62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8

Analysis

max time kernel
144s
max time network
128s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Size

1.1MB
MD5

589e542e797c5853842d692221855347
SHA1

180fb3a204a3b6b54e349de423be054affb2aecf
SHA256

62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8
SHA512

34a62809c8ae47cd988f80565492346c87a30ce13781dbc9c6a12ce93e17925ea12458bc6b384c0da905a249f0c3275bb9188b5df9cb8fa912aad666d7c4429c
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

description pid process target process

PID 564 created 600 564 ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat svchost.exe

description	pid	process	target process
PID 564 created 600	564	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat	svchost.exe

Adds policy Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Feeds Cache\\RUC7JGOV\\wcqJoNRE6icaCknjx2JLt5ud6HqMcGNB82TAVF2A95ZiM90.exe\" O"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\UK9IvcTsEW2qrk3xYiki.exe\" O"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Burn\\wsrZ8QeGlTPxgi72xVxIJaeCqLbyiDa4B6A2.exe\" O"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Default\\AppData\\Roaming\\cMYAqRpttEty576SfKuJmbV4mbUnGZTV3MyYsv3hBcFY5ZofyGh9p.exe\" O"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe

Executes dropped EXE 2 IoCs

Processes:

ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.batZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

pid process

564 ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
1828 ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

pid	process
564	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
1828	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

Sets file execution options in registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.batZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " "	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " "	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " "	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " "	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

Drops startup file 1 IoCs

Processes:

ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rh4HNQj9iZcKc1bzVkgXlufaXKnCsRV06yl7rXYu8T5ljTe7GnbQQ454CAbe.exe	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

Loads dropped DLL 3 IoCs

Processes:

gpscript.exeZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

pid process

1036 gpscript.exe
1036 gpscript.exe
564 ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1036	gpscript.exe
1036	gpscript.exe
564	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

Modifies data under HKEY_USERS 59 IoCs

Processes:

62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exeZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.batgpscript.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\.DEFAULT	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\mB8cPrWUMS.exe\" O 2>NUL"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IEDownloadHistory\\hhcKKlH5BvulhgAdEpKgMwicfrzMVE5w0Wt4eW7vBIIkmnU5.exe\" O 2>NUL"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Site Characteristics Database\\9ba7kK2vr7GXaAgSrmqio7JUzyoYN6InQYN6E2XTHg7v1GxJpz3O1oBr0rFU0zxhVpMh.exe\" O"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%systemroot%\system32\windowspowershell\v1.0\powershell.exe",-111 = "Performs object-based (command-line) functions"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\VHqL3vgROqe0njH6XQVbKcauqISi.exe\" O"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\FontLookupTableCache\\rtfZ7wiOAhl95I6.exe\" O 2>NUL"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Public\\RRgAmpxZ9KEQRbFLVKsFhjl41n.exe\" O 2>NUL"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet."	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{7BD29E01-76C1-11CF-9DD0-00A0C9034933} {000214E6-0000-0000-C000-000000000046} 0xFFFF = 010000000000000070b57c39e400d901	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\es-ES\\mpmkfPUlL6M7RK3aNG1AgS9XL.exe\" O"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\kXhaZTEoOcHSJSS9.exe\" O 2>NUL"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%windir%\System32\ie4uinit.exe",-738 = "Start Internet Explorer without ActiveX controls or browser extensions."	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\E17cceinrXhTJvoVlV8Mx18kyoffFvnR.exe\" O 2>NUL"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Mozilla\\PaGUdlFSqs7ho0ShFn12W4TckgwdbD.exe\" O"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\S-1-5-20	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-19	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\EURLi0gokfdWKFJJLWQmUJAojygRWrH.exe\" O"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	gpscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\oXDNLgj4XRx88ggv6wDuXoDiHKiWxUcAzNJMk7H1ByWE1.exe\" O"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Default\\AppData\\Local\\gCBSPp5wV0GR3Qm6Nfnkci7TVoEMxr3RA3Wk4BY4ttzsSVVnNzXpuD6SpslhOL.exe\" O"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000090a8b835e400d901	gpscript.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\mzuG2MyBvbmrZzmJgibs.exe\" O 2>NUL"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Assistance\\Client\\iBbz4azwAD6Lr5LRz9L6fDjzI0imeO8oA5naN5GMwjzi0BGgeWEGjio39fZoC3p.exe\" O"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3845472200-3839195424-595303356-1000\\iaIFpW3AKlOdIiSCzOJIxc36L7Jpb6dIwQTmCaMhq94ehMlNHKEVfQvItyTP3MhFngQtM.exe\" O"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\13\\jB2NCY4FcaWJmmPZH07iwOwrrnsCl.exe\" O 2>NUL"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\TypA55dKZGffaymerP10JgQ1jPoSxLFswac96V3OZzauQvmusiPwSyoMPWl2D57K.exe\" O 2>NUL"	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe

Modifies registry class 12 IoCs

Processes:

62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\BK4yuQImv8.exe\" O"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Public\\Favorites\\Zx9XHVDD4VV0tOwDNVNbA6PvheVAAVi.exe\" O 2>NUL"	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\SOFTWARE\Microsoft\Command Processor	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Command Processor	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

pid process

1828 ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
1828 ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

pid	process
1828	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
1828	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exeAUDIODG.EXEZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.batZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

description	pid	process
Token: SeBackupPrivilege	1340	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Token: SeRestorePrivilege	1340	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Token: SeShutdownPrivilege	1340	62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
Token: 33	1612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1612	AUDIODG.EXE
Token: 33	1612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1612	AUDIODG.EXE
Token: SeDebugPrivilege	564	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Token: SeRestorePrivilege	564	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Token: SeDebugPrivilege	1828	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Token: SeRestorePrivilege	1828	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

gpscript.exeZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

description	pid	process	target process
PID 1036 wrote to memory of 564	1036	gpscript.exe	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
PID 1036 wrote to memory of 564	1036	gpscript.exe	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
PID 1036 wrote to memory of 564	1036	gpscript.exe	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
PID 564 wrote to memory of 1828	564	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
PID 564 wrote to memory of 1828	564	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
PID 564 wrote to memory of 1828	564	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat	ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat

C:\Users\Admin\AppData\Local\Temp\62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe
"C:\Users\Admin\AppData\Local\Temp\62d78ad3b7bf9441610d114bfc28ba98e3b837ce31418f47938609ac842b25d8.exe"
1⤵
- Adds policy Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:600

C:\ProgramData\Microsoft\Device Stage\Task\ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
"C:\ProgramData\Microsoft\Device Stage\Task\ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat" 2
2⤵
- Executes dropped EXE
- Sets file execution options in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:288

C:\Windows\system32\gpscript.exe
gpscript.exe /Shutdown
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1036

C:\ProgramData\Microsoft\Device Stage\Task\ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
"C:\ProgramData\Microsoft\Device Stage\Task\ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat" 1
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Device Stage\Task\ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Filesize
2.2MB

MD5
fc0891c806cc0e8feef8ca6b63e0c39f

SHA1
f4c4f7acddcc0fac6b0b35312a28df67c40824ad

SHA256
d1a9e67dd6d14e0134f48900e373ccd37c29eeca81932c48a5399d4465dd3008

SHA512
af5b38c6c172627f4ee46ac7aefbe918e1748b7b234bf9b2f3385a897b2bdacc908253d90eee4cf0530c6130788c98c341f7131077132c253030d656e386f175

Download Submit
C:\ProgramData\Microsoft\Device Stage\Task\ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Filesize
2.2MB

MD5
fc0891c806cc0e8feef8ca6b63e0c39f

SHA1
f4c4f7acddcc0fac6b0b35312a28df67c40824ad

SHA256
d1a9e67dd6d14e0134f48900e373ccd37c29eeca81932c48a5399d4465dd3008

SHA512
af5b38c6c172627f4ee46ac7aefbe918e1748b7b234bf9b2f3385a897b2bdacc908253d90eee4cf0530c6130788c98c341f7131077132c253030d656e386f175

Download Submit
C:\ProgramData\Microsoft\Device Stage\Task\ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Filesize
2.2MB

MD5
fc0891c806cc0e8feef8ca6b63e0c39f

SHA1
f4c4f7acddcc0fac6b0b35312a28df67c40824ad

SHA256
d1a9e67dd6d14e0134f48900e373ccd37c29eeca81932c48a5399d4465dd3008

SHA512
af5b38c6c172627f4ee46ac7aefbe918e1748b7b234bf9b2f3385a897b2bdacc908253d90eee4cf0530c6130788c98c341f7131077132c253030d656e386f175

Download Submit
C:\ProgramData\Microsoft\Windows Defender\Scans\kXhaZTEoOcHSJSS9.exe
Filesize
2.1MB

MD5
b78bb035c41eacef6cd6f31b1ce8396e

SHA1
dc7adaf6ae177b1b2fb8edd4cbfffca2280d13c7

SHA256
51563b485a1efaf2cb3c0e24d022105ec13f59e93d6e1caa31777edd45b87b8e

SHA512
e237f1299b3abe680678506e49dff3eb73311afcccd0f4469b0a99312af6552a0bd2fd11fe5a1382efa47a2da26821aa4872f9872411971b41c9732f11d3f7b2

Download Submit
C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\es-ES\mpmkfPUlL6M7RK3aNG1AgS9XL.exe
Filesize
1.9MB

MD5
c872eacadd628cd72640ee3682c7a903

SHA1
18c39ab128f419172aa73d1e0800e3ae75602f3c

SHA256
221e374303af04e555bc89f06ef84aace21789611b6f679d00175752833058e7

SHA512
0934e9577fc216c7463928141dd74536852b88cceec698031ccabd0e8be2859dd3d9770c5f260cde452294c6b5adb932202d2b07c4aee8e07341925c6e1ebb25

Download Submit
C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\EURLi0gokfdWKFJJLWQmUJAojygRWrH.exe
Filesize
1.9MB

MD5
629353339768702cdf7ef35dd6040ae4

SHA1
6d7f7dbed5e9ecec959aa9dcb949ef991d5185b5

SHA256
3e415359fc01f18685e78ae7b5bc761f9952accdaa51b26955f44969aa478119

SHA512
83bac141dbf64d2b8471b967408c750384e82141cfb9f8517c08fd69b681c01eaafe86b7944ac5745b530066aed7b7b8dee1631c6254a3e869ae2dcfa1bc5c55

Download Submit
C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\tyyG0IUMyALnzKvQAIkufCmLpr8ft.exe
Filesize
3.3MB

MD5
0353df1a5ddc2dd2e97fa44f601cfd76

SHA1
ebbc3d9caf62989980b5cde61070d62686c26b81

SHA256
2ea759b3548d3a1f26d109838a74417660b5bf63ed4b7cca05766d1fbe325ada

SHA512
61dcdd8666c94dae254bfbe258134c42f6a0f0d9eab13a82b4fad1cf66907a35df79c182baf7a5e937181d451e23ab81efecea69f65bf7c29a9ef8759ce7b483

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\rtfZ7wiOAhl95I6.exe
Filesize
1.8MB

MD5
c026c722809b274a3c095080e413fcee

SHA1
18af4633cd8aa97646cf17135d786f8ff160c719

SHA256
f371665baad6a24f383956912f48a7ea1b04a9cd181f2a27f478bc80e892eefc

SHA512
45080139e4caa80981740780e02afeb66b02e9363c8b428d81c7d8ff20a3b739625542f655cbb03767b30636ec55ebf4967f00d507b4335631dfd8ea8fa57324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\wsrZ8QeGlTPxgi72xVxIJaeCqLbyiDa4B6A2.exe
Filesize
2.2MB

MD5
4541419e471c2d7c3eb1a50f0072e5f5

SHA1
a4a784e0aa341534ab751a6871ad3b13e2ab61c7

SHA256
dc56e67d3ae292a5f073add7303123b9e67786a768e06caf643a83d06122c221

SHA512
9018af5d30e4b9d4de2579644e55a06b7e7729041513865ae537827f465fda751afde904e103ff61626f7996b82b444f116c7dfd85c2bc619604e885666b9da3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3845472200-3839195424-595303356-1000\iaIFpW3AKlOdIiSCzOJIxc36L7Jpb6dIwQTmCaMhq94ehMlNHKEVfQvItyTP3MhFngQtM.exe
Filesize
1.9MB

MD5
70a06e9d22e5f0421c181f73e177d547

SHA1
3f5de0918feab7b6cf47de783ab87a58cb794ff7

SHA256
ef7e0b8e3eef04c90e0627ba0f61af3499754ed5712aa58e69611946743ed72e

SHA512
4fea67a571b5d410fb8aace0cf68a3060277c791d5607071dbe59ed0b8c10789cc72b7a3a73ac236ca41d717e48c51b8a22874105071f0fec956967fc8fc747c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\MgbZsF73MvQswHbhcMVG4l4qB4ygm5f.bat
Filesize
3.4MB

MD5
59083b98adddef7417d5a627015f55b6

SHA1
f9102a3b719acebcb57b1fda768684c5828da585

SHA256
0878250765a333716a00c5f892934fd4d798afce3289397d769154fcab909123

SHA512
9a394065b8d5b90a40f23e95f48d90677956dc5290915500c817e5db1cd2607fd337b42c191064a57e8fad6113a1fe983eea5b0bfe38e7ca3277d057857b5277

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Zcpac6eIBZ0iTiBsP21XR0vCc3GMFPEU6amamY9lnCie64EBBTnT.exe
Filesize
1.6MB

MD5
76d38d35e77a246d0946213d406aace1

SHA1
bb4a58f52954b244ca6f2a3b2799f1c29ae44f9e

SHA256
6ee547441fd59a53331ce64c9790c96fde9c7a99e007e13a01fd39523bb767fa

SHA512
4ed393754a2d9db4dfaf82dcb1516d42f8d732ba96e3743bb1afc8a97cfc6b89a3cac68bf4fe0e1a901ae98a1315108579490c97ca3f8809910aa825d93a84dc

Download Submit
C:\Users\Public\RRgAmpxZ9KEQRbFLVKsFhjl41n.exe
Filesize
2.1MB

MD5
12eaefc12f0a3e8877bcfc5ec77a39f0

SHA1
fb8912dfde91ee4543d2fb34eed134550f3ba486

SHA256
d177e51c4d67ef9be23ff07f4de383534d8b450b49016c534231f9346633dccc

SHA512
2e04255c2826212db4188b3d39052998efe92b254b15204d17df993d9ef2ef50c7286ee85c727e53a72045015ead18d201f26ce675024688194ad8e639ef950f

Download Submit
\ProgramData\Microsoft\Device Stage\Task\ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Filesize
2.2MB

MD5
fc0891c806cc0e8feef8ca6b63e0c39f

SHA1
f4c4f7acddcc0fac6b0b35312a28df67c40824ad

SHA256
d1a9e67dd6d14e0134f48900e373ccd37c29eeca81932c48a5399d4465dd3008

SHA512
af5b38c6c172627f4ee46ac7aefbe918e1748b7b234bf9b2f3385a897b2bdacc908253d90eee4cf0530c6130788c98c341f7131077132c253030d656e386f175

Download Submit
\ProgramData\Microsoft\Device Stage\Task\ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Filesize
2.2MB

MD5
fc0891c806cc0e8feef8ca6b63e0c39f

SHA1
f4c4f7acddcc0fac6b0b35312a28df67c40824ad

SHA256
d1a9e67dd6d14e0134f48900e373ccd37c29eeca81932c48a5399d4465dd3008

SHA512
af5b38c6c172627f4ee46ac7aefbe918e1748b7b234bf9b2f3385a897b2bdacc908253d90eee4cf0530c6130788c98c341f7131077132c253030d656e386f175

Download Submit
\ProgramData\Microsoft\Device Stage\Task\ZV1dlqCRSyMJBZlkh05xKehlQsYSxXZwCO7m9i982yt5hMqHXha9Deqh.bat
Filesize
2.2MB

MD5
fc0891c806cc0e8feef8ca6b63e0c39f

SHA1
f4c4f7acddcc0fac6b0b35312a28df67c40824ad

SHA256
d1a9e67dd6d14e0134f48900e373ccd37c29eeca81932c48a5399d4465dd3008

SHA512
af5b38c6c172627f4ee46ac7aefbe918e1748b7b234bf9b2f3385a897b2bdacc908253d90eee4cf0530c6130788c98c341f7131077132c253030d656e386f175

Download Submit
memory/564-62-0x0000000000000000-mapping.dmp

Download
memory/564-68-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/564-78-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/564-82-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/952-55-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

Filesize
8KB

Download
memory/1036-76-0x0000000000DD0000-0x0000000000DFD000-memory.dmp

Filesize
180KB

Download
memory/1036-67-0x0000000000DD0000-0x0000000000DFD000-memory.dmp

Filesize
180KB

Download
memory/1036-66-0x0000000000DD0000-0x0000000000DFD000-memory.dmp

Filesize
180KB

Download
memory/1036-77-0x0000000000DD0000-0x0000000000DFD000-memory.dmp

Filesize
180KB

Download
memory/1340-54-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1340-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1828-80-0x0000000000000000-mapping.dmp

Download
memory/1828-85-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads