SSDEEP

    1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score
10/10
hakbitcredential_accessdiscoveryevasionexecutionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note
To recover your data contact the email below potentialenergy@mail.ru Key Identifier: JIHn5tRp0vKjIk/wYALSttdnuaNGE/8mBHuhPyZ/ie1E/4aGCxfibLuMepJkMu630yO8PkWsPwZPL05uQQ+VjaOi2ALsjTgqWXwvkXkkF9LwAJnH2d/YP6Oc5nGAdxLWfcqXtLDmkYU3fAb2GxJRkgkoVP4ccw25Axz4svfPr86CGoVwjbGMCYKY8f2iyUs1GlGzjy0jR3gn41i6YvpfV4v33wnXg8Ym3uoELvYmTctvwmr/6ehKHWYqSN4fhjvJMSBcVYQ61kuHekEpPj8DIw4U7L2hG+eq5YlIxIilFLswBJ/YYp78rSdUJ2BCHbOl7YJ8r/yh+Hl39043fyVwgnbsyVeNCC+inJ5CD8G/qCQlexDFQqD83dlzQzyCgaoAFYgwkFLqdJt4VxSq6cZ9Ke3BCMaXtk6ydoXIcxRF+zsTkbOzFjLM2S6xcwyJlESAZG9nMvyGUM3NSjL1MEectTBWVbS/dqO8TuJuQIpAMklk5gq6PoM2MJ6zXwcPxln5bhwqaQMYRtFHOC1mi/iWeTGkJGafdi3zqzGA8cCK16umE+EQFPKhtDWIRiwumqaRzp8PFCEYnbF2HGveZPejsgcZevhw6mVxxXYZCBoXAmNvTUKZYt1JqSAl9+jFleTvuGFNRRQ735rwY+46zGaJ9l+HJbDL8l/crTzpUHmYCcc= Number of files that were processed is: 444
Emails

potentialenergy@mail.ru

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Hakbit

    Ransomware which encrypts files using AES, first seen in November 2019.

    ransomwarehakbit
  • Hakbit family
    hakbit
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 47 IoCs
    evasion
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
    "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLTELEMETRY start= disabled
      2⤵
      • Launches sc.exe
      PID:2816
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
      2⤵
      • Launches sc.exe
      PID:4760
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLWriter start= disabled
      2⤵
      • Launches sc.exe
      PID:4296
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SstpSvc start= disabled
      2⤵
      • Launches sc.exe
      PID:1944
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mspub.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2180
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mydesktopqos.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1972
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mydesktopservice.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3664
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mysqld.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4244
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM sqbcoreservice.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4504
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM firefoxconfig.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4288
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
      2⤵
        PID:3168
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM agntsvc.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1636
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM thebat.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2564
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM steam.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3056
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM encsvc.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4036
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM excel.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4416
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM CNTAoSMgr.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2772
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlwriter.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3460
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM tbirdconfig.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3320
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM dbeng50.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1396
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM thebat64.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2680
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM ocomm.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4864
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM infopath.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:792
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mbamtray.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2800
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM zoolz.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:700
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" IM thunderbird.exe /F
        2⤵
        • Kills process with taskkill
        PID:1784
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM dbsnmp.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4716
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM xfssvccon.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4708
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mspub.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4392
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM Ntrtscan.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2892
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM isqlplussvc.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1760
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM onenote.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:760
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM PccNTMon.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1680
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM msaccess.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3312
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM outlook.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4624
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM tmlisten.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3752
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM msftesql.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM powerpnt.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4172
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mydesktopqos.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1592
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM visio.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3832
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mydesktopservice.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4732
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM winword.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5104
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mysqld-nt.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2828
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM wordpad.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3400
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mysqld-opt.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4856
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM ocautoupds.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4748
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM ocssd.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3276
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM oracle.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2344
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlagent.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2704
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlbrowser.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2016
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlservr.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4736
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM synctime.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1748
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3084
      • C:\Windows\System32\notepad.exe
        "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:4428
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1204
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.7 -n 3
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:6592
        • C:\Windows\system32\fsutil.exe
          fsutil file setZeroData offset=0 length=524288 “%s”
          3⤵
            PID:6492
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
          2⤵
            PID:2612
            • C:\Windows\system32\choice.exe
              choice /C Y /N /D Y /T 3
              3⤵
                PID:6528
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
            1⤵
              PID:3168

            Network

            • flag-us
              DNS
              69.31.126.40.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              69.31.126.40.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              5.114.82.104.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              5.114.82.104.in-addr.arpa
              IN PTR
              Response
              5.114.82.104.in-addr.arpa
              IN PTR
              a104-82-114-5deploystaticakamaitechnologiescom
            • flag-us
              DNS
              86.49.80.91.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              86.49.80.91.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              53.210.109.20.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              53.210.109.20.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              15.164.165.52.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              15.164.165.52.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              11.227.111.52.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              11.227.111.52.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              21.49.80.91.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              21.49.80.91.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              21.49.80.91.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              21.49.80.91.in-addr.arpa
              IN PTR
            No results found
            • 8.8.8.8:53
              69.31.126.40.in-addr.arpa
              dns
              71 B
               157 B
               1
              1

              DNS Request

              69.31.126.40.in-addr.arpa

            • 8.8.8.8:53
              5.114.82.104.in-addr.arpa
              dns
              71 B
               135 B
               1
              1

              DNS Request

              5.114.82.104.in-addr.arpa

            • 8.8.8.8:53
              86.49.80.91.in-addr.arpa
              dns
              70 B
               145 B
               1
              1

              DNS Request

              86.49.80.91.in-addr.arpa

            • 8.8.8.8:53
              53.210.109.20.in-addr.arpa
              dns
              72 B
               158 B
               1
              1

              DNS Request

              53.210.109.20.in-addr.arpa

            • 8.8.8.8:53
              15.164.165.52.in-addr.arpa
              dns
              72 B
               146 B
               1
              1

              DNS Request

              15.164.165.52.in-addr.arpa

            • 8.8.8.8:53
              11.227.111.52.in-addr.arpa
              dns
              72 B
               158 B
               1
              1

              DNS Request

              11.227.111.52.in-addr.arpa

            • 8.8.8.8:53
              21.49.80.91.in-addr.arpa
              dns
              140 B
               145 B
               2
              1

              DNS Request

              21.49.80.91.in-addr.arpa

              DNS Request

              21.49.80.91.in-addr.arpa

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Persistence

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Privilege Escalation

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Defense Evasion

            Credential Access

            Credentials from Password Stores

            2
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Windows Credential Manager

            1
            T1555.004

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Query Registry

            1
            T1012

            Remote System Discovery

            1
            T1018

            System Information Discovery

            2
            T1082

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Service Stop

            1
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log
              Filesize

              1.3MB

              MD5

              2125238333fc62c93afbab199eaaa154

              SHA1

              fd8fc23c71622ca8c812898d2df8b2c13e0f8b38

              SHA256

              2c0bcdcc25ecf257dd50a7162343f0a53434f49272db72ef20115800f8a1f12b

              SHA512

              31b4ce66da281f18be6e1fa88f8782fa724bfcf6c452a01902f0a467f460f6882ad81cefa8519ff3fb48a8f3b6d5badc3e16aa18e7d5c22a4442aa70c3238f4d

              Download Submit

            • C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
              Filesize

              28.8MB

              MD5

              65a403cff5045e171e6bb4c756c254db

              SHA1

              c64396d08a6a0d96fbf64950dfaa834bd74eaad8

              SHA256

              53f0e6f21b6426eace6e4ca66db8e1b12b34a25700274a46d3ddc5d1b955378a

              SHA512

              303afe9c4ad627de27799f3c7443425b9aa9ec8f9d7f0c0fd2ce699e3b2a81cca14df136ea076c1a6e665f66cb117663e0cd80662ac5f0bf6e1ca331c4313087

              Download Submit

            • C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.energy[potentialenergy@mail.ru]
              Filesize

              728KB

              MD5

              63e859e9216e332d04131751d74983de

              SHA1

              b209ea0cd2784bd8ae1e0278bc1d3fc090116d82

              SHA256

              aba0934f323269201f2b6fff4b403afe0299b7841e9377077c51e63c01bff399

              SHA512

              0fbfb3096b949c2cb08a07bfc74362f3e26c89c4ebd0469810cb264d54f36e0837dcf28b2baacfa399666565330ae77e54eafee7b31f9521bc27266bf3f878fb

              Download Submit

            • C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
              Filesize

              25.7MB

              MD5

              3364400ac0f22120b6fae847f80635e8

              SHA1

              5156e4fa25c4437706d4689538609e4e4577cee6

              SHA256

              5b74e2a7f42aef792e759174363410ebb59743b331a26b0f75d44bb914d5ba00

              SHA512

              4eff9397cc05ab53e2b5acf13143c3133d1562db2ee755d1039d646d674b52043e356215c6a38aaeb49f46ac442d0d4cc66d6bc50f198f7b700a737ca2983702

              Download Submit

            • C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[potentialenergy@mail.ru]
              Filesize

              180KB

              MD5

              3cb8b189d947153e3bf4457f2770ec78

              SHA1

              f4205906d64791055d7e66a7b3a98991a96111ab

              SHA256

              f05d1f4a92177c9eb395f678b48e44b3a0a1de071fdf78a2423cf75e5f942a24

              SHA512

              77dffd1baefa4286a23a2484c750eb41183d2bc7a51d3059c9474fa48b9671654629d97621dbf0c418bd26ff123e5f75f1b43114ef7af9a6f9ea4c5ea687017b

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              e30544e6d048b2c1c6129c89835c16dd

              SHA1

              21d167ff64825d3f8a5c351c3160b670dc14cb60

              SHA256

              df0fcfba7ccb03bac0ccf6941f9cc512937fdc63035a2fedc78aa9a82c1d8af1

              SHA512

              fcfc1e2b4110286dc8ede8caab34ea309e24fa6deb225213ab0e5b2d6499cc195e65dde2e125bca3ef5d5b5f4fdda66a1e4429cf2ea1c3df0ba92142342dfd9b

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              28bd37b1c2c4aa1279b13dfde5afc05a

              SHA1

              45514aa393e68144c0483e977e21dbafe318a560

              SHA256

              a5793c71134a44cd641b16ad71ba1d3e2bf6d2e2abc38a1b0304d7a55b1f1b42

              SHA512

              4bc58ce55e5450bda26094f151f9f13f45fffd6f1bfdc131344b9bfb6fa70ede399230f2bebd408f40da68affd8ed083aa4b4ced242ea522aace4b822ec45615

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0nautdyv.jtb.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
              Filesize

              828B

              MD5

              67345b85017b91d07654ec23511b49fc

              SHA1

              c08dce10fa783d575b75620054667ee913970942

              SHA256

              bf1848ea61b8cb7a426742da62ccf7c77d534910ccf65e6f2131703ffc6b9e6a

              SHA512

              48f9f6f47823a16b297807594cf85aae264895c8ac9d5508d022fcf2d17e3f69e759c8ea7debf98f177dc2bb84233a54b427f4838e290f2ab8fb98503aa7cf5c

              Download Submit

            • memory/228-345-0x00007FFF05110000-0x00007FFF05BD2000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/228-228-0x00007FFF05113000-0x00007FFF05115000-memory.dmp

              Filesize

              8KB

              Download

            • memory/228-0-0x00007FFF05113000-0x00007FFF05115000-memory.dmp

              Filesize

              8KB

              Download

            • memory/228-2-0x00007FFF05110000-0x00007FFF05BD2000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/228-1-0x0000000000EA0000-0x0000000000EBA000-memory.dmp

              Filesize

              104KB

              Download

            • memory/228-562-0x00007FFF05110000-0x00007FFF05BD2000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3084-36-0x0000024CFC470000-0x0000024CFC492000-memory.dmp

              Filesize

              136KB

              Download

            We care about your privacy.

            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.