Analysis
-
max time kernel
155s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-06-2022 00:07
Static task
static1
Behavioral task
behavioral1
Sample
312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe
Resource
win10v2004-20220414-en
General
-
Target
312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe
-
Size
1.8MB
-
MD5
5b7184b825866b331b646b976e52165d
-
SHA1
e88407cfb398a23e65113fdaa763e924f0da3819
-
SHA256
312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b
-
SHA512
521f667d961b6a703a5230fe52165eb3866527f4542e75b81756fb003a309e60929983e24707e3b7a52ad8ff24edbb5414199d53ca48b59145da4e5b80155f29
Malware Config
Signatures
-
Luminosity 2 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
description ioc pid Process File opened for modification C:\Windows\assembly 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 3460 schtasks.exe -
Executes dropped EXE 2 IoCs
pid Process 2532 tsmgr.exe 32 notepad.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe -
Adds Run key to start application 2 TTPs 42 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe File opened for modification C:\Windows\assembly\Desktop.ini 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3280 set thread context of 32 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 91 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe File created C:\Windows\assembly\Desktop.ini 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe File opened for modification C:\Windows\assembly\Desktop.ini 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3460 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe 2532 tsmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe Token: SeDebugPrivilege 2532 tsmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2532 tsmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3280 wrote to memory of 2532 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 87 PID 3280 wrote to memory of 2532 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 87 PID 3280 wrote to memory of 2532 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 87 PID 3280 wrote to memory of 4836 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 88 PID 3280 wrote to memory of 4836 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 88 PID 3280 wrote to memory of 4836 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 88 PID 4836 wrote to memory of 1428 4836 cmd.exe 90 PID 4836 wrote to memory of 1428 4836 cmd.exe 90 PID 4836 wrote to memory of 1428 4836 cmd.exe 90 PID 3280 wrote to memory of 32 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 91 PID 3280 wrote to memory of 32 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 91 PID 3280 wrote to memory of 32 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 91 PID 3280 wrote to memory of 32 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 91 PID 3280 wrote to memory of 32 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 91 PID 3280 wrote to memory of 32 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 91 PID 3280 wrote to memory of 32 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 91 PID 3280 wrote to memory of 32 3280 312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe 91 PID 2532 wrote to memory of 4648 2532 tsmgr.exe 92 PID 2532 wrote to memory of 4648 2532 tsmgr.exe 92 PID 2532 wrote to memory of 4648 2532 tsmgr.exe 92 PID 2532 wrote to memory of 3460 2532 tsmgr.exe 95 PID 2532 wrote to memory of 3460 2532 tsmgr.exe 95 PID 2532 wrote to memory of 3460 2532 tsmgr.exe 95 PID 2532 wrote to memory of 560 2532 tsmgr.exe 97 PID 2532 wrote to memory of 560 2532 tsmgr.exe 97 PID 2532 wrote to memory of 560 2532 tsmgr.exe 97 PID 2532 wrote to memory of 880 2532 tsmgr.exe 99 PID 2532 wrote to memory of 880 2532 tsmgr.exe 99 PID 2532 wrote to memory of 880 2532 tsmgr.exe 99 PID 2532 wrote to memory of 2080 2532 tsmgr.exe 101 PID 2532 wrote to memory of 2080 2532 tsmgr.exe 101 PID 2532 wrote to memory of 2080 2532 tsmgr.exe 101 PID 2532 wrote to memory of 3620 2532 tsmgr.exe 103 PID 2532 wrote to memory of 3620 2532 tsmgr.exe 103 PID 2532 wrote to memory of 3620 2532 tsmgr.exe 103 PID 2532 wrote to memory of 4116 2532 tsmgr.exe 105 PID 2532 wrote to memory of 4116 2532 tsmgr.exe 105 PID 2532 wrote to memory of 4116 2532 tsmgr.exe 105 PID 2532 wrote to memory of 1464 2532 tsmgr.exe 107 PID 2532 wrote to memory of 1464 2532 tsmgr.exe 107 PID 2532 wrote to memory of 1464 2532 tsmgr.exe 107 PID 2532 wrote to memory of 3888 2532 tsmgr.exe 109 PID 2532 wrote to memory of 3888 2532 tsmgr.exe 109 PID 2532 wrote to memory of 3888 2532 tsmgr.exe 109 PID 2532 wrote to memory of 3048 2532 tsmgr.exe 111 PID 2532 wrote to memory of 3048 2532 tsmgr.exe 111 PID 2532 wrote to memory of 3048 2532 tsmgr.exe 111 PID 2532 wrote to memory of 2960 2532 tsmgr.exe 113 PID 2532 wrote to memory of 2960 2532 tsmgr.exe 113 PID 2532 wrote to memory of 2960 2532 tsmgr.exe 113 PID 2532 wrote to memory of 3448 2532 tsmgr.exe 115 PID 2532 wrote to memory of 3448 2532 tsmgr.exe 115 PID 2532 wrote to memory of 3448 2532 tsmgr.exe 115 PID 2532 wrote to memory of 4272 2532 tsmgr.exe 117 PID 2532 wrote to memory of 4272 2532 tsmgr.exe 117 PID 2532 wrote to memory of 4272 2532 tsmgr.exe 117 PID 2532 wrote to memory of 3144 2532 tsmgr.exe 119 PID 2532 wrote to memory of 3144 2532 tsmgr.exe 119 PID 2532 wrote to memory of 3144 2532 tsmgr.exe 119 PID 2532 wrote to memory of 3144 2532 tsmgr.exe 119 PID 2532 wrote to memory of 3144 2532 tsmgr.exe 119 PID 2532 wrote to memory of 3144 2532 tsmgr.exe 119 PID 2532 wrote to memory of 4080 2532 tsmgr.exe 121 PID 2532 wrote to memory of 4080 2532 tsmgr.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe"C:\Users\Admin\AppData\Local\Temp\312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b.exe"1⤵
- Luminosity
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\tsmgr.exe"C:\Users\Admin\AppData\Local\Temp\tsmgr.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:4648
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /NP /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f3⤵
- Luminosity
- Creates scheduled task(s)
PID:3460
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:560
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:880
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:2080
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:3620
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:4116
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:1464
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:3888
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:3048
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:2960
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:3448
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:4272
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:3144
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:4080
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:4320
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:4048
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:912
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:2436
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:216
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:4432
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
PID:1428
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\tsmgr.exe.lnk " /f3⤵PID:1428
-
-
-
C:\Users\Admin\AppData\Local\Temp\notepad.exe"C:\Users\Admin\AppData\Local\Temp\notepad.exe"2⤵
- Executes dropped EXE
PID:32
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD55b7184b825866b331b646b976e52165d
SHA1e88407cfb398a23e65113fdaa763e924f0da3819
SHA256312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b
SHA512521f667d961b6a703a5230fe52165eb3866527f4542e75b81756fb003a309e60929983e24707e3b7a52ad8ff24edbb5414199d53ca48b59145da4e5b80155f29
-
Filesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
Filesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
Filesize
857KB
MD5bc6529f2a93dd5eb328963e0b41a855a
SHA10d3fe448baa8a886fd33541f17e893a8a550640f
SHA256b98c711a375f39574672d49fdb798e70dab73b56c5a605c2cfd55a82d8d1b528
SHA5124b50bc0de71bdbdbe76622d498d70b940e11a5c34b6d58b43765eacb2447d3106da3ac80f3a20e7eed67598bf9875cda9646694724b8fae6d91a7ed97b0bad73
-
Filesize
857KB
MD5bc6529f2a93dd5eb328963e0b41a855a
SHA10d3fe448baa8a886fd33541f17e893a8a550640f
SHA256b98c711a375f39574672d49fdb798e70dab73b56c5a605c2cfd55a82d8d1b528
SHA5124b50bc0de71bdbdbe76622d498d70b940e11a5c34b6d58b43765eacb2447d3106da3ac80f3a20e7eed67598bf9875cda9646694724b8fae6d91a7ed97b0bad73