Analysis
-
max time kernel
169s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 01:49
Static task
static1
Behavioral task
behavioral1
Sample
4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b.exe
Resource
win10v2004-20220812-en
General
-
Target
4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b.exe
-
Size
1.1MB
-
MD5
6d614c1cc6113efb12d0d7eb0147db64
-
SHA1
6e2ec4f4e73a358849c9b147428dbdb609d043f1
-
SHA256
4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b
-
SHA512
78158ab786852d597a084a5f55401ae087468ae02ae077d56593c68eb4f0464b2573ba1347c9c0cd7a58409194232d2eb12a446b72e53ff569251668d25de007
-
SSDEEP
24576:Itb20pkaCqT5TBWgNQ7aGSbRNn0eeiN/P+U7F16A:RVg5tQ7aGocen+U35
Malware Config
Extracted
njrat
0.7d
u0lf4ÓßgÒiNBMìNñõÛÃáÍÚÒæÉâgþ
193.0.200.131:35689
abde6d91c02e072e675204de91168fab
-
reg_key
abde6d91c02e072e675204de91168fab
-
splitter
|'|'|
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exeucsvc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\temp\\WINDOWS\\TEMPARCHIVE\\taskeng.exe" ucsvc.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
taskeng.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" taskeng.exe -
Blocks application from running via registry modification 64 IoCs
Adds application to list of disallowed applications.
Processes:
RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\zLz = "mscolsrv.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\gTo = "sp2update.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\gYp = "ç.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\n7Q = "dmupdate.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\XZF = "icmntr.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\p2q = "ntvdm.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\wDj = "SmileySource.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\wUA = "soundtask.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\86V = "ftviewer.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\f9r = "spoolasrv.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\DMc = "PrivacyCrusaderDemo.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\yqT = "card.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\BWO = "WindowsKernelUpdat.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3ag = "conhost32.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\qr1 = "ccarss.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\aDj = "WliveUPdate.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\Fer = "sistray.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\Us9 = "lsasrv.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\Atw = "powerscan.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\43j = "Zonealarmupdate.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1Ub = "davcsync.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\hVg = "pr1nc.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8aq = "GiveMeToo.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\kCK = "rlvknlg.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\Ihz = "bios1.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\ifS = "grplscd.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\DLw = "RegistryCare.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\49h = "svhos.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\r0C = "KeyLogger.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\u91 = "nvctrl.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\O7y = "winregsrv.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5qS = "10aba34-5619.tmp" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\way = "$sys$DRMServer.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\PVN = "Facebook_Updater.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\hXA = "SpyFighter.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13b = "zonealarm.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\bVu = "emsn.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\Gmo = "muniu.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\MjI = "cgtask.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\m5V = "miroupdate.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\59u = "QuickUpdate.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15j = "mediaacck.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\eLP = "svcchosts.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5lC = "wificon.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0tD = "RazeSpyware.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4XY = "TrustCleaner.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\Fi6 = "fontfix.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5cW = "sysprinter.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\wRN = "win-logon.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\m7Z = "wndupdate.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\v1i = "a.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\UqT = "spywareremovalwizard.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\Vip = "dxupdate.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\hQO = "lsasrv.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4NX = "srv.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\UtP = "ProcAlert.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\wHI = "wnetmgr.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\oSg = "flashget.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\mqY = "cnfrm.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\fTL = "divx.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\elt = "winspsrv.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\aUC = "NLSupervisorPro.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\jEq = "wfdmgr.exe" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe -
Drops file in Drivers directory 13 IoCs
Processes:
attrib.exeattrib.exeRZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\networks attrib.exe File opened for modification C:\Windows\System32\drivers\etc attrib.exe File opened for modification C:\Windows\system32\drivers\etc\hosts RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe File opened for modification C:\Windows\System32\drivers\etc attrib.exe File opened for modification C:\Windows\System32\drivers\etc\networks attrib.exe File opened for modification C:\Windows\System32\drivers\etc\protocol attrib.exe File opened for modification C:\Windows\System32\drivers\etc\services attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\lmhosts.sam attrib.exe File opened for modification C:\Windows\System32\drivers\etc\protocol attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\lmhosts.sam attrib.exe File opened for modification C:\Windows\System32\drivers\etc\services attrib.exe -
Executes dropped EXE 5 IoCs
Processes:
RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exetaskeng.exeucsvc.exewksprt.exewksprt.exepid process 1700 RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe 4764 taskeng.exe 2056 ucsvc.exe 2032 wksprt.exe 4564 wksprt.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets file to hidden 1 TTPs 16 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 1392 attrib.exe 4848 attrib.exe 3304 attrib.exe 4952 attrib.exe 4456 attrib.exe 344 attrib.exe 4220 attrib.exe 112 attrib.exe 4184 attrib.exe 3696 attrib.exe 4060 attrib.exe 3732 attrib.exe 2876 attrib.exe 3464 attrib.exe 3588 attrib.exe 4376 attrib.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exeucsvc.exetaskeng.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ucsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation taskeng.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
ucsvc.exeRZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*Boot Service Utility = "C:\\Users\\Admin\\AppData\\Local\\temp\\WINDOWS\\TEMPARCHIVE\\ucsvc.exe" ucsvc.exe Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exedescription ioc process File created C:\Windows\assembly\Desktop.ini RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe File opened for modification C:\Windows\assembly\Desktop.ini RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wksprt.exedescription pid process target process PID 2032 set thread context of 4564 2032 wksprt.exe wksprt.exe -
Drops file in Windows directory 3 IoCs
Processes:
RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exedescription ioc process File opened for modification C:\Windows\assembly RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe File created C:\Windows\assembly\Desktop.ini RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe File opened for modification C:\Windows\assembly\Desktop.ini RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exeucsvc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Download\DisallowRun = "1" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" ucsvc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskeng.exepid process 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe 4764 taskeng.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
taskeng.exeucsvc.exewksprt.exewksprt.exedescription pid process Token: SeDebugPrivilege 4764 taskeng.exe Token: SeDebugPrivilege 2056 ucsvc.exe Token: SeDebugPrivilege 2032 wksprt.exe Token: SeDebugPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe Token: 33 4564 wksprt.exe Token: SeIncBasePriorityPrivilege 4564 wksprt.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b.exetaskeng.execmd.exeRZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.execmd.exeucsvc.exewksprt.exewksprt.exedescription pid process target process PID 4560 wrote to memory of 1700 4560 4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b.exe RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe PID 4560 wrote to memory of 1700 4560 4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b.exe RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe PID 4560 wrote to memory of 4764 4560 4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b.exe taskeng.exe PID 4560 wrote to memory of 4764 4560 4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b.exe taskeng.exe PID 4764 wrote to memory of 2056 4764 taskeng.exe ucsvc.exe PID 4764 wrote to memory of 2056 4764 taskeng.exe ucsvc.exe PID 4764 wrote to memory of 4232 4764 taskeng.exe cmd.exe PID 4764 wrote to memory of 4232 4764 taskeng.exe cmd.exe PID 4232 wrote to memory of 1392 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 1392 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 4220 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 4220 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 112 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 112 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 4848 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 4848 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 3732 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 3732 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 4184 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 4184 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 2876 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 2876 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 3696 4232 cmd.exe attrib.exe PID 4232 wrote to memory of 3696 4232 cmd.exe attrib.exe PID 1700 wrote to memory of 4840 1700 RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe cmd.exe PID 1700 wrote to memory of 4840 1700 RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe cmd.exe PID 4840 wrote to memory of 1852 4840 cmd.exe cacls.exe PID 4840 wrote to memory of 1852 4840 cmd.exe cacls.exe PID 4840 wrote to memory of 4484 4840 cmd.exe cacls.exe PID 4840 wrote to memory of 4484 4840 cmd.exe cacls.exe PID 4840 wrote to memory of 364 4840 cmd.exe cacls.exe PID 4840 wrote to memory of 364 4840 cmd.exe cacls.exe PID 4840 wrote to memory of 3304 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 3304 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 3464 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 3464 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 3588 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 3588 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 4376 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 4376 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 4952 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 4952 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 4060 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 4060 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 4456 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 4456 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 344 4840 cmd.exe attrib.exe PID 4840 wrote to memory of 344 4840 cmd.exe attrib.exe PID 2056 wrote to memory of 2032 2056 ucsvc.exe wksprt.exe PID 2056 wrote to memory of 2032 2056 ucsvc.exe wksprt.exe PID 2056 wrote to memory of 2032 2056 ucsvc.exe wksprt.exe PID 2032 wrote to memory of 4564 2032 wksprt.exe wksprt.exe PID 2032 wrote to memory of 4564 2032 wksprt.exe wksprt.exe PID 2032 wrote to memory of 4564 2032 wksprt.exe wksprt.exe PID 2032 wrote to memory of 4564 2032 wksprt.exe wksprt.exe PID 2032 wrote to memory of 4564 2032 wksprt.exe wksprt.exe PID 2032 wrote to memory of 4564 2032 wksprt.exe wksprt.exe PID 2032 wrote to memory of 4564 2032 wksprt.exe wksprt.exe PID 2032 wrote to memory of 4564 2032 wksprt.exe wksprt.exe PID 4564 wrote to memory of 5024 4564 wksprt.exe netsh.exe PID 4564 wrote to memory of 5024 4564 wksprt.exe netsh.exe PID 4564 wrote to memory of 5024 4564 wksprt.exe netsh.exe -
Views/modifies file attributes 1 TTPs 16 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 1392 attrib.exe 4848 attrib.exe 3588 attrib.exe 4060 attrib.exe 4456 attrib.exe 4220 attrib.exe 112 attrib.exe 3304 attrib.exe 4952 attrib.exe 2876 attrib.exe 3696 attrib.exe 3464 attrib.exe 4376 attrib.exe 344 attrib.exe 3732 attrib.exe 4184 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b.exe"C:\Users\Admin\AppData\Local\Temp\4c91884307199fbadb8aa41ce6d6bdef10e0d185737f75c79dbe28e62267c37b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE\RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exeC:\Users\Admin\AppData\Local\Temp/WINDOWS/TEMPARCHIVE/RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exe2⤵
- Modifies WinLogon for persistence
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IyQoe.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cacls.execacls C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE /E /P everyone:n4⤵
-
C:\Windows\system32\cacls.execacls C:\Users\Admin\AppData\Local\Temp\WINDOWS /E /P everyone:n4⤵
-
C:\Windows\system32\cacls.execacls C:\Users\Admin\AppData\Local\Temp\WorkspaceRuntime /E /P everyone:n4⤵
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Windows\System32\drivers\etc\*.*"4⤵
- Drops file in Drivers directory
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Windows\System32\drivers\etc"4⤵
- Drops file in Drivers directory
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE\*.*"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WINDOWS\*.*"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WINDOWS"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WorkspaceRuntime\*.*"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WorkspaceRuntime"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE\taskeng.exeC:\Users\Admin\AppData\Local\Temp/WINDOWS/TEMPARCHIVE/taskeng.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\temp\WINDOWS\TEMPARCHIVE\ucsvc.exe"C:\Users\Admin\AppData\Local\temp\WINDOWS\TEMPARCHIVE\ucsvc.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\temp\WorkspaceRuntime\wksprt.exe"C:\Users\Admin\AppData\Local\temp\WorkspaceRuntime\wksprt.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\temp\WorkspaceRuntime\wksprt.exeC:\Users\Admin\AppData\Local\temp\WorkspaceRuntime\wksprt.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\temp\WorkspaceRuntime\wksprt.exe" "wksprt.exe" ENABLE6⤵
- Modifies Windows Firewall
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\v.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Windows\System32\drivers\etc\*.*"4⤵
- Drops file in Drivers directory
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Windows\System32\drivers\etc"4⤵
- Drops file in Drivers directory
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE\*.*"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WINDOWS\*.*"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WINDOWS"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WorkspaceRuntime\*.*"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +a +h +s +r "C:\Users\Admin\AppData\Local\Temp\WorkspaceRuntime"4⤵
- Sets file to hidden
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IyQoe.batFilesize
522B
MD5254160d9b9287bff589b6246f99d8eec
SHA1876310cdd302898f5c8f4041037f18bacf07bcbe
SHA25616e99344bda2b1338204f4e89c3c6b6a8efbb168a76ed624cba9f4d1ad3fd9a4
SHA512002d0415387e60b9ef11a6e95787f03ec34c571676d7e5cafd54b6352855ca24e9099d1faa970a5cabdaa1f26620676cbb56e028cfdc54045119e0535a70444a
-
C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE\Cb8eU.vbsFilesize
3KB
MD5428fb44c6dd833202070f1f71a74bd39
SHA12126a9eba6097861dad42e836ecf5e90cc5b2fcf
SHA25656ea1c1fb691c818a569a5ce7b2f8ccc7ba529bb52d7dbed2fddbab82aaab176
SHA512bae170e2c83d397240b21832c7d7fe8c083dbb76357cc73e1f02194e2bd39b8dba68b46232d0221a6e61392d54ee550188b5ff58b2dfb1de3a41e52d10a5761e
-
C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE\RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exeFilesize
113KB
MD5bbca72e3a3096b322289adf9226411f7
SHA15a9395d35f73c261082486836bdfb4af6e4a7c06
SHA256c09b77187f6c4dd2be355c3d96b89a6d2fc49646b3b067ef5748e2eadbf7206b
SHA512f32b734432a40d7f4a24e47e6e7a21fc09b4dbb4a784ac8f015c7edea77f4b728c00fb62b102682001c7ced4f55c6fe943208f88c0471217ee82ea82ef1603a5
-
C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE\RZ29oRt44C0mES2NOh4LHX7rjK2hRIIkVPjz.exeFilesize
113KB
MD5bbca72e3a3096b322289adf9226411f7
SHA15a9395d35f73c261082486836bdfb4af6e4a7c06
SHA256c09b77187f6c4dd2be355c3d96b89a6d2fc49646b3b067ef5748e2eadbf7206b
SHA512f32b734432a40d7f4a24e47e6e7a21fc09b4dbb4a784ac8f015c7edea77f4b728c00fb62b102682001c7ced4f55c6fe943208f88c0471217ee82ea82ef1603a5
-
C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE\taskeng.exeFilesize
29KB
MD552944262c2ba7f1b50a054c0c1f9a88d
SHA1c6f9d258438f247c0d14ad9f60e0b01347bcbfcc
SHA2564fc8a9aff00714d712171dd65a9c42382c6a02cd3f55e98a7e469b0a46d657c9
SHA512880a98312a8f80c37b10baf61a97e04226ed1f007093f61b18daab61a9ed42f0a3f1af3ed1bb4159b5dfc1fad849c7500056642ec2e45af4fc486e46f079a972
-
C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE\taskeng.exeFilesize
29KB
MD552944262c2ba7f1b50a054c0c1f9a88d
SHA1c6f9d258438f247c0d14ad9f60e0b01347bcbfcc
SHA2564fc8a9aff00714d712171dd65a9c42382c6a02cd3f55e98a7e469b0a46d657c9
SHA512880a98312a8f80c37b10baf61a97e04226ed1f007093f61b18daab61a9ed42f0a3f1af3ed1bb4159b5dfc1fad849c7500056642ec2e45af4fc486e46f079a972
-
C:\Users\Admin\AppData\Local\Temp\WINDOWS\TEMPARCHIVE\ucsvc.exeFilesize
70KB
MD56b4f12869c822faff28fe9377531655b
SHA1784fb31f33a92695e4dc6eefeaccc13086ae277f
SHA25606688797d34750928fc847a12db9d2c747d97ea514b1f7d077d6620b160ac958
SHA5125a65c6e30903790ed4c557ffa3ccae0c1a177b0a3b7cacade93faf84c8e7f20f410b5a710ebfd58e0e23e57addf9dc96391254db660f74618f7057204baafae3
-
C:\Users\Admin\AppData\Local\Temp\WorkspaceRuntime\wksprt.exeFilesize
220KB
MD51dae65aa91f64af004bfc75bafa18976
SHA1f5b448b07029640a6bc600b154782eef13865d01
SHA25633b9d81dc68b86efed8095dc63e2a299c3a1b31136e654f66e668af93556f96c
SHA512eb78060f610db6849e75981bbe20345b45c8f8dc24011e9e42b2583934bd379286ae996c9eb8586e5dd4302de59cee5632e7dd97488c6318702ea61774e04b56
-
C:\Users\Admin\AppData\Local\Temp\WorkspaceRuntime\wksprt.exeFilesize
220KB
MD51dae65aa91f64af004bfc75bafa18976
SHA1f5b448b07029640a6bc600b154782eef13865d01
SHA25633b9d81dc68b86efed8095dc63e2a299c3a1b31136e654f66e668af93556f96c
SHA512eb78060f610db6849e75981bbe20345b45c8f8dc24011e9e42b2583934bd379286ae996c9eb8586e5dd4302de59cee5632e7dd97488c6318702ea61774e04b56
-
C:\Users\Admin\AppData\Local\Temp\WorkspaceRuntime\wksprt.exeFilesize
220KB
MD51dae65aa91f64af004bfc75bafa18976
SHA1f5b448b07029640a6bc600b154782eef13865d01
SHA25633b9d81dc68b86efed8095dc63e2a299c3a1b31136e654f66e668af93556f96c
SHA512eb78060f610db6849e75981bbe20345b45c8f8dc24011e9e42b2583934bd379286ae996c9eb8586e5dd4302de59cee5632e7dd97488c6318702ea61774e04b56
-
C:\Users\Admin\AppData\Local\Temp\v.batFilesize
384B
MD52ec56e11d99afad1e6fba39be82df172
SHA18ace61da9bf03dfa3f05e4a2eee2311ade93040f
SHA256fe08f1f73ef0636a84ff7b757a04f2f99c417b4c0d63d9da8952c4154830b929
SHA5125fb85766c7ae10f5839fcdb02518caabb9cc44012ea8cc108c0c4ee78f0a04549cf4a2e0d33ce03a00748baa79f25f63e288513d869d967658fa222fbd11cc21
-
C:\Users\Admin\AppData\Local\temp\WINDOWS\TEMPARCHIVE\ucsvc.exeFilesize
70KB
MD56b4f12869c822faff28fe9377531655b
SHA1784fb31f33a92695e4dc6eefeaccc13086ae277f
SHA25606688797d34750928fc847a12db9d2c747d97ea514b1f7d077d6620b160ac958
SHA5125a65c6e30903790ed4c557ffa3ccae0c1a177b0a3b7cacade93faf84c8e7f20f410b5a710ebfd58e0e23e57addf9dc96391254db660f74618f7057204baafae3
-
C:\Windows\System32\drivers\etc\hostsFilesize
1KB
MD501ae587c73cd331fd2da4caeca584612
SHA1ee2f06eba879af91442b137c36861c131f9fbc26
SHA256464da2c16792622be63fb6e5795853c24d84473080d7090948147dc1c1c27e68
SHA512650e69fa28985a4fd79a530f4fd5f08ae0590160e9db25872f0d3ea50a612674c076090e9d1f8ec7335a2473fa51088577436a2ec8e702e9402f16d467fbb1e5
-
memory/112-149-0x0000000000000000-mapping.dmp
-
memory/344-169-0x0000000000000000-mapping.dmp
-
memory/364-161-0x0000000000000000-mapping.dmp
-
memory/1392-146-0x0000000000000000-mapping.dmp
-
memory/1700-139-0x00007FFC5F6C0000-0x00007FFC600F6000-memory.dmpFilesize
10.2MB
-
memory/1700-132-0x0000000000000000-mapping.dmp
-
memory/1852-159-0x0000000000000000-mapping.dmp
-
memory/2032-170-0x0000000000000000-mapping.dmp
-
memory/2032-172-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/2032-176-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/2056-144-0x00007FFC5F6C0000-0x00007FFC600F6000-memory.dmpFilesize
10.2MB
-
memory/2056-141-0x0000000000000000-mapping.dmp
-
memory/2876-154-0x0000000000000000-mapping.dmp
-
memory/3304-162-0x0000000000000000-mapping.dmp
-
memory/3464-163-0x0000000000000000-mapping.dmp
-
memory/3588-164-0x0000000000000000-mapping.dmp
-
memory/3696-156-0x0000000000000000-mapping.dmp
-
memory/3732-152-0x0000000000000000-mapping.dmp
-
memory/4060-167-0x0000000000000000-mapping.dmp
-
memory/4184-153-0x0000000000000000-mapping.dmp
-
memory/4220-148-0x0000000000000000-mapping.dmp
-
memory/4232-143-0x0000000000000000-mapping.dmp
-
memory/4376-165-0x0000000000000000-mapping.dmp
-
memory/4456-168-0x0000000000000000-mapping.dmp
-
memory/4484-160-0x0000000000000000-mapping.dmp
-
memory/4564-179-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/4564-177-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/4564-173-0x0000000000000000-mapping.dmp
-
memory/4564-174-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4764-138-0x00007FFC5F6C0000-0x00007FFC600F6000-memory.dmpFilesize
10.2MB
-
memory/4764-134-0x0000000000000000-mapping.dmp
-
memory/4840-157-0x0000000000000000-mapping.dmp
-
memory/4848-151-0x0000000000000000-mapping.dmp
-
memory/4952-166-0x0000000000000000-mapping.dmp
-
memory/5024-178-0x0000000000000000-mapping.dmp