0562122ca4ad3bf393d111cc8e2408a7c374b10ff09d9cc7f40933770b408f21

Analysis

max time kernel
29s
max time network
39s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-01-2025 12:47

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Lammer.exe
Size

23KB
MD5

57d52e1b44c96f301043976953c88a76
SHA1

0fe526ee33fa4db72cd2c4b177c4aaf1f3b0cb45
SHA256

0562122ca4ad3bf393d111cc8e2408a7c374b10ff09d9cc7f40933770b408f21
SHA512

7f55725d76af38eff42e79360b274fbfd2c274765c2113163a45327cc06480939a77c98c199c91914ceee1022dacabc1009cfe401ca16aba46d6ed7754aa47fc
SSDEEP

384:bYmdk8XvCJrQLdRGSiEYF7Y65gPyx6BDXNRmRvR6JZlbw8hqIusZzZso:kwWkti/aeRpcnuG

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3480	netsh.exe
3736	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6fe32c3cda07f1e8b91e22a447ac35bd.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6fe32c3cda07f1e8b91e22a447ac35bd.exe	Trojan.exe

Executes dropped EXE 1 IoCs

pid	Process
1456	Trojan.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6fe32c3cda07f1e8b91e22a447ac35bd = "\"C:\\ProgramData\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Windows\CurrentVersion\Run\6fe32c3cda07f1e8b91e22a447ac35bd = "\"C:\\ProgramData\\Trojan.exe\" .."	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lammer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1648	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	Trojan.exe
Token: 33	1456	Trojan.exe
Token: SeIncBasePriorityPrivilege	1456	Trojan.exe
Token: 33	1456	Trojan.exe
Token: SeIncBasePriorityPrivilege	1456	Trojan.exe
Token: 33	2908	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2908	AUDIODG.EXE
Token: SeDebugPrivilege	1648	taskkill.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1456	2332	Lammer.exe	77
PID 2332 wrote to memory of 1456	2332	Lammer.exe	77
PID 2332 wrote to memory of 1456	2332	Lammer.exe	77
PID 1456 wrote to memory of 3480	1456	Trojan.exe	78
PID 1456 wrote to memory of 3480	1456	Trojan.exe	78
PID 1456 wrote to memory of 3480	1456	Trojan.exe	78
PID 1456 wrote to memory of 5096	1456	Trojan.exe	81
PID 1456 wrote to memory of 5096	1456	Trojan.exe	81
PID 1456 wrote to memory of 5096	1456	Trojan.exe	81
PID 1456 wrote to memory of 4296	1456	Trojan.exe	83
PID 1456 wrote to memory of 4296	1456	Trojan.exe	83
PID 1456 wrote to memory of 4296	1456	Trojan.exe	83
PID 5096 wrote to memory of 2412	5096	cmd.exe	85
PID 5096 wrote to memory of 2412	5096	cmd.exe	85
PID 5096 wrote to memory of 2412	5096	cmd.exe	85
PID 4296 wrote to memory of 1104	4296	cmd.exe	86
PID 4296 wrote to memory of 1104	4296	cmd.exe	86
PID 4296 wrote to memory of 1104	4296	cmd.exe	86
PID 1456 wrote to memory of 3468	1456	Trojan.exe	87
PID 1456 wrote to memory of 3468	1456	Trojan.exe	87
PID 1456 wrote to memory of 3468	1456	Trojan.exe	87
PID 3468 wrote to memory of 1640	3468	cmd.exe	89
PID 3468 wrote to memory of 1640	3468	cmd.exe	89
PID 3468 wrote to memory of 1640	3468	cmd.exe	89
PID 1456 wrote to memory of 1336	1456	Trojan.exe	90
PID 1456 wrote to memory of 1336	1456	Trojan.exe	90
PID 1456 wrote to memory of 1336	1456	Trojan.exe	90
PID 1456 wrote to memory of 1592	1456	Trojan.exe	93
PID 1456 wrote to memory of 1592	1456	Trojan.exe	93
PID 1456 wrote to memory of 1592	1456	Trojan.exe	93
PID 1592 wrote to memory of 2056	1592	cmd.exe	95
PID 1592 wrote to memory of 2056	1592	cmd.exe	95
PID 1592 wrote to memory of 2056	1592	cmd.exe	95
PID 2056 wrote to memory of 2648	2056	net.exe	96
PID 2056 wrote to memory of 2648	2056	net.exe	96
PID 2056 wrote to memory of 2648	2056	net.exe	96
PID 1592 wrote to memory of 1648	1592	cmd.exe	97
PID 1592 wrote to memory of 1648	1592	cmd.exe	97
PID 1592 wrote to memory of 1648	1592	cmd.exe	97
PID 1592 wrote to memory of 3736	1592	cmd.exe	168
PID 1592 wrote to memory of 3736	1592	cmd.exe	168
PID 1592 wrote to memory of 3736	1592	cmd.exe	168
PID 1456 wrote to memory of 1200	1456	Trojan.exe	99
PID 1456 wrote to memory of 1200	1456	Trojan.exe	99
PID 1456 wrote to memory of 1200	1456	Trojan.exe	99

C:\Users\Admin\AppData\Local\Temp\Lammer.exe
"C:\Users\Admin\AppData\Local\Temp\Lammer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\ProgramData\Trojan.exe
  "C:\ProgramData\Trojan.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\ProgramData\Trojan.exe" "Trojan.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFD9A.tmp.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFE47.tmp.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5B.tmp.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 USER32.DLL,SwapMouseButton
      4⤵
      System Location Discovery: System Language Discovery
      PID:1640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C3.tmp.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2CE.tmp.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\SysWOW64\net.exe
      net stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /t /im FirewallControlPanel.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1648
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall set opmode mode=disable
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp530.tmp.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.redtube.com/
      4⤵
      PID:5044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbba003cb8,0x7ffbba003cc8,0x7ffbba003cd8
        5⤵
        
        PID:3640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,14153350419972790582,13146463957472195450,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2008 /prefetch:2
        5⤵
        
        PID:3700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,14153350419972790582,13146463957472195450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:3
        5⤵
        
        PID:2780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,14153350419972790582,13146463957472195450,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
        5⤵
        
        PID:3592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14153350419972790582,13146463957472195450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
        5⤵
        
        PID:2992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14153350419972790582,13146463957472195450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
        5⤵
        
        PID:1564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14153350419972790582,13146463957472195450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1
        5⤵
        
        PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp689.tmp.bat" "
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7E2.tmp.bat" "
    3⤵
    PID:808
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -r -t 1
      4⤵
      PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8CD.tmp.bat" "
    3⤵
    PID:3292
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -s -t 1
      4⤵
      PID:3412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBCC.tmp.bat" "
    3⤵
    PID:1868
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -l -t 1
      4⤵
      PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCB7.tmp.bat" "
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE9C.tmp.bat" "
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFE6.tmp.bat" "
    3⤵
    PID:412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp116D.tmp.bat" "
    3⤵
    PID:584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1259.tmp.bat" "
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1344.tmp.bat" "
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp14CC.tmp.bat" "
    3⤵
    PID:3552

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004AC 0x00000000000004B4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ca055 /state1:0x41c64e6d
1⤵
PID:4652

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Trojan.exe

Filesize
23KB

MD5
57d52e1b44c96f301043976953c88a76

SHA1
0fe526ee33fa4db72cd2c4b177c4aaf1f3b0cb45

SHA256
0562122ca4ad3bf393d111cc8e2408a7c374b10ff09d9cc7f40933770b408f21

SHA512
7f55725d76af38eff42e79360b274fbfd2c274765c2113163a45327cc06480939a77c98c199c91914ceee1022dacabc1009cfe401ca16aba46d6ed7754aa47fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35de3f600c789bb116f9260b2ce21c76

SHA1
ea1238efcd0d219b687cf3eaffb2c6476ad8aeb6

SHA256
3e61c9e1107ec9c337eb3ddcff2f2ab9aa5ea1c76011e5f37fbd50810cf11b35

SHA512
e4daae7ed0cdbc4ce43e582cd5f10e6d9d6010d869147300ab8b645a3fd7505326b2d017b5ba77ad370797635a97450ed7e38811d8fe030dbe57e2602105c7bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbb3b76964c2b8b5fac3d2999bb74031

SHA1
5b8b67a1b1f428c2b487216938f3f096564c7365

SHA256
f3cfaa25b37713a4a85b570b7c93284a3f4981ad417ae98f39d56352318dd5fc

SHA512
73c0276bf1e9f84535b5754763a387a30efb9c79106bfece26da4c0c293f90ef2ad9812e6cc322787f4a043cf452f2660962b30c41bc8bb0940c01aaa68bec71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5a117850e05d060574a84e721a1ae069

SHA1
2c485791ad8a31106be40784311bbf53b0a966ff

SHA256
03ba675d46085bf55f4136adeb54ddac03eba3437c9d95b56ebd48748bf88076

SHA512
4751a172c6cc40d52a37a509efec5fb85b9a54aadf414d29abf9421e7e2debc78f03655eab373c1a5148d5fc2ccee0433ad2ee8359d2c6913e9fb898f7231f9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1259.tmp.bat

Filesize
62B

MD5
273c2fb624cafc931245c7498e14546e

SHA1
0f0c1a86cde9c13849df8b4283ff8a79dd80ee42

SHA256
c295a1015d4bb45cb3bebe51598240444cf687f63e8aa63f647d6a8a5db54590

SHA512
7cb1908a9dd66c7bea734a657ff840087902ba070b085304cd26f0a47c396d69133cd9c5e2163f809c955f27c3f3a6b4162c6fe4441fe1804ef460f64e42ada3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1C3.tmp.bat

Filesize
55B

MD5
97ef49efe0534021d0263f7585ae391b

SHA1
1945e01fe4f5daadaaf8582f8c9ae0999acfd041

SHA256
d2703dc20789862e79634c010c4bd348d4264a863a679e075eb018c97abd62e3

SHA512
a991da0830e78b7fa1f6902622645cbb8bee80d5f923fde3e7cf8a5ca3b9e4500aa1d8dc8e9073c0cdb155a74ba2bc78bd1db732b421101193fc90b3daf48591

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2CE.tmp.bat

Filesize
175B

MD5
4c233ae34e0e53590b756e9bc8468077

SHA1
e3d4cffdeecc863fc189b7abb14d09201241e309

SHA256
3823ed36754159b8544b630d7ad3a68415d77a6b04c2a1ed327ca3cbaeaaee79

SHA512
7a960eca6495e0a69944abacaf3e0ade18b35b1b0157414ff1f4a14932c661de26c0deea8a2066eab965a7e13513e40c2d05a279775a691223e24d3e8a8a859f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp530.tmp.bat

Filesize
37B

MD5
f5726d253fe5d4ecc9568bd9999883ca

SHA1
8fec12574c36283782076dd020fe67bbd6c49b8b

SHA256
1ede0c20a3dc0fd37285a36f19be95d0770f162e199e3514713301ecc8d05687

SHA512
2bc5d23a1eac45030c181f585c1a44b74386779d1e6e9448e190210d4eae4f98273923b7e055985d06c17e629429098fa78fa11a365d40fc93406cf6a13c9ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5B.tmp.bat

Filesize
64B

MD5
c6cecfb0e0915217462ec526b8be01fd

SHA1
8c5796352dd3d977be5c29fb77c957c272ecea07

SHA256
ca5afc214a9eda0274cbde3a000a83849eb11a121c7b6252962dc4c9a6b21f2e

SHA512
54f5a1d9a0f671407c82e1007da57266bc6f9aa1131c1a676e2926a2b332591ebfe9f7d2345dedddeaa17e044267161ed1146dc3b145272bee22b517fcde2fce

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp689.tmp.bat

Filesize
185B

MD5
f0dfe96c58a7a81be2c6938f53e1f982

SHA1
fa31f1755bccdcdf14174f0eb30ba0cf8da41a81

SHA256
2b51af812899dad4305fccec8de8a17df5bc05ccc93c1ebac46acabde148889e

SHA512
91b40013604a84152ef8cf5fe10e5709828860857239a560d7e3a8222dec066716abe71323ddc47994ef41c862ff403a2d7041710af9a30e59f3e4e0201eadeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7E2.tmp.bat

Filesize
34B

MD5
886b428020420fbe31c8c069cf14805c

SHA1
dd51443a6b8cdf52cd7c0ba6658095aa92af50f8

SHA256
8c8e929fc84a367af1a7f1bebf6be1a544ce334f0677ac6db9863abed73fe778

SHA512
0789ea923daeb3ac518a05ccc905987e991eaf081f1c7a67a0dcbea71e328d331101129566edacb1910323c8180fd481d9bf9602ab0e2fcb3bdc41a0880c3b2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8CD.tmp.bat

Filesize
34B

MD5
af45a1096d1543e3b8a84eb76743e1e5

SHA1
74b3825abdc9f63ee98ce5cf02520d4fefb1e52b

SHA256
ea973f052ee5036b535a0b1593bb982861e793367980a4f4d33b6a92d0936bd4

SHA512
db55de580e493150326567ca8879b6acfb63d55ce70d5ec74cb96e21cd6d9cf6198e0afe1cea2b4d4ca49889c50e7f616034e1abb079b544a01c67abcda3b4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBCC.tmp.bat

Filesize
34B

MD5
cce38745bfb6264a3995bbf6d85445c7

SHA1
54771ec0e2fcee5d9916d4195cbe4ce442ea3426

SHA256
f0e91f3262da87d89a4e2521980e5b0a4d392ad46cd381c8d63051087a3bc683

SHA512
66eb8322fdb5007a217f80baa04cd2867f34a8fd3051cc028fa6f6372754499739d721049de758118b9919196fa721ae710b0bf8ef82ab97d5b2e4ad954524cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCB7.tmp.bat

Filesize
77B

MD5
a14439c4f5cb6326e6fb50e4e56a9864

SHA1
65dd9ee8dd3d255d26549a7982052d5c2f7ef856

SHA256
3c6f30cdd7a9391e1f45c4975d135e377aa0cb81d0efafa19bd5200bedb9b162

SHA512
51e985189dd42390c93951cb5e8f471ffb6e35b3e8ac2584a6f3657e8e6e57f34999dcdbb0d1a82a50ec1f0e36b6367c2ae0257b1d9ba2a0e6003c847d6db5a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFE47.tmp.bat

Filesize
136B

MD5
8f4381caf4f4466fdb23f75961e6c109

SHA1
94060d8113f25dd4872b54264cabc5ac73f95948

SHA256
e268378b2c6788f37948835806557b4d0ac887faac8a1f65989c81f4b6c6be39

SHA512
4c5968a774ae1d950e9858d9606237031c1bdc574389de1746d9d6b3861ff7954af57ba382a5555638f7f119a2e2e8ba85568cd6ee8747aad6a6bf7ce93de0d8

Download Submit
memory/1456-13-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/1456-14-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/1456-16-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/1456-77-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/1456-11-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/1456-17-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/1456-18-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/1456-126-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/2332-0-0x0000000074A71000-0x0000000074A72000-memory.dmp

Filesize
4KB

Download
memory/2332-12-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download
memory/2332-1-0x0000000074A70000-0x0000000075021000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads