cybergate | 44aa86c6880354edb6c4df8c9d6c0075c0da0fb8e1537a47329deda54c041344

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/03/2025, 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Size

281KB
MD5

7e6fc2d6bc70a57d3e6bc35e066d9cff
SHA1

2fae1438e0d749a88d4227da5db48ddc90bb54ab
SHA256

44aa86c6880354edb6c4df8c9d6c0075c0da0fb8e1537a47329deda54c041344
SHA512

89dd93d051432e740c1cbfa2e3142c4e184e196547a789d31aa92f4d83df876ded0742b8272947993ebb738a8dff80fe8190f0d5e2096c62dd2efda29f8e286d
SSDEEP

6144:gScrLt4mp8D6WGc/YSlIipBReybLzeh7Yy0DMIdeXijX:xcKy78QSVndyhsFMCeSjX

Score

10^/10

cybergate remote discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

remote

merabti01.no-ip.info:288

Mutex

2TH4461J3K8JE7

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
svchost.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe"	server.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe"	server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	server.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{7L4HR7J7-O046-W22W-C2F8-AD8ADB6R2F8U}	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7L4HR7J7-O046-W22W-C2F8-AD8ADB6R2F8U}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{7L4HR7J7-O046-W22W-C2F8-AD8ADB6R2F8U}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7L4HR7J7-O046-W22W-C2F8-AD8ADB6R2F8U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe Restart"	server.exe

Executes dropped EXE 4 IoCs

pid	Process
1604	server.exe
900	server.exe
1384	server.exe
1824	server.exe

Loads dropped DLL 10 IoCs

pid	Process
2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
2280	WerFault.exe
2280	WerFault.exe
2280	WerFault.exe
1604	server.exe
1604	server.exe
2088	WerFault.exe
2088	WerFault.exe
2088	WerFault.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\install\server.exe	server.exe
File created	C:\Windows\SysWOW64\install\server.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	server.exe
File created	C:\Windows\SysWOW64\install\server.exe	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1136-532-0x0000000010490000-0x0000000010502000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1044	1136	WerFault.exe	31
644	2108	WerFault.exe	33
2916	1848	WerFault.exe	36
2280	900	WerFault.exe	38
2044	1520	WerFault.exe	41
2088	1824	WerFault.exe	43

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
1604	server.exe
1604	server.exe
1384	server.exe
1384	server.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
1604	server.exe
1384	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21
PID 2708 wrote to memory of 1208	2708	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 264
      4⤵
      Program crash
      PID:1044
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 216
      4⤵
      Program crash
      PID:644
- - C:\Windows\SysWOW64\install\server.exe
    "C:\Windows\system32\install\server.exe"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:1604
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 260
        5⤵
        Program crash
        
        PID:2916
  - - C:\Windows\SysWOW64\install\server.exe
      "C:\Windows\SysWOW64\install\server.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 212
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2280
  - - C:\Users\Admin\AppData\Roaming\install\server.exe
      "C:\Users\Admin\AppData\Roaming\install\server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:1384
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1520
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 260
        6⤵
        Program crash
        
        PID:2044
    - - C:\Users\Admin\AppData\Roaming\install\server.exe
        
        "C:\Users\Admin\AppData\Roaming\install\server.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 220
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
236KB

MD5
63570976e06b551c3cde0028cde2e876

SHA1
410225155783936ce519fdbbe2922419392a9e38

SHA256
7e71e993da66ff881ca62317447025c4bbf22b1ac43f650ed9b05869ef9eda27

SHA512
dc0e8f5b5c732ad9f72202509a42c3c5c73f0056f5322f7cac54205c6e4a4e1eb961a355458b71866e8a75013962e7aa9541f8fabaa6fc21406571e84de8bd3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
236KB

MD5
e3070601bf7de2b9bbb2335b25905ea4

SHA1
1a410e0ba88583a48ac0b7f29a325a7a7b5fd325

SHA256
2298f33ce2aee4061745b5a537a70202fcabb857777a8eb4c87b4fd6afc3811b

SHA512
26b0536a146a0845515ba44e86b3705c69cfa1c04cadd8bb3cd134219cf547b4aed1a6738e2e338046d84ee98d0c1546cbcbcafed8ac40f52e006dd83d35bee9

Download Submit
\Windows\SysWOW64\install\server.exe

Filesize
281KB

MD5
7e6fc2d6bc70a57d3e6bc35e066d9cff

SHA1
2fae1438e0d749a88d4227da5db48ddc90bb54ab

SHA256
44aa86c6880354edb6c4df8c9d6c0075c0da0fb8e1537a47329deda54c041344

SHA512
89dd93d051432e740c1cbfa2e3142c4e184e196547a789d31aa92f4d83df876ded0742b8272947993ebb738a8dff80fe8190f0d5e2096c62dd2efda29f8e286d

Download Submit
memory/1136-246-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1136-262-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1136-532-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/1208-3-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download