Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 13:21
General
-
Target
Update on Stamp Duty Charges on Paga.pdf.scr
-
Size
474KB
-
MD5
931d6095b12f270ab926dd037d3b8430
-
SHA1
ae8832bcefff293fd6d4c29d00362e3ed5a2202c
-
SHA256
65603c7a88beb93205d2012ca8d63dba310fc0f7f91fc81300734ee3b2eb3f10
-
SHA512
c69971083b4fbbb7b3c8098f1fdc7edc8b66642d04ac0f2fe795eae4f1a5cd0dac08658e2814ee2a31e3b3472f4def59056c1142d4d63eece3ad7368e8aa67d2
Score
10/10
Malware Config
Extracted
Family
nanocore
Version
1.2.2.0
C2
grace532.sytes.net:1919
Mutex
02171e57-d8c6-4512-9969-2622471b4b14
Attributes
-
activate_away_mode
true
-
backup_connection_host
grace532.sytes.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-10T08:21:11.593844436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1919
-
default_group
New House New Grace
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
02171e57-d8c6-4512-9969-2622471b4b14
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
grace532.sytes.net
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious behavior: MapViewOfSection 37 IoCs
-
Suspicious behavior: EnumeratesProcesses 14520 IoCs
-
Drops startup file 2 IoCs
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Drops file in Program Files directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 218 IoCs
-
Suspicious use of SetThreadContext 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Adds Run entry to start application 2 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
- Adds Run entry to start application
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF279.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF364.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S2⤵
- Suspicious behavior: MapViewOfSection
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S18⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S19⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S20⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S21⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S22⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S23⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S24⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S25⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S26⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
-
C:\Users\Admin\AppData\Local\Temp\tmpF279.tmp
-
C:\Users\Admin\AppData\Local\Temp\tmpF364.tmp
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe
-
memory/424-13-0x0000000000000000-mapping.dmp
-
memory/808-26-0x0000000000000000-mapping.dmp
-
memory/816-67-0x000000000041E792-mapping.dmp
-
memory/900-64-0x000000000041E792-mapping.dmp
-
memory/900-43-0x000000000041E792-mapping.dmp
-
memory/996-79-0x000000000041E792-mapping.dmp
-
memory/1008-38-0x0000000000000000-mapping.dmp
-
memory/1120-62-0x0000000000000000-mapping.dmp
-
memory/1176-58-0x000000000041E792-mapping.dmp
-
memory/1260-59-0x0000000000000000-mapping.dmp
-
memory/1260-35-0x0000000000000000-mapping.dmp
-
memory/1276-22-0x000000000041E792-mapping.dmp
-
memory/1336-82-0x000000000041E792-mapping.dmp
-
memory/1516-23-0x0000000000000000-mapping.dmp
-
memory/1620-25-0x000000000041E792-mapping.dmp
-
memory/1648-44-0x0000000000000000-mapping.dmp
-
memory/1700-9-0x0000000000000000-mapping.dmp
-
memory/1700-68-0x0000000000000000-mapping.dmp
-
memory/1820-37-0x000000000041E792-mapping.dmp
-
memory/1820-56-0x0000000000000000-mapping.dmp
-
memory/1904-1-0x000000000041E792-mapping.dmp
-
memory/1904-0-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1920-74-0x0000000000000000-mapping.dmp
-
memory/1960-34-0x000000000041E792-mapping.dmp
-
memory/2088-2-0x0000000000000000-mapping.dmp
-
memory/2092-17-0x0000000000000000-mapping.dmp
-
memory/2096-49-0x000000000041E792-mapping.dmp
-
memory/2232-28-0x000000000041E792-mapping.dmp
-
memory/2256-31-0x000000000041E792-mapping.dmp
-
memory/2276-65-0x0000000000000000-mapping.dmp
-
memory/2424-70-0x000000000041E792-mapping.dmp
-
memory/2500-80-0x0000000000000000-mapping.dmp
-
memory/2504-5-0x0000000000000000-mapping.dmp
-
memory/2624-32-0x0000000000000000-mapping.dmp
-
memory/2652-19-0x000000000041E792-mapping.dmp
-
memory/2756-47-0x0000000000000000-mapping.dmp
-
memory/2756-73-0x000000000041E792-mapping.dmp
-
memory/2944-71-0x0000000000000000-mapping.dmp
-
memory/3032-50-0x0000000000000000-mapping.dmp
-
memory/3064-41-0x0000000000000000-mapping.dmp
-
memory/3096-46-0x000000000041E792-mapping.dmp
-
memory/3168-12-0x000000000041E792-mapping.dmp
-
memory/3188-77-0x0000000000000000-mapping.dmp
-
memory/3208-55-0x000000000041E792-mapping.dmp
-
memory/3680-20-0x0000000000000000-mapping.dmp
-
memory/3736-61-0x000000000041E792-mapping.dmp
-
memory/3736-40-0x000000000041E792-mapping.dmp
-
memory/3760-53-0x0000000000000000-mapping.dmp
-
memory/3764-52-0x000000000041E792-mapping.dmp
-
memory/3788-3-0x0000000000000000-mapping.dmp
-
memory/3788-76-0x000000000041E792-mapping.dmp
-
memory/3832-8-0x000000000041E792-mapping.dmp
-
memory/4016-29-0x0000000000000000-mapping.dmp
-
memory/4028-15-0x000000000041E792-mapping.dmp