Resubmissions
05-10-2022 11:39
221005-nsrtyaedfm 905-10-2022 08:12
221005-j3wtesdfg7 905-10-2022 06:56
221005-hqhwcsdeg8 9Analysis
-
max time kernel
108s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2022 06:56
Static task
static1
Behavioral task
behavioral1
Sample
830004.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
830004.exe
Resource
win10v2004-20220901-en
General
-
Target
830004.exe
-
Size
691KB
-
MD5
58aea2aac89947773dfae8e3859e20b0
-
SHA1
be17c41c65703f9475e36dff55fd3de220e395f3
-
SHA256
39b74b2fb057e8c78a2ba6639cf3d58ae91685e6ac13b57b70d2afb158cf742d
-
SHA512
f3d43c0759b05b949498cc63084b54b869c228a427f1590a1010007b4bdbebf760145a29e5f1a7c5585133ed76a3c1a5d7bf2ace46858ac9a48ff5c05eafa6eb
-
SSDEEP
12288:i0iads6yn93ySQDWYgeWYg955/155/m6q5iKn3zMCO342FoqdXS:dicFyn93ySQJ5f34Jo2Fi
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\830004.exe" reg.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
830004.exedescription ioc process File opened (read-only) \??\H: 830004.exe File opened (read-only) \??\I: 830004.exe File opened (read-only) \??\M: 830004.exe File opened (read-only) \??\X: 830004.exe File opened (read-only) \??\E: 830004.exe File opened (read-only) \??\G: 830004.exe File opened (read-only) \??\T: 830004.exe File opened (read-only) \??\N: 830004.exe File opened (read-only) \??\O: 830004.exe File opened (read-only) \??\J: 830004.exe File opened (read-only) \??\K: 830004.exe File opened (read-only) \??\L: 830004.exe File opened (read-only) \??\P: 830004.exe File opened (read-only) \??\Q: 830004.exe File opened (read-only) \??\R: 830004.exe File opened (read-only) \??\A: 830004.exe File opened (read-only) \??\B: 830004.exe File opened (read-only) \??\S: 830004.exe File opened (read-only) \??\V: 830004.exe File opened (read-only) \??\W: 830004.exe File opened (read-only) \??\Y: 830004.exe File opened (read-only) \??\Z: 830004.exe File opened (read-only) \??\F: 830004.exe File opened (read-only) \??\U: 830004.exe -
Drops file in Program Files directory 64 IoCs
Processes:
830004.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-200.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html.crypt 830004.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.crypt 830004.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-125_contrast-black.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.winmd.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteMedTile.scale-100.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\Shifter\Relicensing Statement.txt.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x.crypt 830004.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-250.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_achievements.targetsize-48.png.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\ECHO.INF.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-100.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-64_contrast-black.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.scale-100.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32_altform-lightunplated.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\SegXbox2Inline.ttf.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-250.png.crypt 830004.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.crypt 830004.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSYH.TTC.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-20_altform-unplated_contrast-black.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-80_altform-unplated.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-GB.Calendar.ot.crypt 830004.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-125.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-96_contrast-black.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-125.png.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.crypt 830004.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileWide.scale-100.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\people\rachelVaughan.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-200_contrast-white.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-16.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_altform-unplated_contrast-black.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\WideTile.scale-200.png.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\THMBNAIL.PNG.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_BadgeLogo.scale-200.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-200.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-400.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch-Dark.scale-125.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteLargeTile.scale-125.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.crypt 830004.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\REFINED.INF.crypt 830004.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_scale-125.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-180.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\OfflineError.svg.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-200_contrast-black.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-40.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\2876_24x24x32.png.crypt 830004.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\de-DE.PhoneNumber.model.crypt 830004.exe -
Delays execution with timeout.exe 56 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 4024 timeout.exe 4288 timeout.exe 1608 timeout.exe 3548 timeout.exe 4204 timeout.exe 3268 timeout.exe 4192 timeout.exe 5016 timeout.exe 1504 timeout.exe 2148 timeout.exe 3680 timeout.exe 3408 timeout.exe 4216 timeout.exe 4224 timeout.exe 4724 timeout.exe 2264 timeout.exe 4960 timeout.exe 1604 timeout.exe 1664 timeout.exe 4016 timeout.exe 3236 timeout.exe 4700 timeout.exe 224 timeout.exe 3588 timeout.exe 916 timeout.exe 4236 timeout.exe 3048 timeout.exe 3168 timeout.exe 760 timeout.exe 2944 timeout.exe 3040 timeout.exe 3368 timeout.exe 5064 timeout.exe 1840 timeout.exe 1452 timeout.exe 4252 timeout.exe 2880 timeout.exe 4288 timeout.exe 5112 timeout.exe 3016 timeout.exe 1852 timeout.exe 5024 timeout.exe 3104 timeout.exe 3544 timeout.exe 1788 timeout.exe 4516 timeout.exe 4324 timeout.exe 1272 timeout.exe 4132 timeout.exe 5104 timeout.exe 3064 timeout.exe 1476 timeout.exe 4736 timeout.exe 1124 timeout.exe 4628 timeout.exe 5092 timeout.exe -
Enumerates processes with tasklist 1 TTPs 57 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exepid process 2260 tasklist.exe 1784 tasklist.exe 684 tasklist.exe 4316 tasklist.exe 4640 tasklist.exe 3012 tasklist.exe 4268 tasklist.exe 4000 tasklist.exe 1712 tasklist.exe 2704 tasklist.exe 5024 tasklist.exe 4620 tasklist.exe 5084 tasklist.exe 3504 tasklist.exe 3692 tasklist.exe 2280 tasklist.exe 1416 tasklist.exe 4936 tasklist.exe 2876 tasklist.exe 3216 tasklist.exe 2024 tasklist.exe 1816 tasklist.exe 1372 tasklist.exe 4900 tasklist.exe 4316 tasklist.exe 2284 tasklist.exe 1480 tasklist.exe 2004 tasklist.exe 4032 tasklist.exe 1376 tasklist.exe 4264 tasklist.exe 2220 tasklist.exe 4128 tasklist.exe 4580 tasklist.exe 4816 tasklist.exe 1832 tasklist.exe 3140 tasklist.exe 1856 tasklist.exe 840 tasklist.exe 3816 tasklist.exe 4440 tasklist.exe 3268 tasklist.exe 4608 tasklist.exe 3156 tasklist.exe 1824 tasklist.exe 2004 tasklist.exe 3184 tasklist.exe 3252 tasklist.exe 224 tasklist.exe 1612 tasklist.exe 4504 tasklist.exe 2704 tasklist.exe 3180 tasklist.exe 4520 tasklist.exe 4244 tasklist.exe 2188 tasklist.exe 4480 tasklist.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 59 IoCs
Processes:
830004.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exedescription pid process Token: SeDebugPrivilege 4880 830004.exe Token: SeBackupPrivilege 4880 830004.exe Token: SeRestorePrivilege 4880 830004.exe Token: 35 4880 830004.exe Token: SeSecurityPrivilege 4880 830004.exe Token: SeManageVolumePrivilege 4880 830004.exe Token: 32 4880 830004.exe Token: SeTcbPrivilege 4880 830004.exe Token: SeSystemProfilePrivilege 4880 830004.exe Token: SeTakeOwnershipPrivilege 4880 830004.exe Token: SeDebugPrivilege 5084 tasklist.exe Token: SeDebugPrivilege 1372 tasklist.exe Token: SeDebugPrivilege 3816 tasklist.exe Token: SeDebugPrivilege 1480 tasklist.exe Token: SeDebugPrivilege 3504 tasklist.exe Token: SeDebugPrivilege 2704 tasklist.exe Token: SeDebugPrivilege 3180 tasklist.exe Token: SeDebugPrivilege 2004 tasklist.exe Token: SeDebugPrivilege 4900 tasklist.exe Token: SeDebugPrivilege 4264 tasklist.exe Token: SeDebugPrivilege 4316 tasklist.exe Token: SeDebugPrivilege 4936 tasklist.exe Token: SeDebugPrivilege 2876 tasklist.exe Token: SeDebugPrivilege 1612 tasklist.exe Token: SeDebugPrivilege 2220 tasklist.exe Token: SeDebugPrivilege 4440 tasklist.exe Token: SeDebugPrivilege 4244 tasklist.exe Token: SeDebugPrivilege 4504 tasklist.exe Token: SeDebugPrivilege 4128 tasklist.exe Token: SeDebugPrivilege 1824 tasklist.exe Token: SeDebugPrivilege 4640 tasklist.exe Token: SeDebugPrivilege 2704 tasklist.exe Token: SeDebugPrivilege 3140 tasklist.exe Token: SeDebugPrivilege 4580 tasklist.exe Token: SeDebugPrivilege 3692 tasklist.exe Token: SeDebugPrivilege 2004 tasklist.exe Token: SeDebugPrivilege 3216 tasklist.exe Token: SeDebugPrivilege 3184 tasklist.exe Token: SeDebugPrivilege 5024 tasklist.exe Token: SeDebugPrivilege 4032 tasklist.exe Token: SeDebugPrivilege 2188 tasklist.exe Token: SeDebugPrivilege 1832 tasklist.exe Token: SeDebugPrivilege 2024 tasklist.exe Token: SeDebugPrivilege 3252 tasklist.exe Token: SeDebugPrivilege 2260 tasklist.exe Token: SeDebugPrivilege 1816 tasklist.exe Token: SeDebugPrivilege 4816 tasklist.exe Token: SeDebugPrivilege 224 tasklist.exe Token: SeDebugPrivilege 1856 tasklist.exe Token: SeDebugPrivilege 4000 tasklist.exe Token: SeDebugPrivilege 3012 tasklist.exe Token: SeDebugPrivilege 840 tasklist.exe Token: SeDebugPrivilege 4520 tasklist.exe Token: SeDebugPrivilege 4620 tasklist.exe Token: SeDebugPrivilege 3268 tasklist.exe Token: SeDebugPrivilege 4268 tasklist.exe Token: SeDebugPrivilege 1784 tasklist.exe Token: SeDebugPrivilege 2280 tasklist.exe Token: SeDebugPrivilege 684 tasklist.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
830004.execmd.execmd.execmd.exenet.exedescription pid process target process PID 4880 wrote to memory of 3932 4880 830004.exe cmd.exe PID 4880 wrote to memory of 3932 4880 830004.exe cmd.exe PID 4880 wrote to memory of 2080 4880 830004.exe cmd.exe PID 4880 wrote to memory of 2080 4880 830004.exe cmd.exe PID 4880 wrote to memory of 696 4880 830004.exe cmd.exe PID 4880 wrote to memory of 696 4880 830004.exe cmd.exe PID 3932 wrote to memory of 1452 3932 cmd.exe net.exe PID 3932 wrote to memory of 1452 3932 cmd.exe net.exe PID 696 wrote to memory of 2108 696 cmd.exe reg.exe PID 696 wrote to memory of 2108 696 cmd.exe reg.exe PID 2080 wrote to memory of 5084 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 5084 2080 cmd.exe tasklist.exe PID 1452 wrote to memory of 1960 1452 net.exe net1.exe PID 1452 wrote to memory of 1960 1452 net.exe net1.exe PID 2080 wrote to memory of 5080 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 5080 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 2944 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 2944 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 1372 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 1372 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 2100 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 2100 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 3040 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 3040 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 3816 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 3816 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 4188 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 4188 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 4236 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 4236 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 1480 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 1480 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 4288 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 4288 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 4252 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 4252 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 3504 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 3504 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 4664 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 4664 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 1664 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 1664 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 2704 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 2704 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 1880 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 1880 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 3268 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 3268 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 3180 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 3180 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 3716 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 3716 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 4516 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 4516 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 2004 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 2004 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 2088 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 2088 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 4192 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 4192 2080 cmd.exe timeout.exe PID 2080 wrote to memory of 4900 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 4900 2080 cmd.exe tasklist.exe PID 2080 wrote to memory of 1376 2080 cmd.exe findstr.exe PID 2080 wrote to memory of 1376 2080 cmd.exe findstr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\830004.exe"C:\Users\Admin\AppData\Local\Temp\830004.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Settings\9t4T8k5j8.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\timeout.exeTIMEOUT /T 1 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\tasklist.exeTASKLIST3⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\findstr.exeFINDSTR /B /L /I /C:830004.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net config server /autodisconnect:-12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet config server /autodisconnect:-13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config server /autodisconnect:-14⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add hklm\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityUpdate /t REG_EXPAND_SZ /d C:\Users\Admin\AppData\Local\Temp\830004.exe /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add hklm\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityUpdate /t REG_EXPAND_SZ /d C:\Users\Admin\AppData\Local\Temp\830004.exe /f3⤵
- Adds Run key to start application
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Settings\9t4T8k5j8.batFilesize
163B
MD53578e838f655c9bd9426651cc13f6a84
SHA110b312cca508e1958507cd3f8a6feae72f6a3a3d
SHA25642f5a94a41364f4ab334ab6bf3638b1861d3a10b7684df6e5968567ca5027bde
SHA5124ccd6320fe0eb7dccd3b322ffbb94b9f718123dec2781f9f9404e3c520628f8f9d544b88189dda079a8f431cebdecc7a3cd94e37d21eb9257fdc65408465a995
-
memory/224-189-0x0000000000000000-mapping.dmp
-
memory/696-134-0x0000000000000000-mapping.dmp
-
memory/916-186-0x0000000000000000-mapping.dmp
-
memory/1152-170-0x0000000000000000-mapping.dmp
-
memory/1232-191-0x0000000000000000-mapping.dmp
-
memory/1372-185-0x0000000000000000-mapping.dmp
-
memory/1372-142-0x0000000000000000-mapping.dmp
-
memory/1376-164-0x0000000000000000-mapping.dmp
-
memory/1452-136-0x0000000000000000-mapping.dmp
-
memory/1480-148-0x0000000000000000-mapping.dmp
-
memory/1612-178-0x0000000000000000-mapping.dmp
-
memory/1664-153-0x0000000000000000-mapping.dmp
-
memory/1824-196-0x0000000000000000-mapping.dmp
-
memory/1832-173-0x0000000000000000-mapping.dmp
-
memory/1880-155-0x0000000000000000-mapping.dmp
-
memory/1960-139-0x0000000000000000-mapping.dmp
-
memory/2004-160-0x0000000000000000-mapping.dmp
-
memory/2080-133-0x0000000000000000-mapping.dmp
-
memory/2088-161-0x0000000000000000-mapping.dmp
-
memory/2100-143-0x0000000000000000-mapping.dmp
-
memory/2108-137-0x0000000000000000-mapping.dmp
-
memory/2148-183-0x0000000000000000-mapping.dmp
-
memory/2220-181-0x0000000000000000-mapping.dmp
-
memory/2264-174-0x0000000000000000-mapping.dmp
-
memory/2704-154-0x0000000000000000-mapping.dmp
-
memory/2876-175-0x0000000000000000-mapping.dmp
-
memory/2944-141-0x0000000000000000-mapping.dmp
-
memory/2972-182-0x0000000000000000-mapping.dmp
-
memory/3000-167-0x0000000000000000-mapping.dmp
-
memory/3016-195-0x0000000000000000-mapping.dmp
-
memory/3040-144-0x0000000000000000-mapping.dmp
-
memory/3048-180-0x0000000000000000-mapping.dmp
-
memory/3180-157-0x0000000000000000-mapping.dmp
-
memory/3236-188-0x0000000000000000-mapping.dmp
-
memory/3268-156-0x0000000000000000-mapping.dmp
-
memory/3368-177-0x0000000000000000-mapping.dmp
-
memory/3504-151-0x0000000000000000-mapping.dmp
-
memory/3652-179-0x0000000000000000-mapping.dmp
-
memory/3716-158-0x0000000000000000-mapping.dmp
-
memory/3816-145-0x0000000000000000-mapping.dmp
-
memory/3932-132-0x0000000000000000-mapping.dmp
-
memory/4024-171-0x0000000000000000-mapping.dmp
-
memory/4128-193-0x0000000000000000-mapping.dmp
-
memory/4188-146-0x0000000000000000-mapping.dmp
-
memory/4192-162-0x0000000000000000-mapping.dmp
-
memory/4236-147-0x0000000000000000-mapping.dmp
-
memory/4244-187-0x0000000000000000-mapping.dmp
-
memory/4252-150-0x0000000000000000-mapping.dmp
-
memory/4264-166-0x0000000000000000-mapping.dmp
-
memory/4288-149-0x0000000000000000-mapping.dmp
-
memory/4288-192-0x0000000000000000-mapping.dmp
-
memory/4316-169-0x0000000000000000-mapping.dmp
-
memory/4440-184-0x0000000000000000-mapping.dmp
-
memory/4484-176-0x0000000000000000-mapping.dmp
-
memory/4504-190-0x0000000000000000-mapping.dmp
-
memory/4516-159-0x0000000000000000-mapping.dmp
-
memory/4572-194-0x0000000000000000-mapping.dmp
-
memory/4664-152-0x0000000000000000-mapping.dmp
-
memory/4724-165-0x0000000000000000-mapping.dmp
-
memory/4900-163-0x0000000000000000-mapping.dmp
-
memory/4936-172-0x0000000000000000-mapping.dmp
-
memory/5024-168-0x0000000000000000-mapping.dmp
-
memory/5080-140-0x0000000000000000-mapping.dmp
-
memory/5084-138-0x0000000000000000-mapping.dmp