088a9f665d0fdc9b2bb050ecd1524b1539010bbe1d9935f72343bb2bc5f98975

General

Target

Launcher.exe
Size

164.9MB
MD5

69297f39ec0be1969de6409a310264d1
SHA1

7c0e7ead5bd451a95cd6062eb0fb4a5c053f7190
SHA256

22117115927d13aee3314c659efe6253692ec3555b2b3e602d512067d71e0b98
SHA512

2c6b82ee7d76d227b35e75aed7521a6d939a1f8abe8a031202ec2c56832a3c131a82b006e53be05e0937b461e3a0cdeff8f1f71f1e4e61fb01bc592cd0ee5b57
SSDEEP

1572864:Ftc2cEGwGrRSREICCr3ka8YrcSAfII01aLadS5sDNd+Ipx9cF3LfxNEK2Ho8jlgY:b+CHrJIgIsV

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

Launcher.exe

pid process

244 Launcher.exe
244 Launcher.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ipinfo.io

flow	ioc
8	ipinfo.io

Drops file in System32 directory 2 IoCs

Processes:

Launcher.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	Launcher.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	Launcher.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Launcher.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Launcher.exe

Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

10864 WMIC.exe

pid	process
10864	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	process
7512	tasklist.exe
7384	tasklist.exe
1704	tasklist.exe
7328	tasklist.exe
8136	tasklist.exe
7704	tasklist.exe
7368	tasklist.exe
7612	tasklist.exe
8316	tasklist.exe
7520	tasklist.exe
7504	tasklist.exe
7448	tasklist.exe
7420	tasklist.exe
8152	tasklist.exe
7920	tasklist.exe
7680	tasklist.exe
7896	tasklist.exe
7620	tasklist.exe
7696	tasklist.exe
8212	tasklist.exe
7968	tasklist.exe
7952	tasklist.exe
5792	tasklist.exe
7140	tasklist.exe
7320	tasklist.exe
7400	tasklist.exe
7688	tasklist.exe
7560	tasklist.exe
8160	tasklist.exe
7336	tasklist.exe
7312	tasklist.exe
7644	tasklist.exe
7904	tasklist.exe
7628	tasklist.exe
8324	tasklist.exe
8248	tasklist.exe
8280	tasklist.exe
7960	tasklist.exe
7944	tasklist.exe
7792	tasklist.exe
7784	tasklist.exe
5548	tasklist.exe
7260	tasklist.exe
8016	tasklist.exe
7544	tasklist.exe
7496	tasklist.exe
7436	tasklist.exe
7740	tasklist.exe
7184	tasklist.exe
8340	tasklist.exe
7936	tasklist.exe
7344	tasklist.exe
7296	tasklist.exe
7636	tasklist.exe
7820	tasklist.exe
8124	tasklist.exe
1200	tasklist.exe
7192	tasklist.exe
5968	tasklist.exe
7928	tasklist.exe
7912	tasklist.exe
7732	tasklist.exe
7272	tasklist.exe
8232	tasklist.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

Launcher.exepowershell.exepowershell.exeLauncher.exe

pid	process
244	Launcher.exe
244	Launcher.exe
244	Launcher.exe
244	Launcher.exe
244	Launcher.exe
244	Launcher.exe
10956	powershell.exe
10956	powershell.exe
10956	powershell.exe
11144	powershell.exe
11144	powershell.exe
11144	powershell.exe
5612	Launcher.exe
5612	Launcher.exe
5612	Launcher.exe
5612	Launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

tasklist.exeLauncher.exeWMIC.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	1704	tasklist.exe
Token: SeShutdownPrivilege	244	Launcher.exe
Token: SeCreatePagefilePrivilege	244	Launcher.exe
Token: SeIncreaseQuotaPrivilege	988	WMIC.exe
Token: SeSecurityPrivilege	988	WMIC.exe
Token: SeTakeOwnershipPrivilege	988	WMIC.exe
Token: SeLoadDriverPrivilege	988	WMIC.exe
Token: SeSystemProfilePrivilege	988	WMIC.exe
Token: SeSystemtimePrivilege	988	WMIC.exe
Token: SeProfSingleProcessPrivilege	988	WMIC.exe
Token: SeIncBasePriorityPrivilege	988	WMIC.exe
Token: SeCreatePagefilePrivilege	988	WMIC.exe
Token: SeBackupPrivilege	988	WMIC.exe
Token: SeRestorePrivilege	988	WMIC.exe
Token: SeShutdownPrivilege	988	WMIC.exe
Token: SeDebugPrivilege	988	WMIC.exe
Token: SeSystemEnvironmentPrivilege	988	WMIC.exe
Token: SeRemoteShutdownPrivilege	988	WMIC.exe
Token: SeUndockPrivilege	988	WMIC.exe
Token: SeManageVolumePrivilege	988	WMIC.exe
Token: 33	988	WMIC.exe
Token: 34	988	WMIC.exe
Token: 35	988	WMIC.exe
Token: 36	988	WMIC.exe
Token: SeIncreaseQuotaPrivilege	988	WMIC.exe
Token: SeSecurityPrivilege	988	WMIC.exe
Token: SeTakeOwnershipPrivilege	988	WMIC.exe
Token: SeLoadDriverPrivilege	988	WMIC.exe
Token: SeSystemProfilePrivilege	988	WMIC.exe
Token: SeSystemtimePrivilege	988	WMIC.exe
Token: SeProfSingleProcessPrivilege	988	WMIC.exe
Token: SeIncBasePriorityPrivilege	988	WMIC.exe
Token: SeCreatePagefilePrivilege	988	WMIC.exe
Token: SeBackupPrivilege	988	WMIC.exe
Token: SeRestorePrivilege	988	WMIC.exe
Token: SeShutdownPrivilege	988	WMIC.exe
Token: SeDebugPrivilege	988	WMIC.exe
Token: SeSystemEnvironmentPrivilege	988	WMIC.exe
Token: SeRemoteShutdownPrivilege	988	WMIC.exe
Token: SeUndockPrivilege	988	WMIC.exe
Token: SeManageVolumePrivilege	988	WMIC.exe
Token: 33	988	WMIC.exe
Token: 34	988	WMIC.exe
Token: 35	988	WMIC.exe
Token: 36	988	WMIC.exe
Token: SeShutdownPrivilege	244	Launcher.exe
Token: SeCreatePagefilePrivilege	244	Launcher.exe
Token: SeDebugPrivilege	7132	tasklist.exe
Token: SeDebugPrivilege	7140	tasklist.exe
Token: SeDebugPrivilege	7148	tasklist.exe
Token: SeDebugPrivilege	1200	tasklist.exe
Token: SeDebugPrivilege	7184	tasklist.exe
Token: SeDebugPrivilege	7304	tasklist.exe
Token: SeDebugPrivilege	7312	tasklist.exe
Token: SeDebugPrivilege	5792	tasklist.exe
Token: SeDebugPrivilege	7176	tasklist.exe
Token: SeDebugPrivilege	5548	tasklist.exe
Token: SeDebugPrivilege	7436	tasklist.exe
Token: SeDebugPrivilege	7636	tasklist.exe
Token: SeDebugPrivilege	7528	tasklist.exe
Token: SeDebugPrivilege	5968	tasklist.exe
Token: SeDebugPrivilege	7740	tasklist.exe
Token: SeDebugPrivilege	5800	tasklist.exe
Token: SeDebugPrivilege	7336	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Launcher.execmd.execmd.exe

description	pid	process	target process
PID 244 wrote to memory of 2148	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 2148	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 5072	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 2116	244	Launcher.exe	Launcher.exe
PID 244 wrote to memory of 2116	244	Launcher.exe	Launcher.exe
PID 2148 wrote to memory of 1704	2148	cmd.exe	tasklist.exe
PID 2148 wrote to memory of 1704	2148	cmd.exe	tasklist.exe
PID 244 wrote to memory of 2336	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 2336	244	Launcher.exe	cmd.exe
PID 2336 wrote to memory of 988	2336	cmd.exe	WMIC.exe
PID 2336 wrote to memory of 988	2336	cmd.exe	WMIC.exe
PID 244 wrote to memory of 5080	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 5080	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 1728	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 1728	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 4840	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 4840	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 2512	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 2512	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 4736	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 4736	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 4636	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 4636	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 1904	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 1904	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 1968	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 1968	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 4916	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 4916	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 2544	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 2544	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 1620	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 1620	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 936	244	Launcher.exe	cmd.exe
PID 244 wrote to memory of 936	244	Launcher.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\theonlyscript" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1636 --field-trial-handle=1640,i,11302814624381880582,9338419199389171752,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
2⤵
PID:5072

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\theonlyscript" --mojo-platform-channel-handle=1868 --field-trial-handle=1640,i,11302814624381880582,9338419199389171752,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
2⤵
PID:2116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=244 get ExecutablePath"
2⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=244 get ExecutablePath
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:5080

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1728

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4840

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2512

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4736

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4636

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1904

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1968

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4916

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2544

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1620

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:936

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3488

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3296

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:652

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3136

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2732

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3280

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1544

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4240

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1960

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4556

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2376

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:784

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2520

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:752

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3808

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1844

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4416

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3180

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:488

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3096

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:8008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1436

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2016

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:5060

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:760

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2888

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4328

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1644

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:5068

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1384

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3732

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:5032

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4504

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3024

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2312

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3624

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1220

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4624

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1360

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3572

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2672

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:336

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2140

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:812

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:8220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:972

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1304

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2976

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4640

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2440

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2280

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2100

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1452

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1952

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2612

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2368

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2848

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:8084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4832

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1224

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:8144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1332

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1336

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1380

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3656

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3900

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2704

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4844

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4200

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3744

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:8240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4928

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4856

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1032

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4724

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:8164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4656

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1036

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2580

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2324

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:4892

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2340

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2148

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:2464

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:428

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:7552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3064

C:\Windows\system32\tasklist.exe
tasklist
3⤵
PID:8260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "net session"
2⤵
PID:3288

C:\Windows\system32\net.exe
net session
3⤵
PID:8352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 session
4⤵
PID:9092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\bind\main.exe"
2⤵
PID:4860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
2⤵
PID:4820

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
3⤵
PID:7488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
2⤵
PID:5140

C:\Windows\System32\Wbem\WMIC.exe
wmic OS get caption, osarchitecture
3⤵
PID:7984

C:\Windows\system32\more.com
more +1
3⤵
PID:8172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
2⤵
PID:10732

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
3⤵
PID:10772

C:\Windows\system32\more.com
more +1
3⤵
PID:10780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
2⤵
PID:10824

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController get name
3⤵
- Detects videocard installed
PID:10864

C:\Windows\system32\more.com
more +1
3⤵
PID:10872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
2⤵
PID:10916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:10956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
2⤵
PID:11100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:11144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:9328

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=244 get ExecutablePath"
2⤵
PID:800

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=244 get ExecutablePath
3⤵
PID:11004

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\theonlyscript" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3948 --field-trial-handle=1640,i,11302814624381880582,9338419199389171752,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5612

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Process Discovery

1

T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\9218a1200d8f72da\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Filesize
64KB

MD5
879e17ee6282834dab1e9c246b65e300

SHA1
4338fcf5532daa56ea66764c69f9352120800cf9

SHA256
d63ec0f08dbe1192ff95576b4500b46bdf00eac2431afd180bb001185b6e829f

SHA512
2c1509095a1ca742cc1ab5a5365dbe42976f0b78269010e76c54152755685729726a302ad65673c84901105ece7631ce60d25c1fcc84f06a9d30a4a0f1b24971

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\9218a1200d8f72da\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\9218a1200d8f72da\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Filesize
992B

MD5
8417cccd61ccfee149e2e370915049d6

SHA1
9a2879e33f7492b33616e3874ed140296bb188b4

SHA256
a4f187e4de83f16bc550064367ecb55f365524517054f88977a2b445e57e2538

SHA512
bb4eeb3abbaf915cbb406e93ad2cdbda69269021e9eedecfa83176f041cb501b6f907f71a90ec450e03fb568fc9822f3665a375564b6e964e6ec221e9880a425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
88dc70c361a22feac57b031dd9c1f02f

SHA1
a9b4732260c2a323750022a73480f229ce25d46d

SHA256
43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

SHA512
19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8d0d670a-7192-4617-99ef-f8e4e774b2e4.tmp.node
Filesize
1.4MB

MD5
56192831a7f808874207ba593f464415

SHA1
e0c18c72a62692d856da1f8988b0bc9c8088d2aa

SHA256
6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

SHA512
c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_coeuom2n.zww.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\de49ba45-7e54-4573-8494-ab58abf4a312.tmp.node
Filesize
151KB

MD5
bec0df3a37e6681b7eb29bd15904147a

SHA1
82a0869313ad7dcd86de3b5fa0e516d160c17013

SHA256
3d185f516d23d8c98a17e304b00b405b74dd7f3f6fb7d750bb7471deb1a9689f

SHA512
ae0639566f24e65a6a381862e020e39a32bec408b88eba60d3b01400c49535f09c6c67f424af406db78af2f197d79c3e262050ff5e17910c1ac1453561fffcd1

Download Submit
memory/5612-143-0x0000025C6BD60000-0x0000025C6BD61000-memory.dmp

Filesize
4KB

Download
memory/5612-148-0x0000025C6BD60000-0x0000025C6BD61000-memory.dmp

Filesize
4KB

Download
memory/5612-151-0x0000025C6BD60000-0x0000025C6BD61000-memory.dmp

Filesize
4KB

Download
memory/5612-150-0x0000025C6BD60000-0x0000025C6BD61000-memory.dmp

Filesize
4KB

Download
memory/5612-149-0x0000025C6BD60000-0x0000025C6BD61000-memory.dmp

Filesize
4KB

Download
memory/5612-147-0x0000025C6BD60000-0x0000025C6BD61000-memory.dmp

Filesize
4KB

Download
memory/5612-153-0x0000025C6BD60000-0x0000025C6BD61000-memory.dmp

Filesize
4KB

Download
memory/5612-152-0x0000025C6BD60000-0x0000025C6BD61000-memory.dmp

Filesize
4KB

Download
memory/5612-141-0x0000025C6BD60000-0x0000025C6BD61000-memory.dmp

Filesize
4KB

Download
memory/5612-142-0x0000025C6BD60000-0x0000025C6BD61000-memory.dmp

Filesize
4KB

Download
memory/10956-19-0x000002141A870000-0x000002141A892000-memory.dmp

Filesize
136KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads