9cf18172ea095ac7bb1453e9f4a0ba21af67147d38fd7ef837ea8a26a8cef1b8

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2023 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vip x tiger king.exe
Size

2.5MB
MD5

82f6956b19929bdd329eb1bd3e82737b
SHA1

f82a8612f0f1f4450dbccdab384752b92cbd49d3
SHA256

9cf18172ea095ac7bb1453e9f4a0ba21af67147d38fd7ef837ea8a26a8cef1b8
SHA512

995d1d62b8d0744d1c7fbb00607bf52a552dff589205a1f239f9a0a794103bd76eb7b78c48a4069183eb4bec36177a94c8e2a5b3b608e384d1028bab47110bd1
SSDEEP

49152:bLclBtZBMqDkAfFm75qmbavcQdV5+7nfxf2AJ9MRWxPuJLbpUMI:bOBtZKqKCjr5+7fx+AJS4x4LbpU

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2952	CB.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	vip x tiger king.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\CB.exe	vip x tiger king.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1324	4956	vip x tiger king.exe	81
PID 4956 wrote to memory of 1324	4956	vip x tiger king.exe	81
PID 4956 wrote to memory of 1324	4956	vip x tiger king.exe	81
PID 1324 wrote to memory of 4592	1324	cmd.exe	82
PID 1324 wrote to memory of 4592	1324	cmd.exe	82
PID 1324 wrote to memory of 4592	1324	cmd.exe	82
PID 4956 wrote to memory of 628	4956	vip x tiger king.exe	83
PID 4956 wrote to memory of 628	4956	vip x tiger king.exe	83
PID 4956 wrote to memory of 628	4956	vip x tiger king.exe	83
PID 4956 wrote to memory of 4596	4956	vip x tiger king.exe	84
PID 4956 wrote to memory of 4596	4956	vip x tiger king.exe	84
PID 4956 wrote to memory of 4596	4956	vip x tiger king.exe	84
PID 4956 wrote to memory of 1560	4956	vip x tiger king.exe	85
PID 4956 wrote to memory of 1560	4956	vip x tiger king.exe	85
PID 4956 wrote to memory of 1560	4956	vip x tiger king.exe	85
PID 4956 wrote to memory of 2184	4956	vip x tiger king.exe	86
PID 4956 wrote to memory of 2184	4956	vip x tiger king.exe	86
PID 4956 wrote to memory of 2184	4956	vip x tiger king.exe	86
PID 4956 wrote to memory of 1548	4956	vip x tiger king.exe	87
PID 4956 wrote to memory of 1548	4956	vip x tiger king.exe	87
PID 4956 wrote to memory of 1548	4956	vip x tiger king.exe	87
PID 4956 wrote to memory of 2336	4956	vip x tiger king.exe	88
PID 4956 wrote to memory of 2336	4956	vip x tiger king.exe	88
PID 4956 wrote to memory of 2336	4956	vip x tiger king.exe	88
PID 4956 wrote to memory of 1356	4956	vip x tiger king.exe	89
PID 4956 wrote to memory of 1356	4956	vip x tiger king.exe	89
PID 4956 wrote to memory of 1356	4956	vip x tiger king.exe	89
PID 4956 wrote to memory of 3036	4956	vip x tiger king.exe	90
PID 4956 wrote to memory of 3036	4956	vip x tiger king.exe	90
PID 4956 wrote to memory of 3036	4956	vip x tiger king.exe	90
PID 4956 wrote to memory of 1868	4956	vip x tiger king.exe	92
PID 4956 wrote to memory of 1868	4956	vip x tiger king.exe	92
PID 4956 wrote to memory of 1868	4956	vip x tiger king.exe	92
PID 4956 wrote to memory of 528	4956	vip x tiger king.exe	93
PID 4956 wrote to memory of 528	4956	vip x tiger king.exe	93
PID 4956 wrote to memory of 528	4956	vip x tiger king.exe	93
PID 4956 wrote to memory of 460	4956	vip x tiger king.exe	94
PID 4956 wrote to memory of 460	4956	vip x tiger king.exe	94
PID 4956 wrote to memory of 460	4956	vip x tiger king.exe	94
PID 4956 wrote to memory of 100	4956	vip x tiger king.exe	95
PID 4956 wrote to memory of 100	4956	vip x tiger king.exe	95
PID 4956 wrote to memory of 100	4956	vip x tiger king.exe	95
PID 4956 wrote to memory of 312	4956	vip x tiger king.exe	96
PID 4956 wrote to memory of 312	4956	vip x tiger king.exe	96
PID 4956 wrote to memory of 312	4956	vip x tiger king.exe	96
PID 4956 wrote to memory of 3560	4956	vip x tiger king.exe	97
PID 4956 wrote to memory of 3560	4956	vip x tiger king.exe	97
PID 4956 wrote to memory of 3560	4956	vip x tiger king.exe	97
PID 4956 wrote to memory of 5004	4956	vip x tiger king.exe	98
PID 4956 wrote to memory of 5004	4956	vip x tiger king.exe	98
PID 4956 wrote to memory of 5004	4956	vip x tiger king.exe	98
PID 4956 wrote to memory of 2792	4956	vip x tiger king.exe	99
PID 4956 wrote to memory of 2792	4956	vip x tiger king.exe	99
PID 4956 wrote to memory of 2792	4956	vip x tiger king.exe	99
PID 4956 wrote to memory of 3468	4956	vip x tiger king.exe	100
PID 4956 wrote to memory of 3468	4956	vip x tiger king.exe	100
PID 4956 wrote to memory of 3468	4956	vip x tiger king.exe	100
PID 4956 wrote to memory of 4624	4956	vip x tiger king.exe	101
PID 4956 wrote to memory of 4624	4956	vip x tiger king.exe	101
PID 4956 wrote to memory of 4624	4956	vip x tiger king.exe	101
PID 4956 wrote to memory of 1216	4956	vip x tiger king.exe	102
PID 4956 wrote to memory of 1216	4956	vip x tiger king.exe	102
PID 4956 wrote to memory of 1216	4956	vip x tiger king.exe	102
PID 4956 wrote to memory of 3632	4956	vip x tiger king.exe	103

C:\Users\Admin\AppData\Local\Temp\vip x tiger king.exe
"C:\Users\Admin\AppData\Local\Temp\vip x tiger king.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE CON COLS=19 LINES=2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\mode.com
    MODE CON COLS=19 LINES=2
    3⤵
    PID:4592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:5008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:5036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:5056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:5072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:5028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:5016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:5008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:5036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:3432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2884
- C:\Windows\CB.exe
  "C:\Windows\CB.exe"
  2⤵
  - Executes dropped EXE
  PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c MODE CON COLS=215 LINES=22
    3⤵
    PID:4556
  - - C:\Windows\SysWOW64\mode.com
      MODE CON COLS=215 LINES=22
      4⤵
      PID:5064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color A
    3⤵
    PID:3580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\CB.exe

Filesize
2.7MB

MD5
901401fae956333e7bbae211510984dc

SHA1
21fd2f262d362534f6ca4eb7b1dacebc97e5f2f7

SHA256
77d071a3200427d6b849fc8dae5274e9b4ee11c606c6f249e51c8c9b5e3a8319

SHA512
3bcda43421f8701d1222f67be9afeaecc70d95db0123834a3378c9168dd953ceebc58a472130df68e4d1d50351de613f4091a668f80f3842a208f6ecec2249db

Download Submit
C:\Windows\CB.exe

Filesize
2.7MB

MD5
901401fae956333e7bbae211510984dc

SHA1
21fd2f262d362534f6ca4eb7b1dacebc97e5f2f7

SHA256
77d071a3200427d6b849fc8dae5274e9b4ee11c606c6f249e51c8c9b5e3a8319

SHA512
3bcda43421f8701d1222f67be9afeaecc70d95db0123834a3378c9168dd953ceebc58a472130df68e4d1d50351de613f4091a668f80f3842a208f6ecec2249db

Download Submit
memory/100-145-0x0000000000000000-mapping.dmp

Download
memory/312-146-0x0000000000000000-mapping.dmp

Download
memory/392-158-0x0000000000000000-mapping.dmp

Download
memory/460-144-0x0000000000000000-mapping.dmp

Download
memory/528-143-0x0000000000000000-mapping.dmp

Download
memory/628-134-0x0000000000000000-mapping.dmp

Download
memory/752-156-0x0000000000000000-mapping.dmp

Download
memory/816-163-0x0000000000000000-mapping.dmp

Download
memory/944-171-0x0000000000000000-mapping.dmp

Download
memory/1148-195-0x0000000000000000-mapping.dmp

Download
memory/1216-152-0x0000000000000000-mapping.dmp

Download
memory/1272-159-0x0000000000000000-mapping.dmp

Download
memory/1324-132-0x0000000000000000-mapping.dmp

Download
memory/1356-140-0x0000000000000000-mapping.dmp

Download
memory/1380-160-0x0000000000000000-mapping.dmp

Download
memory/1420-175-0x0000000000000000-mapping.dmp

Download
memory/1520-180-0x0000000000000000-mapping.dmp

Download
memory/1548-138-0x0000000000000000-mapping.dmp

Download
memory/1560-136-0x0000000000000000-mapping.dmp

Download
memory/1868-142-0x0000000000000000-mapping.dmp

Download
memory/2008-154-0x0000000000000000-mapping.dmp

Download
memory/2184-137-0x0000000000000000-mapping.dmp

Download
memory/2196-182-0x0000000000000000-mapping.dmp

Download
memory/2336-139-0x0000000000000000-mapping.dmp

Download
memory/2340-172-0x0000000000000000-mapping.dmp

Download
memory/2388-174-0x0000000000000000-mapping.dmp

Download
memory/2460-193-0x0000000000000000-mapping.dmp

Download
memory/2792-149-0x0000000000000000-mapping.dmp

Download
memory/3012-183-0x0000000000000000-mapping.dmp

Download
memory/3024-181-0x0000000000000000-mapping.dmp

Download
memory/3036-141-0x0000000000000000-mapping.dmp

Download
memory/3176-177-0x0000000000000000-mapping.dmp

Download
memory/3204-167-0x0000000000000000-mapping.dmp

Download
memory/3340-186-0x0000000000000000-mapping.dmp

Download
memory/3376-185-0x0000000000000000-mapping.dmp

Download
memory/3404-190-0x0000000000000000-mapping.dmp

Download
memory/3444-188-0x0000000000000000-mapping.dmp

Download
memory/3468-150-0x0000000000000000-mapping.dmp

Download
memory/3544-165-0x0000000000000000-mapping.dmp

Download
memory/3560-147-0x0000000000000000-mapping.dmp

Download
memory/3632-153-0x0000000000000000-mapping.dmp

Download
memory/3680-164-0x0000000000000000-mapping.dmp

Download
memory/3696-194-0x0000000000000000-mapping.dmp

Download
memory/3964-155-0x0000000000000000-mapping.dmp

Download
memory/4048-170-0x0000000000000000-mapping.dmp

Download
memory/4084-162-0x0000000000000000-mapping.dmp

Download
memory/4220-191-0x0000000000000000-mapping.dmp

Download
memory/4292-168-0x0000000000000000-mapping.dmp

Download
memory/4320-187-0x0000000000000000-mapping.dmp

Download
memory/4388-173-0x0000000000000000-mapping.dmp

Download
memory/4432-178-0x0000000000000000-mapping.dmp

Download
memory/4496-192-0x0000000000000000-mapping.dmp

Download
memory/4528-157-0x0000000000000000-mapping.dmp

Download
memory/4592-133-0x0000000000000000-mapping.dmp

Download
memory/4596-135-0x0000000000000000-mapping.dmp

Download
memory/4624-151-0x0000000000000000-mapping.dmp

Download
memory/4692-166-0x0000000000000000-mapping.dmp

Download
memory/4704-176-0x0000000000000000-mapping.dmp

Download
memory/4716-184-0x0000000000000000-mapping.dmp

Download
memory/4728-179-0x0000000000000000-mapping.dmp

Download
memory/4756-189-0x0000000000000000-mapping.dmp

Download
memory/4884-169-0x0000000000000000-mapping.dmp

Download
memory/5004-148-0x0000000000000000-mapping.dmp

Download
memory/5096-161-0x0000000000000000-mapping.dmp

Download