428280c60495d98bb323401c877783e641d21f649684fbacbb29bc8067bf6635

Analysis

max time kernel
145s
max time network
146s
platform
windows10_x64
resource
win10v20210408
submitted
07-05-2021 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64.exe
Size

1.6MB
MD5

2510bc30669edc05f9aeb06f5c92bed2
SHA1

3ac2a1e223d74323c18c9d4788ec3195c382dc64
SHA256

428280c60495d98bb323401c877783e641d21f649684fbacbb29bc8067bf6635
SHA512

9140358e8b8587b415ef65f0f13005920cf98ea3e98bf984aded7e1a10408b9a7f8bb4bde22de5e698f6ec3bf9d32abca849194e0b1c9daa8cb08961d03bddfb

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 9 IoCs

Processes:

dxdiag.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

pid process

4080 dxdiag.exe
1236 svchost.exe
2900 svchost.exe
2224 svchost.exe
2696 svchost.exe
1176 svchost.exe
3180 svchost.exe
2644 svchost.exe
3164 svchost.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
4080	dxdiag.exe
1236	svchost.exe
2900	svchost.exe
2224	svchost.exe
2696	svchost.exe
1176	svchost.exe
3180	svchost.exe
2644	svchost.exe
3164	svchost.exe

Drops file in Windows directory 39 IoCs

Processes:

64.exedxdiag.exe

description	ioc	process
File created	C:\Windows\Fonts\Ms\mance.xml	64.exe
File created	C:\Windows\Fonts\Ms\NansHou.dll	64.exe
File created	C:\Windows\Fonts\Ms\tibe-2.dll	64.exe
File created	C:\Windows\Fonts\Ms\trfo-2.dll	64.exe
File created	C:\Windows\svchost.exe	dxdiag.exe
File created	C:\Windows\Fonts\Ms\any.bat	64.exe
File created	C:\Windows\Fonts\Ms\neibu.bat	64.exe
File created	C:\Windows\Fonts\Ms\svchost.exe	64.exe
File created	C:\Windows\Fonts\Ms\wget.exe	64.exe
File created	C:\Windows\Fonts\Ms\cnli-1.dll	64.exe
File created	C:\Windows\Fonts\Ms\tich-1.dll	64.exe
File created	C:\Windows\Fonts\Ms\taskhost.exe	64.exe
File created	C:\Windows\Fonts\Ms\tucl-1.dll	64.exe
File created	C:\Windows\Fonts\Ms\xdvl-0.dll	64.exe
File created	C:\Windows\Fonts\Ms\Doubl.dll	64.exe
File created	C:\Windows\Fonts\Ms\puls.exe	64.exe
File created	C:\Windows\Fonts\Ms\Eter.dll	64.exe
File created	C:\Windows\Fonts\Ms\libeay32.dll	64.exe
File created	C:\Windows\Fonts\Ms\crli-0.dll	64.exe
File created	C:\Windows\Fonts\Ms\exma-1.dll	64.exe
File created	C:\Windows\Fonts\Ms\ssleay32.dll	64.exe
File created	C:\Windows\Fonts\Ms\Eter.xml	64.exe
File created	C:\Windows\Fonts\Ms\puls.xml	64.exe
File created	C:\Windows\Fonts\Ms\p.txt	64.exe
File created	C:\Windows\Fonts\Ms\Eter.exe	64.exe
File created	C:\Windows\Fonts\Ms\coli-0.dll	64.exe
File created	C:\Windows\Fonts\Ms\tufo-2.dll	64.exe
File created	C:\Windows\Fonts\Ms\ucl.dll	64.exe
File created	C:\Windows\Help\dxdiag.exe	64.exe
File created	C:\Windows\Fonts\Ms\lb.bat	64.exe
File created	C:\Windows\Fonts\Ms\ld.bat	64.exe
File created	C:\Windows\Fonts\Ms\dmgd-4.dll	64.exe
File created	C:\Windows\Fonts\Ms\libxml2.dll	64.exe
File created	C:\Windows\Fonts\Ms\posh-0.dll	64.exe
File created	C:\Windows\Fonts\Ms\cm.bat	64.exe
File created	C:\Windows\Fonts\Ms\mance.exe	64.exe
File created	C:\Windows\Fonts\Ms\trch-1.dll	64.exe
File created	C:\Windows\Fonts\Ms\zlib1.dll	64.exe
File opened for modification	C:\Windows\svchost.exe	dxdiag.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1484 schtasks.exe
2884 schtasks.exe

pid	process
1484	schtasks.exe
2884	schtasks.exe

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2712	taskkill.exe
3284	taskkill.exe
2724	taskkill.exe
928	taskkill.exe
2116	taskkill.exe
3948	taskkill.exe
4000	taskkill.exe
408	taskkill.exe
3168	taskkill.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

764 PING.EXE

pid	process
764	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

svchost.exe

pid	process
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	928	taskkill.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	3284	taskkill.exe
Token: SeDebugPrivilege	3948	taskkill.exe
Token: SeDebugPrivilege	4000	taskkill.exe
Token: SeDebugPrivilege	408	taskkill.exe
Token: SeDebugPrivilege	3168	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dxdiag.exesvchost.exe

pid process

4080 dxdiag.exe
2224 svchost.exe

pid	process
4080	dxdiag.exe
2224	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

64.execmd.exesvchost.exenet.exenet.exe

description	pid	process	target process
PID 900 wrote to memory of 4080	900	64.exe	dxdiag.exe
PID 900 wrote to memory of 4080	900	64.exe	dxdiag.exe
PID 900 wrote to memory of 4080	900	64.exe	dxdiag.exe
PID 900 wrote to memory of 412	900	64.exe	cmd.exe
PID 900 wrote to memory of 412	900	64.exe	cmd.exe
PID 900 wrote to memory of 412	900	64.exe	cmd.exe
PID 412 wrote to memory of 1236	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 1236	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 1236	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 2900	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 2900	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 2900	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 928	412	cmd.exe	sc.exe
PID 412 wrote to memory of 928	412	cmd.exe	sc.exe
PID 412 wrote to memory of 928	412	cmd.exe	sc.exe
PID 412 wrote to memory of 2696	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 2696	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 2696	412	cmd.exe	svchost.exe
PID 1176 wrote to memory of 2080	1176	svchost.exe	cmd.exe
PID 1176 wrote to memory of 2080	1176	svchost.exe	cmd.exe
PID 1176 wrote to memory of 2080	1176	svchost.exe	cmd.exe
PID 412 wrote to memory of 1460	412	cmd.exe	net.exe
PID 412 wrote to memory of 1460	412	cmd.exe	net.exe
PID 412 wrote to memory of 1460	412	cmd.exe	net.exe
PID 1460 wrote to memory of 3872	1460	net.exe	net1.exe
PID 1460 wrote to memory of 3872	1460	net.exe	net1.exe
PID 1460 wrote to memory of 3872	1460	net.exe	net1.exe
PID 412 wrote to memory of 2336	412	cmd.exe	net.exe
PID 412 wrote to memory of 2336	412	cmd.exe	net.exe
PID 412 wrote to memory of 2336	412	cmd.exe	net.exe
PID 2336 wrote to memory of 3968	2336	net.exe	net1.exe
PID 2336 wrote to memory of 3968	2336	net.exe	net1.exe
PID 2336 wrote to memory of 3968	2336	net.exe	net1.exe
PID 412 wrote to memory of 3180	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 3180	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 3180	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 2644	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 2644	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 2644	412	cmd.exe	svchost.exe
PID 412 wrote to memory of 3148	412	cmd.exe	sc.exe
PID 412 wrote to memory of 3148	412	cmd.exe	sc.exe
PID 412 wrote to memory of 3148	412	cmd.exe	sc.exe
PID 412 wrote to memory of 764	412	cmd.exe	PING.EXE
PID 412 wrote to memory of 764	412	cmd.exe	PING.EXE
PID 412 wrote to memory of 764	412	cmd.exe	PING.EXE
PID 1176 wrote to memory of 2304	1176	svchost.exe	cmd.exe
PID 1176 wrote to memory of 2304	1176	svchost.exe	cmd.exe
PID 1176 wrote to memory of 2304	1176	svchost.exe	cmd.exe
PID 412 wrote to memory of 2200	412	cmd.exe	cmd.exe
PID 412 wrote to memory of 2200	412	cmd.exe	cmd.exe
PID 412 wrote to memory of 2200	412	cmd.exe	cmd.exe
PID 412 wrote to memory of 1484	412	cmd.exe	schtasks.exe
PID 412 wrote to memory of 1484	412	cmd.exe	schtasks.exe
PID 412 wrote to memory of 1484	412	cmd.exe	schtasks.exe
PID 412 wrote to memory of 2708	412	cmd.exe	attrib.exe
PID 412 wrote to memory of 2708	412	cmd.exe	attrib.exe
PID 412 wrote to memory of 2708	412	cmd.exe	attrib.exe
PID 412 wrote to memory of 1328	412	cmd.exe	attrib.exe
PID 412 wrote to memory of 1328	412	cmd.exe	attrib.exe
PID 412 wrote to memory of 1328	412	cmd.exe	attrib.exe
PID 412 wrote to memory of 2884	412	cmd.exe	cmd.exe
PID 412 wrote to memory of 2884	412	cmd.exe	cmd.exe
PID 412 wrote to memory of 2884	412	cmd.exe	cmd.exe
PID 412 wrote to memory of 712	412	cmd.exe	cacls.exe

Views/modifies file attributes 1 TTPs 6 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

2708 attrib.exe
1328 attrib.exe
3284 attrib.exe
964 attrib.exe
900 attrib.exe
764 attrib.exe

pid	process
2708	attrib.exe
1328	attrib.exe
3284	attrib.exe
964	attrib.exe
900	attrib.exe
764	attrib.exe

C:\Users\Admin\AppData\Local\Temp\64.exe
"C:\Users\Admin\AppData\Local\Temp\64.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\Help\dxdiag.exe
"C:\Windows\Help\dxdiag.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\Ms\any.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\Fonts\Ms\svchost.exe
svchost install MSSQLD "C:\Windows\Fonts\Ms\cm.bat"
3⤵
- Executes dropped EXE
PID:1236

C:\Windows\Fonts\Ms\svchost.exe
svchost install "MSSQLD" C:\Windows\Fonts\Ms\cm.bat
3⤵
- Executes dropped EXE
PID:2900

C:\Windows\SysWOW64\sc.exe
sc config "MSSQLD" start= AUTO
3⤵
PID:928

C:\Windows\Fonts\Ms\svchost.exe
svchost start "MSSQLD"
3⤵
- Executes dropped EXE
PID:2696

C:\Windows\SysWOW64\net.exe
net start "MSSQLD"
3⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start "MSSQLD"
4⤵
PID:3872

C:\Windows\SysWOW64\net.exe
net stop "MicrosoftMsql"
3⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MicrosoftMsql"
4⤵
PID:3968

C:\Windows\Fonts\Ms\svchost.exe
svchost stop "MicrosoftMsql"
3⤵
- Executes dropped EXE
PID:3180

C:\Windows\Fonts\Ms\svchost.exe
svchost remove "MicrosoftMsql" confirm
3⤵
- Executes dropped EXE
PID:2644

C:\Windows\SysWOW64\sc.exe
sc delete "MicrosoftMsql"
3⤵
PID:3148

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
3⤵
- Runs ping.exe
PID:764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:2200

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /TN "At8" /TR "C:\Windows\Fonts\Ms\neibu.bat" /SC daily /ST 10:40:00 /RU SYSTEM
3⤵
- Creates scheduled task(s)
PID:1484

C:\Windows\SysWOW64\attrib.exe
attrib -h -s -r C:\windows\tasks\At*.job
3⤵
- Views/modifies file attributes
PID:2708

C:\Windows\SysWOW64\attrib.exe
attrib -h -s -r C:\Windows\System32\Tasks\At*
3⤵
- Views/modifies file attributes
PID:1328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:2884

C:\Windows\SysWOW64\cacls.exe
cacls C:\windows\tasks\At6.job /c /e /t /g system:F
3⤵
PID:712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:2140

C:\Windows\SysWOW64\cacls.exe
cacls C:\windows\tasks\At6.job /c /e /t /g everyone:F
3⤵
PID:4024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:3700

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\System32\Tasks\At6 /c /e /t /g system:F
3⤵
PID:892

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:800

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\System32\Tasks\At* /c /e /t /g everyone:F
3⤵
PID:688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:4000

C:\Windows\SysWOW64\cacls.exe
cacls C:\windows\tasks\At6.job /c /e /t /g system:F
3⤵
PID:3968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:3788

C:\Windows\SysWOW64\cacls.exe
cacls C:\windows\tasks\At6.job /c /e /t /g everyone:F
3⤵
PID:408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:716

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\System32\Tasks\At6 /c /e /t /g system:F
3⤵
PID:1376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:2624

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\System32\Tasks\At6 /c /e /t /g everyone:F
3⤵
PID:3268

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:188

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\System32\Tasks /c /e /t /g system:F
3⤵
PID:3192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:636

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\System32\Tasks /c /e /t /g everyone:F
3⤵
PID:2200

C:\Windows\SysWOW64\net.exe
net start schedule
3⤵
PID:3604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule
4⤵
PID:3232

C:\Windows\SysWOW64\sc.exe
sc start schedule
3⤵
PID:1568

C:\Windows\Fonts\Ms\svchost.exe
svchost start schedule
3⤵
- Executes dropped EXE
PID:3164

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:2236

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /TN "At8" /TR "C:\Windows\Fonts\Ms\neibu.bat" /SC daily /ST 10:40:00 /RU SYSTEM
3⤵
- Creates scheduled task(s)
PID:2884

C:\Windows\SysWOW64\attrib.exe
attrib -r C:\windows\tasks\At*.job
3⤵
- Views/modifies file attributes
PID:3284

C:\Windows\SysWOW64\attrib.exe
attrib -r C:\Windows\System32\Tasks\At*
3⤵
- Views/modifies file attributes
PID:964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:4024

C:\Windows\SysWOW64\cacls.exe
cacls C:\windows\tasks\At8.job /c /e /t /g system:F
3⤵
PID:3476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:4048

C:\Windows\SysWOW64\cacls.exe
cacls C:\windows\tasks\At8.job /c /e /t /g everyone:F
3⤵
PID:4008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:3568

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\System32\Tasks\At8 /c /e /t /g system:F
3⤵
PID:3180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:3964

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\System32\Tasks\At8 /c /e /t /g everyone:F
3⤵
PID:3168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:3976

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Fonts\Msql\*.* /c /e /t /g everyone:F
3⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:3036

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Fonts\Msql\*.* /c /e /t /g system:F
3⤵
PID:1236

C:\Windows\SysWOW64\attrib.exe
attrib -h -s -r C:\Windows\Fonts\Msql\*.*
3⤵
- Views/modifies file attributes
PID:900

C:\Windows\SysWOW64\attrib.exe
attrib -h -s -r C:\Windows\Fonts\Msql
3⤵
- Views/modifies file attributes
PID:764

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ss.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 32.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im c32.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im c64.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 64.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im service.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ll.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ql.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskmgr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2224

C:\Windows\Fonts\Ms\svchost.exe
C:\Windows\Fonts\Ms\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\Ms\cm.bat" "
2⤵
PID:2080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\Ms\cm.bat" "
2⤵
PID:2304

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\Ms\cm.bat" "
2⤵
PID:188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\Ms\cm.bat" "
2⤵
PID:636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\Ms\cm.bat" "
2⤵
PID:2696

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\Ms\cm.bat" "
2⤵
PID:3940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\Ms\cm.bat" "
2⤵
PID:3948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Hidden Files and Directories

T1158

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Fonts\Ms\any.bat
MD5
f3ce82845d4d64d0083bef0bbcabe64b

SHA1
15161c5ddfeecf09c85150af69e9bcb346896194

SHA256
a34508f4fd08a101c6e6fa66eeb73f911c2de4232c9efe6c0034c91ac3e891c9

SHA512
7109a3e522c2c62aaf81ec78857c6a90628b296643bf78f54522af02dfaa7fe64e0b746d2d08b35b8af5d0277edac628c4a6f462e6f102750f10ae2a47bad7c2

Download Submit
C:\Windows\Fonts\Ms\svchost.exe
MD5
7afcf45907f225e3e3cfeece3bbcd410

SHA1
9747e4c11bcf0393e1d1a2ac4b7c43af590da0bc

SHA256
c5a346bd16c246db669605c70a547204313c0fa2325332a3d8427a4449e5b40e

SHA512
ce091728b83bc4edb57dfbbeec4ce0de0220de82965ae3b2d6f71ce822be60a81c28ef7c605a8411c1113ee23513e06670029ec3b7af09ab0682b0358064c44f

Download Submit
C:\Windows\Fonts\Ms\svchost.exe
MD5
7afcf45907f225e3e3cfeece3bbcd410

SHA1
9747e4c11bcf0393e1d1a2ac4b7c43af590da0bc

SHA256
c5a346bd16c246db669605c70a547204313c0fa2325332a3d8427a4449e5b40e

SHA512
ce091728b83bc4edb57dfbbeec4ce0de0220de82965ae3b2d6f71ce822be60a81c28ef7c605a8411c1113ee23513e06670029ec3b7af09ab0682b0358064c44f

Download Submit
C:\Windows\Fonts\Ms\svchost.exe
MD5
7afcf45907f225e3e3cfeece3bbcd410

SHA1
9747e4c11bcf0393e1d1a2ac4b7c43af590da0bc

SHA256
c5a346bd16c246db669605c70a547204313c0fa2325332a3d8427a4449e5b40e

SHA512
ce091728b83bc4edb57dfbbeec4ce0de0220de82965ae3b2d6f71ce822be60a81c28ef7c605a8411c1113ee23513e06670029ec3b7af09ab0682b0358064c44f

Download Submit
C:\Windows\Fonts\Ms\svchost.exe
MD5
7afcf45907f225e3e3cfeece3bbcd410

SHA1
9747e4c11bcf0393e1d1a2ac4b7c43af590da0bc

SHA256
c5a346bd16c246db669605c70a547204313c0fa2325332a3d8427a4449e5b40e

SHA512
ce091728b83bc4edb57dfbbeec4ce0de0220de82965ae3b2d6f71ce822be60a81c28ef7c605a8411c1113ee23513e06670029ec3b7af09ab0682b0358064c44f

Download Submit
C:\Windows\Fonts\Ms\svchost.exe
MD5
7afcf45907f225e3e3cfeece3bbcd410

SHA1
9747e4c11bcf0393e1d1a2ac4b7c43af590da0bc

SHA256
c5a346bd16c246db669605c70a547204313c0fa2325332a3d8427a4449e5b40e

SHA512
ce091728b83bc4edb57dfbbeec4ce0de0220de82965ae3b2d6f71ce822be60a81c28ef7c605a8411c1113ee23513e06670029ec3b7af09ab0682b0358064c44f

Download Submit
C:\Windows\Fonts\Ms\svchost.exe
MD5
7afcf45907f225e3e3cfeece3bbcd410

SHA1
9747e4c11bcf0393e1d1a2ac4b7c43af590da0bc

SHA256
c5a346bd16c246db669605c70a547204313c0fa2325332a3d8427a4449e5b40e

SHA512
ce091728b83bc4edb57dfbbeec4ce0de0220de82965ae3b2d6f71ce822be60a81c28ef7c605a8411c1113ee23513e06670029ec3b7af09ab0682b0358064c44f

Download Submit
C:\Windows\Fonts\Ms\svchost.exe
MD5
7afcf45907f225e3e3cfeece3bbcd410

SHA1
9747e4c11bcf0393e1d1a2ac4b7c43af590da0bc

SHA256
c5a346bd16c246db669605c70a547204313c0fa2325332a3d8427a4449e5b40e

SHA512
ce091728b83bc4edb57dfbbeec4ce0de0220de82965ae3b2d6f71ce822be60a81c28ef7c605a8411c1113ee23513e06670029ec3b7af09ab0682b0358064c44f

Download Submit
C:\Windows\Fonts\Ms\svchost.exe
MD5
7afcf45907f225e3e3cfeece3bbcd410

SHA1
9747e4c11bcf0393e1d1a2ac4b7c43af590da0bc

SHA256
c5a346bd16c246db669605c70a547204313c0fa2325332a3d8427a4449e5b40e

SHA512
ce091728b83bc4edb57dfbbeec4ce0de0220de82965ae3b2d6f71ce822be60a81c28ef7c605a8411c1113ee23513e06670029ec3b7af09ab0682b0358064c44f

Download Submit
C:\Windows\Help\dxdiag.exe
MD5
3f16cd0ddc89cee34e2a17516d3cdaf7

SHA1
95980b35711abe98275faa6ecd6ca40f4ca41ead

SHA256
309b9f57044afd1c8b0e0381da3e54cdd3f45aafd924bfbff2fd1d5aa0166e48

SHA512
45b4e193b77f818c2f418e2b4dafb86c107dc6f9ec9f07eca9b44c7370bd234dbc3547cc8ea1f022d0b46f3dcf6b155836c8a60fbf342fbfbd423cda9a404f6b

Download Submit
C:\Windows\Help\dxdiag.exe
MD5
3f16cd0ddc89cee34e2a17516d3cdaf7

SHA1
95980b35711abe98275faa6ecd6ca40f4ca41ead

SHA256
309b9f57044afd1c8b0e0381da3e54cdd3f45aafd924bfbff2fd1d5aa0166e48

SHA512
45b4e193b77f818c2f418e2b4dafb86c107dc6f9ec9f07eca9b44c7370bd234dbc3547cc8ea1f022d0b46f3dcf6b155836c8a60fbf342fbfbd423cda9a404f6b

Download Submit
C:\Windows\svchost.exe
MD5
3f16cd0ddc89cee34e2a17516d3cdaf7

SHA1
95980b35711abe98275faa6ecd6ca40f4ca41ead

SHA256
309b9f57044afd1c8b0e0381da3e54cdd3f45aafd924bfbff2fd1d5aa0166e48

SHA512
45b4e193b77f818c2f418e2b4dafb86c107dc6f9ec9f07eca9b44c7370bd234dbc3547cc8ea1f022d0b46f3dcf6b155836c8a60fbf342fbfbd423cda9a404f6b

Download Submit
C:\Windows\svchost.exe
MD5
3f16cd0ddc89cee34e2a17516d3cdaf7

SHA1
95980b35711abe98275faa6ecd6ca40f4ca41ead

SHA256
309b9f57044afd1c8b0e0381da3e54cdd3f45aafd924bfbff2fd1d5aa0166e48

SHA512
45b4e193b77f818c2f418e2b4dafb86c107dc6f9ec9f07eca9b44c7370bd234dbc3547cc8ea1f022d0b46f3dcf6b155836c8a60fbf342fbfbd423cda9a404f6b

Download Submit
memory/188-166-0x0000000000000000-mapping.dmp

Download
memory/408-161-0x0000000000000000-mapping.dmp

Download
memory/412-117-0x0000000000000000-mapping.dmp

Download
memory/636-168-0x0000000000000000-mapping.dmp

Download
memory/688-157-0x0000000000000000-mapping.dmp

Download
memory/712-151-0x0000000000000000-mapping.dmp

Download
memory/716-162-0x0000000000000000-mapping.dmp

Download
memory/764-192-0x0000000000000000-mapping.dmp

Download
memory/764-144-0x0000000000000000-mapping.dmp

Download
memory/800-156-0x0000000000000000-mapping.dmp

Download
memory/892-155-0x0000000000000000-mapping.dmp

Download
memory/900-191-0x0000000000000000-mapping.dmp

Download
memory/928-126-0x0000000000000000-mapping.dmp

Download
memory/928-193-0x0000000000000000-mapping.dmp

Download
memory/964-178-0x0000000000000000-mapping.dmp

Download
memory/1236-190-0x0000000000000000-mapping.dmp

Download
memory/1236-119-0x0000000000000000-mapping.dmp

Download
memory/1328-149-0x0000000000000000-mapping.dmp

Download
memory/1376-163-0x0000000000000000-mapping.dmp

Download
memory/1460-135-0x0000000000000000-mapping.dmp

Download
memory/1484-147-0x0000000000000000-mapping.dmp

Download
memory/1568-172-0x0000000000000000-mapping.dmp

Download
memory/2080-134-0x0000000000000000-mapping.dmp

Download
memory/2112-188-0x0000000000000000-mapping.dmp

Download
memory/2116-194-0x0000000000000000-mapping.dmp

Download
memory/2140-152-0x0000000000000000-mapping.dmp

Download
memory/2200-146-0x0000000000000000-mapping.dmp

Download
memory/2200-169-0x0000000000000000-mapping.dmp

Download
memory/2236-175-0x0000000000000000-mapping.dmp

Download
memory/2304-145-0x0000000000000000-mapping.dmp

Download
memory/2336-137-0x0000000000000000-mapping.dmp

Download
memory/2624-164-0x0000000000000000-mapping.dmp

Download
memory/2644-141-0x0000000000000000-mapping.dmp

Download
memory/2696-129-0x0000000000000000-mapping.dmp

Download
memory/2708-148-0x0000000000000000-mapping.dmp

Download
memory/2884-176-0x0000000000000000-mapping.dmp

Download
memory/2884-150-0x0000000000000000-mapping.dmp

Download
memory/2900-122-0x0000000000000000-mapping.dmp

Download
memory/3036-189-0x0000000000000000-mapping.dmp

Download
memory/3148-143-0x0000000000000000-mapping.dmp

Download
memory/3164-173-0x0000000000000000-mapping.dmp

Download
memory/3168-186-0x0000000000000000-mapping.dmp

Download
memory/3180-139-0x0000000000000000-mapping.dmp

Download
memory/3180-184-0x0000000000000000-mapping.dmp

Download
memory/3192-167-0x0000000000000000-mapping.dmp

Download
memory/3232-171-0x0000000000000000-mapping.dmp

Download
memory/3268-165-0x0000000000000000-mapping.dmp

Download
memory/3284-177-0x0000000000000000-mapping.dmp

Download
memory/3476-180-0x0000000000000000-mapping.dmp

Download
memory/3568-183-0x0000000000000000-mapping.dmp

Download
memory/3604-170-0x0000000000000000-mapping.dmp

Download
memory/3700-154-0x0000000000000000-mapping.dmp

Download
memory/3788-160-0x0000000000000000-mapping.dmp

Download
memory/3872-136-0x0000000000000000-mapping.dmp

Download
memory/3964-185-0x0000000000000000-mapping.dmp

Download
memory/3968-138-0x0000000000000000-mapping.dmp

Download
memory/3968-159-0x0000000000000000-mapping.dmp

Download
memory/3976-187-0x0000000000000000-mapping.dmp

Download
memory/4000-158-0x0000000000000000-mapping.dmp

Download
memory/4008-182-0x0000000000000000-mapping.dmp

Download
memory/4024-153-0x0000000000000000-mapping.dmp

Download
memory/4024-179-0x0000000000000000-mapping.dmp

Download
memory/4048-181-0x0000000000000000-mapping.dmp

Download
memory/4080-124-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/4080-114-0x0000000000000000-mapping.dmp

Download