darkcomet | b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4

Analysis

max time kernel
189s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe
Size 1006KB
Sample221014-cd8y5abhf6
SHA256 b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4
MD5 6b631cb6e48a1fe1408d76318a93c4e0
SHA1 8e1b79d32274125aca3ba619daa29a8354b4cf3a
SHA512 b049a7de1754b11c50ae36d617ba95d12be6546b31d77ab587a509484931183376d516f89ee1b67e4e591f2d9fbc2dac361b6e0bda48cc960e0418afa9c43c7d
SSDEEP 24576:CaHM+6Corjmny5QLdEI71PhlVwLQwPwN/FHN:C1+qj55QLdd1JlVAQwQVN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet crypted persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

crypted

newrat122.no-ip.org:90

Mutex

DC_MUTEX-LRN55ZH

Attributes

gencode
YUZ8JL6ZqZ4B
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1676-196-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1676-197-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1676-198-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1676-199-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1676-200-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1676-201-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\218255 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\218255\\svhost.exe"	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4436 set thread context of 1676	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	333

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 60 IoCs

evasion

pid	Process
2316	taskkill.exe
2240	taskkill.exe
1612	taskkill.exe
712	taskkill.exe
1292	taskkill.exe
4512	taskkill.exe
4552	taskkill.exe
3840	taskkill.exe
4240	taskkill.exe
3116	taskkill.exe
4616	taskkill.exe
1328	taskkill.exe
712	taskkill.exe
1612	taskkill.exe
3096	taskkill.exe
3160	taskkill.exe
1852	taskkill.exe
3180	taskkill.exe
4624	taskkill.exe
1488	taskkill.exe
3412	taskkill.exe
4676	taskkill.exe
2244	taskkill.exe
632	taskkill.exe
3440	taskkill.exe
4184	taskkill.exe
4808	taskkill.exe
1372	taskkill.exe
4368	taskkill.exe
3368	taskkill.exe
1136	taskkill.exe
1508	taskkill.exe
4288	taskkill.exe
1612	taskkill.exe
4336	taskkill.exe
4796	taskkill.exe
4352	taskkill.exe
4688	taskkill.exe
704	taskkill.exe
2232	taskkill.exe
4768	taskkill.exe
4128	taskkill.exe
1964	taskkill.exe
3836	taskkill.exe
2852	taskkill.exe
3644	taskkill.exe
3212	taskkill.exe
404	taskkill.exe
4928	taskkill.exe
220	taskkill.exe
1192	taskkill.exe
1448	taskkill.exe
3208	taskkill.exe
1980	taskkill.exe
2676	taskkill.exe
816	taskkill.exe
1564	taskkill.exe
3380	taskkill.exe
4104	taskkill.exe
3776	taskkill.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	taskkill.exe
Token: SeDebugPrivilege	1328	taskkill.exe
Token: SeDebugPrivilege	712	taskkill.exe
Token: SeDebugPrivilege	3840	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	2676	taskkill.exe
Token: SeDebugPrivilege	816	taskkill.exe
Token: SeDebugPrivilege	4368	taskkill.exe
Token: SeDebugPrivilege	3836	taskkill.exe
Token: SeDebugPrivilege	4624	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	4808	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	1564	taskkill.exe
Token: SeDebugPrivilege	4676	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	2852	taskkill.exe
Token: SeDebugPrivilege	4796	taskkill.exe
Token: SeDebugPrivilege	4104	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	3096	taskkill.exe
Token: SeDebugPrivilege	3644	taskkill.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeDebugPrivilege	632	taskkill.exe
Token: SeDebugPrivilege	1488	taskkill.exe
Token: SeDebugPrivilege	3368	taskkill.exe
Token: SeDebugPrivilege	3160	taskkill.exe
Token: SeDebugPrivilege	4688	taskkill.exe
Token: SeDebugPrivilege	704	taskkill.exe
Token: SeDebugPrivilege	4240	taskkill.exe
Token: SeDebugPrivilege	3212	taskkill.exe
Token: SeDebugPrivilege	1852	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	404	taskkill.exe
Token: SeDebugPrivilege	4928	taskkill.exe
Token: SeDebugPrivilege	3180	taskkill.exe
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	1448	taskkill.exe
Token: SeDebugPrivilege	3412	taskkill.exe
Token: SeDebugPrivilege	1136	taskkill.exe
Token: SeDebugPrivilege	712	taskkill.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	3116	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	4288	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	4336	taskkill.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	220	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	1372	taskkill.exe
Token: SeDebugPrivilege	1508	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	1192	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1676	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe
Token: SeSecurityPrivilege	1676	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe
Token: SeTakeOwnershipPrivilege	1676	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe
Token: SeLoadDriverPrivilege	1676	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4528	OpenWith.exe
3340	OpenWith.exe
1676	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4712	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	79
PID 4436 wrote to memory of 4712	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	79
PID 4436 wrote to memory of 4712	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	79
PID 4436 wrote to memory of 4696	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	80
PID 4436 wrote to memory of 4696	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	80
PID 4436 wrote to memory of 4696	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	80
PID 4696 wrote to memory of 4616	4696	cmd.exe	82
PID 4696 wrote to memory of 4616	4696	cmd.exe	82
PID 4696 wrote to memory of 4616	4696	cmd.exe	82
PID 4436 wrote to memory of 4332	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	84
PID 4436 wrote to memory of 4332	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	84
PID 4436 wrote to memory of 4332	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	84
PID 4436 wrote to memory of 1084	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	85
PID 4436 wrote to memory of 1084	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	85
PID 4436 wrote to memory of 1084	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	85
PID 1084 wrote to memory of 1328	1084	cmd.exe	87
PID 1084 wrote to memory of 1328	1084	cmd.exe	87
PID 1084 wrote to memory of 1328	1084	cmd.exe	87
PID 4436 wrote to memory of 876	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	88
PID 4436 wrote to memory of 876	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	88
PID 4436 wrote to memory of 876	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	88
PID 4436 wrote to memory of 2148	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	89
PID 4436 wrote to memory of 2148	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	89
PID 4436 wrote to memory of 2148	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	89
PID 2148 wrote to memory of 712	2148	cmd.exe	91
PID 2148 wrote to memory of 712	2148	cmd.exe	91
PID 2148 wrote to memory of 712	2148	cmd.exe	91
PID 4436 wrote to memory of 544	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	92
PID 4436 wrote to memory of 544	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	92
PID 4436 wrote to memory of 544	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	92
PID 4436 wrote to memory of 3988	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	93
PID 4436 wrote to memory of 3988	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	93
PID 4436 wrote to memory of 3988	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	93
PID 3988 wrote to memory of 3840	3988	cmd.exe	95
PID 3988 wrote to memory of 3840	3988	cmd.exe	95
PID 3988 wrote to memory of 3840	3988	cmd.exe	95
PID 4436 wrote to memory of 3120	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	96
PID 4436 wrote to memory of 3120	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	96
PID 4436 wrote to memory of 3120	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	96
PID 4436 wrote to memory of 3216	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	97
PID 4436 wrote to memory of 3216	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	97
PID 4436 wrote to memory of 3216	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	97
PID 3216 wrote to memory of 1980	3216	cmd.exe	99
PID 3216 wrote to memory of 1980	3216	cmd.exe	99
PID 3216 wrote to memory of 1980	3216	cmd.exe	99
PID 4436 wrote to memory of 1104	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	100
PID 4436 wrote to memory of 1104	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	100
PID 4436 wrote to memory of 1104	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	100
PID 4436 wrote to memory of 2304	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	101
PID 4436 wrote to memory of 2304	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	101
PID 4436 wrote to memory of 2304	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	101
PID 2304 wrote to memory of 2676	2304	cmd.exe	103
PID 2304 wrote to memory of 2676	2304	cmd.exe	103
PID 2304 wrote to memory of 2676	2304	cmd.exe	103
PID 4436 wrote to memory of 1964	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	104
PID 4436 wrote to memory of 1964	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	104
PID 4436 wrote to memory of 1964	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	104
PID 4436 wrote to memory of 3648	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	105
PID 4436 wrote to memory of 3648	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	105
PID 4436 wrote to memory of 3648	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	105
PID 3648 wrote to memory of 816	3648	cmd.exe	107
PID 3648 wrote to memory of 816	3648	cmd.exe	107
PID 3648 wrote to memory of 816	3648	cmd.exe	107
PID 4436 wrote to memory of 4832	4436	b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe	108

C:\Users\Admin\AppData\Local\Temp\b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe
"C:\Users\Admin\AppData\Local\Temp\b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:712
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3840
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:816
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3836
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:1368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3096
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3644
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:2568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:632
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:1360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3368
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:704
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3668
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4824
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:5056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1136
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:2548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:712
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3116
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:1212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1312
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:1064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:1708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4128
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:1104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im calc.exe
  2⤵
  PID:2164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im calc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- C:\Users\Admin\AppData\Local\Temp\b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe
  "C:\Users\Admin\AppData\Local\Temp\b1f4984d0d3ea9795bcc6df1ed5fde93fe147e907a83c088c55ba06f35edc6b4.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-196-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/1676-197-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/1676-198-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/1676-199-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/1676-200-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/1676-201-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads