8531e82a9d4ca8a0f08d678b680695292585ef8fcfd334850601ab1a628a34a0

Analysis

max time kernel
9s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
KittytrapV3.exe
Size 95.7MB
Sample260802-xt5a4aee88
SHA256 8531e82a9d4ca8a0f08d678b680695292585ef8fcfd334850601ab1a628a34a0
MD5 f7a368fa6307cbf94ae0aa1456f61cb8
SHA1 768f71307344eabe5a8909cc47bef5c750c244d8
SHA512 d628c5676813b143381c3a13ed2182e12ea02b792927af0e22911ef94fa33ed4d489e78723f8a1c0c918dbfaf40aab612e2d936c16fb5dfd4e960a7aebe5fd20
SSDEEP 786432:XWyHz4Y9bxjYoFxrogpIaLEGm1aJDrNwuBdM+TkvgKpn/jzVROH0zX23Gslgb:X/H0eb7xpISEGXrNNBTkvgG8Ub
TLSH
T14228CF15A7D8471AD63FC27CC5638112E6F1B86213A1D6CF8854EE8D3FA3BC16736262
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KittytrapV3.exe

Disables Task Manager via registry modification
defense_evasion

Loads dropped DLL 18 IoCs

pid	Process
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe
1504	KittytrapV3.exe

Modifies visibility of existing users in the login screen 1 TTPs 1 IoCs

A user account was hidden or made visible on the Windows login screen through a registry modification.

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Admin = "1"	KittytrapV3.exe

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP		1.1.1.3		Process not Found
Destination IP		1.1.1.3		Process not Found
Destination IP	6	1.1.1.3	368	netsh.exe
Destination IP		1.1.1.3		Process not Found
Destination IP		1.1.1.3		Process not Found
Destination IP		1.1.1.3		Process not Found
Destination IP		1.1.1.3		Process not Found
Destination IP		1.1.1.3		Process not Found

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\HideFastUserSwitching = "0"	KittytrapV3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	KittytrapV3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	KittytrapV3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Admin = "1"	KittytrapV3.exe

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
3988	net.exe
2656	net1.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\KittyImages\\wall.jpg"	KittytrapV3.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4080	cmd.exe
3840	cmd.exe
1804	cmd.exe
1676	cmd.exe
4292	cmd.exe
708	cmd.exe
4276	cmd.exe
2500	cmd.exe
1220	cmd.exe
3784	cmd.exe
3436	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\WallpaperStyle = "2"	KittytrapV3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\TileWallpaper = "0"	KittytrapV3.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{E427D72A-80A0-4C0A-8E0B-A090565E91B0}	wmplayer.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3800	wmplayer.exe
Token: SeCreatePagefilePrivilege	3800	wmplayer.exe
Token: SeShutdownPrivilege	4740	unregmp2.exe
Token: SeCreatePagefilePrivilege	4740	unregmp2.exe
Token: SeShutdownPrivilege	3800	wmplayer.exe
Token: SeCreatePagefilePrivilege	3800	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3800	wmplayer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 3800	1504	KittytrapV3.exe	85
PID 3800 wrote to memory of 4740	3800	wmplayer.exe	86
PID 1504 wrote to memory of 3436	1504	KittytrapV3.exe	89
PID 3436 wrote to memory of 3988	3436	cmd.exe	91
PID 3988 wrote to memory of 2656	3988	net.exe	92
PID 1504 wrote to memory of 4080	1504	KittytrapV3.exe	93
PID 4080 wrote to memory of 1448	4080	cmd.exe	95
PID 1448 wrote to memory of 3292	1448	net.exe	96
PID 1504 wrote to memory of 3840	1504	KittytrapV3.exe	97
PID 3840 wrote to memory of 4924	3840	cmd.exe	99
PID 4924 wrote to memory of 4360	4924	net.exe	100
PID 1504 wrote to memory of 1804	1504	KittytrapV3.exe	101
PID 1804 wrote to memory of 2696	1804	cmd.exe	103
PID 2696 wrote to memory of 1976	2696	net.exe	104
PID 1504 wrote to memory of 1676	1504	KittytrapV3.exe	105
PID 1676 wrote to memory of 3756	1676	cmd.exe	107
PID 3756 wrote to memory of 5044	3756	net.exe	108
PID 1504 wrote to memory of 4292	1504	KittytrapV3.exe	109
PID 4292 wrote to memory of 4244	4292	cmd.exe	111
PID 4244 wrote to memory of 2800	4244	net.exe	112
PID 1504 wrote to memory of 708	1504	KittytrapV3.exe	113
PID 708 wrote to memory of 4860	708	cmd.exe	115
PID 4860 wrote to memory of 1760	4860	net.exe	116
PID 1504 wrote to memory of 2500	1504	KittytrapV3.exe	117
PID 2500 wrote to memory of 4528	2500	cmd.exe	119
PID 4528 wrote to memory of 2340	4528	net.exe	120
PID 1504 wrote to memory of 4276	1504	KittytrapV3.exe	121
PID 4276 wrote to memory of 368	4276	cmd.exe	123

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername = "0"	KittytrapV3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "FEMDOM LOSER"	KittytrapV3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "really? click on this?? ;3 ur pass 123"	KittytrapV3.exe

C:\Users\Admin\AppData\Local\Temp\KittytrapV3.exe
"C:\Users\Admin\AppData\Local\Temp\KittytrapV3.exe"
1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies visibility of existing users in the login screen
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1504
- C:\Program Files\Windows Media Player\wmplayer.exe
  "C:\Program Files\Windows Media Player\wmplayer.exe" /fullscreen "C:\Users\Admin\AppData\Local\Temp\intro.mp4"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\System32\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user KittyOwner /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\net.exe
    net user KittyOwner /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user KittyOwner /add
      4⤵
      Creates a new local user account
      PID:2656
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user KittyOwner q5wM9kAu7XALHkO4
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\system32\net.exe
    net user KittyOwner q5wM9kAu7XALHkO4
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user KittyOwner q5wM9kAu7XALHkO4
      4⤵
      PID:3292
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Administrators" KittyOwner /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\system32\net.exe
    net localgroup "Administrators" KittyOwner /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Administrators" KittyOwner /add
      4⤵
      PID:4360
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" 123
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\system32\net.exe
    net user "Admin" 123
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" 123
      4⤵
      PID:1976
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" /passwordchg:yes /expires:never
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\net.exe
    net user "Admin" /passwordchg:yes /expires:never
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" /passwordchg:yes /expires:never
      4⤵
      PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" /active:yes
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\net.exe
    net user "Admin" /active:yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" /active:yes
      4⤵
      PID:2800
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Administrators" "Admin" /delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\system32\net.exe
    net localgroup "Administrators" "Admin" /delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Administrators" "Admin" /delete
      4⤵
      PID:1760
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Users" "Admin" /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\system32\net.exe
    net localgroup "Users" "Admin" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Users" "Admin" /add
      4⤵
      PID:2340
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh interface ip set dns name=Ethernet source=static addr=1.1.1.3
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns name=Ethernet source=static addr=1.1.1.3
    3⤵
    - Unexpected DNS network traffic destination
    - Event Triggered Execution: Netsh Helper DLL
    PID:368
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh interface ipv6 set dns name=Ethernet source=static addr=2606:4700:4700::1113
  2⤵
  - Executes a command shell one-liner
  PID:1220
- - C:\Windows\system32\netsh.exe
    netsh interface ipv6 set dns name=Ethernet source=static addr=2606:4700:4700::1113
    3⤵
    PID:3476
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c shutdown /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  PID:3784
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 0 /f
    3⤵
    PID:3980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3164

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ba855 /state1:0x41c64e6d
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create Account

T1136

Local Account

T1136.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Users

T1564.002

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 e6534d893af667eaf6c1902f9e5c115585b285ba8c146048436265370d246cdf
MD5 4e69fdeeed6ee2611d6aa65112c7b282
SHA1 4f13721c32bf289e84bd3f96c9801b7aeb5e1fc7
SHA512 387a3aacefd5d07a99c16c08ee14329442e0b16f993a0c8bf8fb88fa170c78642c562febcfb41e135d32e76900a751a2fd1847960191f452c4b7fc838b97b683
SSDEEP 768:/0aleDxcg7KGVp3zT13VuI61HOdrrA9abhrXfEwPRzitFrzAqUmNKX08oJImdbaN:YZPhtMiP2NnY4UmqEMioTaBacg
TLSH
T13F153137D150A089CF2C71B2E5ED5F0CBD23A10B12E052465FB4A67BBA633C99D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 c6114d85b212d73f2abe74bec43d1e530312f4138574947e77835178e66b085c
MD5 e5cf43c6fa4e8717dc3f0e9854fdb5ec
SHA1 761f275ae19989db14dfb2dc55a929129d84c5da
SHA512 64dd4394cefa47a9d5466fe08d3ccbbf4b2d0c6ab4270b96db0810dfc3279f6972447efa0dfba995eb4bb21a6294aa6fcedee760ba532755c53582732dd061fe
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaY:rZP2tFP3vqY8+qEMOTaBacg
TLSH
T1A7257437D190B0C5CE2CB171E9ED8F09BA23B10B11A052465FF8A57E7A533D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
MD5 5433eab10c6b5c6d55b7cbd302426a39
SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
SSDEEP 96:zkZRAF6zyHUhm77yB1pZYCEnfHrHHbB6xTGH+YCLV3zwULJEYCJWyHht3zwFRhRM:BFV0bBPCfUdY
TLSH
T1112292A194818DD206290E275DB95C0DDA8CE9D3822C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kittytrap.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\Kittytrap.dll
Size 25.1MB
SHA256 3193e475acd232716cae86ae9e731ca3f50743c43618629e605d7f669a312ff1
MD5 64d78647c6f3d7795114e93188aaf025
SHA1 e4f61187bb18cfe572acda06bdb0399823bc01ed
SHA512 bc1d03ea677576b0d5f26bdd93ac480a349b99273bafb2436b5b6bcdcabe714193c01d9d8492a051be2b4cdd0e10f2c4ab4e9133a3d1a9df496c4025c89b6d50
SSDEEP 393216:G1Am4Y9azm4Hix9bSEY3tNSneALt0cnmvFgpBz6QcDYLEG4NR1aJDr1a38wVlW/T:04Y9bxjYoFxrogpIaLEGm1aJDrNwuBd
TLSH
T1E14723D16F148A9CE7A023B85CF042C065E9B93DE1E4E686EC015F9FFCB534568427BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\Microsoft.Win32.Registry.dll
Size 114KB
SHA256 31f5a1cb2046a26c7be2e3a0a18770d8445f0c9d7213ed7365a8403fcca77ab5
MD5 4aac66cd0c4ace7cffcd3773243b0803
SHA1 c525964d67dd354d5220b8293a62bfb45b410801
SHA512 d536ee1e36e424294a9110c384d6e9a55f5fcd7bb75882cfaeee34cd4a20865949cfdf356d1521312a705ac4c88ba4e3026910dcf1e0cd69d7be0eb7d86d4339
SSDEEP 3072:E8Qwrfx6bAYMteaJSvEdy7IViadv5uatHi+Thi:BJVteaJSvEdE8RI+TU
TLSH
T188B36B20BBC4410FEA7E41B89C734846E232F5A65741ABDF4695C0DD2FA3BC6F632562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Collections.dll
Size 290KB
SHA256 11de530ddce2c99a0be5fcefa0e040062860cd41824834f42e06761a949af957
MD5 75c00f6f6113d35e475b9a1ec166186b
SHA1 ffb8a304155d9c13f58d5cc18c4a7aeceb51701d
SHA512 9234b7521192c44471416d61a2c31b4fc12bb54d36d2ab1d91fc1d4ad02466b7c88e22164264464b4d930592907eb3b8db71ba8c43a88ca57a6a8acd758e2669
SSDEEP 6144:rtH48sjvCSCDLEFCL8ph2wqXh0PRbHkbtXcD:rrUvCS8qCL9wqx2bHkbtC
TLSH
T1CC54392873CC2711FDBE41BAE693C042E3799152435082EB46BDF6519F9BFC12ABB025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.ComponentModel.Primitives.dll
Size 78KB
SHA256 85485dd7639c9449b7d90e305e66612bcd46d14bfb2c216eb6b5c1572ddec1c4
MD5 75f0a60be7fd71384940695df296fb95
SHA1 c4abd4a812e95893945c7c5f1806193678fa7cff
SHA512 c174437cd631eb157eaffc46e93a0f76644a90aa6d6175a372fba08f389bb101ed384cbaecbd7b355eda4bf93e39a7422188c8c9311346faa0a173c5bfc8671c
SSDEEP 1536:e5a9l7Z7h4qjUzMJVLvrYu2nCXK5tZgpcBzd:e+l7Z7h4BIrLvr52CXKOgh
TLSH
T151733A1813E8431AEAAD567C96B399109574F5971313D9CF85E0DA0E2F8F7C2F231A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Diagnostics.Process.dll
Size 322KB
SHA256 786e7825067b48fd2cb9e10b1c971f547a0e83814a1a9b7951b8b64ca1e0b808
MD5 2930cf2c21066ff277510b83d2d3de06
SHA1 cadbccd74d06c4689b083fb0f7de46c8e703f8b6
SHA512 521a6add5987e7b91e95a1ed0a9e3648d5a1ecacb63615e8459cdc2ce01a9176264190a58d95e2e05aed83ad163964665363d32f0943b7d55d5a57a711f4ac98
SSDEEP 6144:uaTnBsJOyjlS+LeRqWwxov9jb3bG1PjdlfOGiHn4LFh:uarBAOyjYqeROxhFIHn4Zh
TLSH
T1DF648E24AB88850DFBAD82788463C402E1BDB443378DD7DB4A54DD992F7B7C6A7311B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Linq.dll
Size 682KB
SHA256 5e36874e08bb3579aba965097ac9d3b2462ac5d631e8b095ead53289b10074e8
MD5 3057e704f0168bd150cc656b99efcf06
SHA1 936cf6e5ecdd872209dc6068a33e1668ca965272
SHA512 11f1b96477915266b2fca699a14613470fbcdc3014e43beaaebe700bbfda43857a9ae5cf40bca54328af89afd6ea5d8d4f16c85755b70143163db9f5b48b8162
SSDEEP 12288:HSa5IvfEbReykb2SNb5i8y2Nt9N7u3esbH:HSR6R7kb2SNb7PjK3esr
TLSH
T103E46C28E39CCB22C62E4A7AB5235135D36153D26792C9CB964CED442FE3BC1667D32C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Memory.dll
Size 158KB
SHA256 a8e1263bfb450d029562302f3784fd91106d8c67f28008a5104faf91503bba3e
MD5 7f3359b8377b530459f45160d7fe87a5
SHA1 3db9da69f5f819e64678385321cfe55ffd8c72ee
SHA512 2068fd6f756ebb6c32816cf35fb0eab482d20a8c9ef022bf15a0b335e97a9981b921b0e948900c8d5fd657021496906bcb3e5514bfbeb845dffe5780f1c00bb4
SSDEEP 3072:Yabfv1/38goVRXZ1isc8JyyKhpwaGrpXki4T/hSGd:Bd383by3vwaGraiw5SE
TLSH
T16DF35A1BD3980257DA2FD6BA8796C202EF336001D711A1CB48D4DA44AF53BE1BF76936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NetworkInformation.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Net.NetworkInformation.dll
Size 154KB
SHA256 8a0e7156004e255b7f94d397bfb3f646c3fd0f8c3a286d3f7005ef49da453750
MD5 04795c5e3ef4a41e9c391ed9ca9b3ab4
SHA1 c0c2e913de91016e77e4351828f8668b033c7d55
SHA512 8c15e2676ab787b3466f08f2dfbf1f1b3e7b19cba7c758d9c772b1e2589e3de41d7f5eb9d4dbfc8124bb53363e48be5f95db46effe8ecffda334930d3b812385
SSDEEP 3072:BFqySgUx6wLv3mqP6ub8VkDLVXyVwaVGT9O5xlMmkH:xSgUx6ux5bWJRPlo
TLSH
T1C7F35C1193940216EA9BC23AB1E76E03953BE6C16323D6DB1588ADDC2EF37D0B731652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Net.Primitives.dll
Size 206KB
SHA256 92639fa57d6ea7bbcbd47f5d108a615cafc75929f5dddda25ceae33db60e959c
MD5 d679d13e700b0f8645e2de5d1a7519f0
SHA1 53d2015142d1b9fa7cbcb6dd1841c569a9eda42a
SHA512 0a2d98055897102b68264c3f4e3b5733055a10507225f6c6126accad66d2873b1db9d0b0c19ca03b4c4fdf6d1395a8c86c7df22706c14f1ef9e7b963a629d4dc
SSDEEP 6144:i0yf5VGYBigOpZAcus4Uzz3KGY+jXHJK8:a1Bp+es5f3KGY83JK8
TLSH
T18A245B29638C460BF76F85788B13CA06E373B5425306D6DB1AA499C47FA37C4BF72192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Private.CoreLib.dll
Size 15.3MB
SHA256 bb9a91b896447b666487d7c6538d0e1a79dbed3604ed913315a59a7c0ec6e7c6
MD5 acfd2ad4337d0efcc734098d70a04e2d
SHA1 f60108139a10cc492daa93491478611c1536b097
SHA512 0b569773107d2d0910574c0ef02c487ecc332575ec5ae679fa6383249c36a0ef37d95dd5677cebb29310b2575ccc05aa2977626003b79672d87c359b82d5fcc8
SSDEEP 196608:tz8tp+2zZ5bTp7Okcl8QP7uOH0XrGGEyllZqe03:J8tp/lxTp7al8Q6OH0XrvX2N
TLSH
T1BDF69D10E3D4CB4AE53E927C8153C225EAB5F8926326C2C70158EA493F63FD9673B761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Private.Xml.Linq.dll
Size 382KB
SHA256 c028f975e4c4487a6266efe93106b17ed0e1020a1ef802efb2c971a7cabb2ad1
MD5 06bb429392c39ea13c6e780372461094
SHA1 ae29b751e6fa9225a40353d2966a2a06017c0034
SHA512 6d81143f0512cd024ceb0f3280e1c065fc1e3395f8aeae6a96c743e8534f2f6d77075c798159592425cde0bbf8f84c055a192e0f0a2528385f914b8a38b32e24
SSDEEP 6144:hgRQPsxlsLJpYKcscCx8tYSqLiViCDPuA:hg6PsxexmYSV3v
TLSH
T17C847C24E3C80A12DF6F92BCC153C941E1B1D25243DAD6CB8538EFE55E8B7C4A67216B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Private.Xml.dll
Size 7.4MB
SHA256 9380bd61bfb15a0066cbf5c10f9a50729c8020d72c84a8eb37fb0074c582b392
MD5 2be1447da6983713c5b246904aa248c8
SHA1 5e076da5fc82b6ef91c98a179fcb813e72c8b273
SHA512 96c7cdc1861c76ef4b1656bf63bc2ab9673a92f3db5c2badc523cbacf92ae2e9a47bf6253dc3a1e691d5ae1da3997ef8f91b3b347f09c07aea4b12792e33a648
SSDEEP 98304:Smv4nygnKe+85ykjHD0x5TSJqjfAF31DMsrUA:LvEMoyGHeTSAE3xM8V
TLSH
T1C3767C14B3C40A19D32FC27D92238611E6F9B8933356EAEF0458DAC51F937C18A7766B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Runtime.InteropServices.dll
Size 110KB
SHA256 500ba5ed075420e8d6857bf38c79708a062f855d1ce87d505b3f1df9357806c6
MD5 dfa380da21f3ae64310eee6918df2ef2
SHA1 34af7a2ce82c6e5482478a08a11d339b9cf193f8
SHA512 d795a7f7ab82926804616258a5c67e0d53d766f970c1d17d3cdbf38d7cf72b081353aa21e9bb0a860e203da61e9346404609d77dfcbfccae56b6e52bf21b71a6
SSDEEP 1536:up2RQtNQMAyNBKTerzicKDq5t4udNY/w2yVvONugk94RHPeF20gB8qzT7:upAiNQMAIKTVC2udNY42ypAuSmcaqX7
TLSH
T1C6B34A207B98863ACA5A473898336D04CEB3FEC69322E6CF9544C49D0FD77C066757A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Claims.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Security.Claims.dll
Size 98KB
SHA256 a57dc1dfd3d2cb774e517e826c05d3e81098d09cee868de4104cf6f1a8a7c4c5
MD5 3c4e6509e453012fef309a02781ffe30
SHA1 01b134f0357c97d121d172da5ee3bf2a98ea382f
SHA512 203f20a1726dd0ec4bb8682ef22fb340312c6107feabb8bc363a48b9c3f7bca799961195d823a08d9584d6ee6fa135a225f7fe8f2d43c42d35dd87b3c3946ef2
SSDEEP 1536:mhAUIoA3VU8GPjLLWNYcIfc/H31IMrOQwQ7rzUU3q2bP6mBvjrvzs:m2doGVU8GbLLaYcIfc/hNRI
TLSH
T1BBA34A1877EC0316D6BB0E3D85F28009D5B5F9822722C6EF09399A0D5E97BC1D631E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Security.Cryptography.dll
Size 2.4MB
SHA256 b11f291573c6dbd6b3d1cadcd0e7a4f7eced94ff009e4061981d91f1315f721a
MD5 5a099f2c157948a4871084b653eccb7d
SHA1 3756cce480c3c95d55e567a0542a8c1a98aa098e
SHA512 c5985ea44c654d1d07c7d2214285a52339acd80d28cf42a6e30d7f51d8f70c1258e8763486cf23b7e1d1652713596146f8cd07d77935d575b38288fb42d2d5c1
SSDEEP 49152:k+eiPVGpQ+nlM82RPOmtx/VBmNDx+62tlDzn:BeD9llmT
TLSH
T1CEC57C04B3C4064AD1AEDAFEC1174956D5B0F44693C29BEF46C9CE482FA37C2977226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Security.Principal.Windows.dll
Size 174KB
SHA256 972a50bb0fb2569e1b77c20465ce8783fc53dba9c2132a33a749ef72977a4c23
MD5 f06d5b5f7d0e57ef8079cde389a1a0df
SHA1 d4ea8fb46777c85eb0be012f69501fd88d856c8c
SHA512 644e00c18e4f88b12d0686c1d193758f0abe31b1dac904000949eccea54c087e50ad3139d197618af05267286a87b687381d1ba418dd97e0a368c06afc1f9dd0
SSDEEP 3072:tA6a2mRkHtntehhzNUxmbr/3rsd1MVbXpWwsh6aH:O6a2l1tscmbr/w88VH
TLSH
T1C0044B265B880643E76F8A7C81E3664597B3A45707819BCB14C0C9E91F97BC3FB32267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Threading.dll
Size 82KB
SHA256 7175ac06b5908412692d2c2e124cb79f58aaee61ade19bb81118d14a92bb7694
MD5 ccb30dd6940a1943b8129bfe5da67d63
SHA1 e0d7d2cc0e425bc401b51b3148cc708ed6c2452c
SHA512 77e73d93df00ab1cbdb1d66a68ea886c89f11201be491136c0cb39fe6e986a94450a608d9b73d29f91f0db011a7009834d378e2e17202edc7eedea4ad0b2bd7d
SSDEEP 1536:cLVlwV2H8OyQwXeisjb9Rpd5bTF9o6zionNozn:cZlJH8OxwXdsf9RpHHF9o6GonKT
TLSH
T19F834B11B3E8090AF67B1779D6B75905C172FEE22B01D6CF4069D20D2FA77C096B226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

intro.mp4

Path C:\Users\Admin\AppData\Local\Temp\intro.mp4
Size 19.4MB
SHA256 c4ff48a58f4c30d7c69d8e8f4271dda1a9738c452836c0687f56e3d185f44b22
MD5 3066f2ec5bff3df08fba01fa371fe521
SHA1 b630ab112ec22c082c800054b6c8223c739f5bdf
SHA512 c7a400a33a712de3062b249a8b622f9e13cfd36bb9d6f0e6121d64512087d7ba496a045b517eadc4adb450e29b71fa8c764ba7d002a6927e445d9065038c88d8
SSDEEP 393216:J1Am4Y9azm4Hix9bSEY3tNSneALt0cnmvFgpBz6QcDYLEG4NR1aJDr1w:v4Y9bxjYoFxrogpIaLEGm1aJDrq
TLSH
T1012733893319681DD77483BCCBE44354BAF2C649DA86D70BF926878C88F17964D83EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads