Analysis
-
max time kernel
153s -
max time network
165s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:22
Static task
static1
Behavioral task
behavioral1
Sample
09637f910840cebb2f1e2524414c8d62.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
09637f910840cebb2f1e2524414c8d62.exe
Resource
win10v2004-en-20220113
General
-
Target
09637f910840cebb2f1e2524414c8d62.exe
-
Size
5.9MB
-
MD5
09637f910840cebb2f1e2524414c8d62
-
SHA1
f31516f4e0008dd5dea7f85722488a9db7007e43
-
SHA256
58484d3924b8c496a925660742b55da793ec4048765edf87c3116e5fb34ebeae
-
SHA512
9498b20333ca822c88358aa773475bd7604b2e1905417d078014ed41b084e2ab28a1ce197bc4e74aa49b3f2659d051cf803fd98ce9115442654c20b96c837a2c
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
09637f910840cebb2f1e2524414c8d62.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts 09637f910840cebb2f1e2524414c8d62.exe -
Modifies Windows Firewall 1 TTPs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
09637f910840cebb2f1e2524414c8d62.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\wscntfy = "C:\\Windows\\wscntfy.exe" 09637f910840cebb2f1e2524414c8d62.exe -
Drops file in Windows directory 1 IoCs
Processes:
attrib.exedescription ioc process File opened for modification C:\Windows\wscntfy.exe attrib.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1044 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 704 powershell.exe 1632 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
cmd.exepid process 776 cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exewhoami.exepowershell.exewhoami.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 704 powershell.exe Token: SeDebugPrivilege 1000 whoami.exe Token: SeDebugPrivilege 1632 powershell.exe Token: SeDebugPrivilege 1060 whoami.exe Token: SeIncreaseQuotaPrivilege 1776 WMIC.exe Token: SeSecurityPrivilege 1776 WMIC.exe Token: SeTakeOwnershipPrivilege 1776 WMIC.exe Token: SeLoadDriverPrivilege 1776 WMIC.exe Token: SeSystemProfilePrivilege 1776 WMIC.exe Token: SeSystemtimePrivilege 1776 WMIC.exe Token: SeProfSingleProcessPrivilege 1776 WMIC.exe Token: SeIncBasePriorityPrivilege 1776 WMIC.exe Token: SeCreatePagefilePrivilege 1776 WMIC.exe Token: SeBackupPrivilege 1776 WMIC.exe Token: SeRestorePrivilege 1776 WMIC.exe Token: SeShutdownPrivilege 1776 WMIC.exe Token: SeDebugPrivilege 1776 WMIC.exe Token: SeSystemEnvironmentPrivilege 1776 WMIC.exe Token: SeRemoteShutdownPrivilege 1776 WMIC.exe Token: SeUndockPrivilege 1776 WMIC.exe Token: SeManageVolumePrivilege 1776 WMIC.exe Token: 33 1776 WMIC.exe Token: 34 1776 WMIC.exe Token: 35 1776 WMIC.exe Token: SeIncreaseQuotaPrivilege 1776 WMIC.exe Token: SeSecurityPrivilege 1776 WMIC.exe Token: SeTakeOwnershipPrivilege 1776 WMIC.exe Token: SeLoadDriverPrivilege 1776 WMIC.exe Token: SeSystemProfilePrivilege 1776 WMIC.exe Token: SeSystemtimePrivilege 1776 WMIC.exe Token: SeProfSingleProcessPrivilege 1776 WMIC.exe Token: SeIncBasePriorityPrivilege 1776 WMIC.exe Token: SeCreatePagefilePrivilege 1776 WMIC.exe Token: SeBackupPrivilege 1776 WMIC.exe Token: SeRestorePrivilege 1776 WMIC.exe Token: SeShutdownPrivilege 1776 WMIC.exe Token: SeDebugPrivilege 1776 WMIC.exe Token: SeSystemEnvironmentPrivilege 1776 WMIC.exe Token: SeRemoteShutdownPrivilege 1776 WMIC.exe Token: SeUndockPrivilege 1776 WMIC.exe Token: SeManageVolumePrivilege 1776 WMIC.exe Token: 33 1776 WMIC.exe Token: 34 1776 WMIC.exe Token: 35 1776 WMIC.exe Token: SeIncreaseQuotaPrivilege 1224 WMIC.exe Token: SeSecurityPrivilege 1224 WMIC.exe Token: SeTakeOwnershipPrivilege 1224 WMIC.exe Token: SeLoadDriverPrivilege 1224 WMIC.exe Token: SeSystemProfilePrivilege 1224 WMIC.exe Token: SeSystemtimePrivilege 1224 WMIC.exe Token: SeProfSingleProcessPrivilege 1224 WMIC.exe Token: SeIncBasePriorityPrivilege 1224 WMIC.exe Token: SeCreatePagefilePrivilege 1224 WMIC.exe Token: SeBackupPrivilege 1224 WMIC.exe Token: SeRestorePrivilege 1224 WMIC.exe Token: SeShutdownPrivilege 1224 WMIC.exe Token: SeDebugPrivilege 1224 WMIC.exe Token: SeSystemEnvironmentPrivilege 1224 WMIC.exe Token: SeRemoteShutdownPrivilege 1224 WMIC.exe Token: SeUndockPrivilege 1224 WMIC.exe Token: SeManageVolumePrivilege 1224 WMIC.exe Token: 33 1224 WMIC.exe Token: 34 1224 WMIC.exe Token: 35 1224 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
09637f910840cebb2f1e2524414c8d62.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1896 wrote to memory of 568 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 568 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 568 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 776 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 776 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 776 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 568 wrote to memory of 704 568 cmd.exe powershell.exe PID 568 wrote to memory of 704 568 cmd.exe powershell.exe PID 568 wrote to memory of 704 568 cmd.exe powershell.exe PID 1896 wrote to memory of 1360 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1360 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1360 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1360 wrote to memory of 824 1360 cmd.exe netsh.exe PID 1360 wrote to memory of 824 1360 cmd.exe netsh.exe PID 1360 wrote to memory of 824 1360 cmd.exe netsh.exe PID 1896 wrote to memory of 632 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 632 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 632 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 428 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 428 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 428 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 632 wrote to memory of 1044 632 cmd.exe ipconfig.exe PID 632 wrote to memory of 1044 632 cmd.exe ipconfig.exe PID 632 wrote to memory of 1044 632 cmd.exe ipconfig.exe PID 428 wrote to memory of 1280 428 cmd.exe reg.exe PID 428 wrote to memory of 1280 428 cmd.exe reg.exe PID 428 wrote to memory of 1280 428 cmd.exe reg.exe PID 1896 wrote to memory of 1616 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1616 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1616 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1500 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1500 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1500 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1492 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1492 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1492 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1500 wrote to memory of 1632 1500 cmd.exe powershell.exe PID 1500 wrote to memory of 1632 1500 cmd.exe powershell.exe PID 1500 wrote to memory of 1632 1500 cmd.exe powershell.exe PID 1616 wrote to memory of 1152 1616 cmd.exe attrib.exe PID 1616 wrote to memory of 1152 1616 cmd.exe attrib.exe PID 1616 wrote to memory of 1152 1616 cmd.exe attrib.exe PID 1492 wrote to memory of 1000 1492 cmd.exe whoami.exe PID 1492 wrote to memory of 1000 1492 cmd.exe whoami.exe PID 1492 wrote to memory of 1000 1492 cmd.exe whoami.exe PID 1896 wrote to memory of 1720 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1720 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 1720 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1720 wrote to memory of 1060 1720 cmd.exe whoami.exe PID 1720 wrote to memory of 1060 1720 cmd.exe whoami.exe PID 1720 wrote to memory of 1060 1720 cmd.exe whoami.exe PID 1896 wrote to memory of 892 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 892 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 892 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 892 wrote to memory of 1776 892 cmd.exe WMIC.exe PID 892 wrote to memory of 1776 892 cmd.exe WMIC.exe PID 892 wrote to memory of 1776 892 cmd.exe WMIC.exe PID 1896 wrote to memory of 684 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 684 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 1896 wrote to memory of 684 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe PID 684 wrote to memory of 1224 684 cmd.exe WMIC.exe PID 684 wrote to memory of 1224 684 cmd.exe WMIC.exe PID 684 wrote to memory of 1224 684 cmd.exe WMIC.exe PID 1896 wrote to memory of 1964 1896 09637f910840cebb2f1e2524414c8d62.exe cmd.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09637f910840cebb2f1e2524414c8d62.exe"C:\Users\Admin\AppData\Local\Temp\09637f910840cebb2f1e2524414c8d62.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\system32\cmd.execmd /C "powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:704 -
C:\Windows\system32\cmd.execmd /Q /C move /Y C:\Users\Admin\AppData\Local\Temp\09637f910840cebb2f1e2524414c8d62.exe C:\Windows\wscntfy.exe2⤵
- Suspicious behavior: RenamesItself
PID:776 -
C:\Windows\system32\cmd.execmd /C "netsh advfirewall firewall add rule name=\"wscntfy\" dir=in action=allow program=\"C:\Users\Admin\AppData\Local\Temp\09637f910840cebb2f1e2524414c8d62.exe\" enable=yes"2⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=\"wscntfy\" dir=in action=allow program=\"C:\Users\Admin\AppData\Local\Temp\09637f910840cebb2f1e2524414c8d62.exe\" enable=yes3⤵PID:824
-
C:\Windows\system32\cmd.execmd /C "ipconfig //flushdns"2⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\system32\ipconfig.exeipconfig //flushdns3⤵
- Gathers network information
PID:1044 -
C:\Windows\system32\cmd.execmd /Q /C reg add "HKCU\Software\Mystic Entertainment" /f2⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\system32\reg.exereg add "HKCU\Software\Mystic Entertainment" /f3⤵PID:1280
-
C:\Windows\system32\cmd.execmd /C "powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft"2⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632 -
C:\Windows\system32\cmd.execmd /C "attrib +S +H C:\Windows\wscntfy.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\attrib.exeattrib +S +H C:\Windows\wscntfy.exe3⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1152 -
C:\Windows\system32\cmd.execmd /C whoami2⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1000 -
C:\Windows\system32\cmd.execmd /C whoami2⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1060 -
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776 -
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224 -
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1964
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1956
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1948
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1848
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1000
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1680
-
C:\Windows\system32\whoami.exewhoami3⤵PID:552
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2028
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1784
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1996
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:904
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1132
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1840
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:768
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1884
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:704
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1708
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:452
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1960
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:532
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1948
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1492
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:756
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1760
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1720
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1128
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1776
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1736
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:904
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1712
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1840
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1004
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:768
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1708
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1284
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1212
-
C:\Windows\system32\whoami.exewhoami3⤵PID:824
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:428
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1940
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1000
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1848
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1088
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1760
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1776
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1728
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1248
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1192
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:636
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1952
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:872
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1084
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1564
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1552
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:836
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1836
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1948
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1940
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1848
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1060
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:868
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1532
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1684
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1180
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1216
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1320
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:636
-
C:\Windows\system32\whoami.exewhoami3⤵PID:460
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1916
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1424
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1564
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1212
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1552
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:568
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1956
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1544
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1972
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1760
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1404
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:900
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1696
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1352
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1932
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1952
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:540
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1764
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:776
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:824
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1364
-
C:\Windows\system32\whoami.exewhoami3⤵PID:576
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1424
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1708
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1212
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:816
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:568
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1636
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:756
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1200
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1404
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1728
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1996
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1532
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1932
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1768
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:540
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:684
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1700
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1664
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1584
-
C:\Windows\system32\whoami.exewhoami3⤵PID:576
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:268
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1984
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:632
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1500
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1048
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:964
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:2028
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:108
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1128
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1720
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1480
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1696
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1852
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1920
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:540
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1376
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1172
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:824
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:460
-
C:\Windows\system32\whoami.exewhoami3⤵PID:872
-
C:\Windows\system32\cmd.execmd /C whoami2⤵PID:1084
-
C:\Windows\system32\whoami.exewhoami3⤵PID:1284
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1520
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:816
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1780
-
C:\Windows\system32\cmd.execmd /C ver2⤵PID:1940
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:756
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
7ed82fb4c4ccc2f1754735a420d6a695
SHA1a8164f1f58eeedb8df82f26789d5550b4294e286
SHA2569654a4359e8cbc8cdabb2d6136acae5c9fc5c20bdb119491c53ad02893e582af
SHA512edd54b6266659ee4e96dd5a260e88274663550f3d848bd513158626433f23802792060550b7c92cc1724e35a01c7d3503d20ef40e701d2255c4ad4b06c2f56aa
-
memory/704-61-0x000000001B730000-0x000000001BA2F000-memory.dmpFilesize
3.0MB
-
memory/704-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmpFilesize
8KB
-
memory/704-58-0x00000000023C2000-0x00000000023C4000-memory.dmpFilesize
8KB
-
memory/704-59-0x00000000023C4000-0x00000000023C7000-memory.dmpFilesize
12KB
-
memory/704-55-0x000007FEF36B0000-0x000007FEF420D000-memory.dmpFilesize
11.4MB
-
memory/704-56-0x000007FEF5DDE000-0x000007FEF5DDF000-memory.dmpFilesize
4KB
-
memory/704-57-0x00000000023C0000-0x00000000023C2000-memory.dmpFilesize
8KB
-
memory/704-71-0x00000000023CB000-0x00000000023EA000-memory.dmpFilesize
124KB
-
memory/1632-66-0x0000000002030000-0x0000000002032000-memory.dmpFilesize
8KB
-
memory/1632-67-0x0000000002032000-0x0000000002034000-memory.dmpFilesize
8KB
-
memory/1632-68-0x0000000002034000-0x0000000002037000-memory.dmpFilesize
12KB
-
memory/1632-64-0x000007FEF36B0000-0x000007FEF420D000-memory.dmpFilesize
11.4MB
-
memory/1632-69-0x000000001B760000-0x000000001BA5F000-memory.dmpFilesize
3.0MB
-
memory/1632-65-0x000007FEF5DDE000-0x000007FEF5DDF000-memory.dmpFilesize
4KB
-
memory/1632-70-0x000000000203B000-0x000000000205A000-memory.dmpFilesize
124KB