fe9e578f0f46460b5c2fec679c5102d871300615417ae898a6b36bd41527d0b1

Analysis

max time kernel
64s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2023, 20:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Build 29.exe
Size

1000KB
MD5

7b9a05b21a757945e705b3d7c8f0ed0e
SHA1

4e653927f7dddcd368c08784df004fb9d4d91bf6
SHA256

fe9e578f0f46460b5c2fec679c5102d871300615417ae898a6b36bd41527d0b1
SHA512

164af7caf5ab071dd30c02633bacaa8c7fc6ebb5f6ecc5ebc43c5fa2fd70ec07c63d2f4c6717eb6a0fb963bf33246d9575c88b41fe4b7790f542b154aabf5d36
SSDEEP

24576:pLllLl7CEtAeO/zwj6WM1ZfBelVVqCC1iMs16A2:BllLtP8nWKG0CCb0X2

Score

10^/10

evasion ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Build 29.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	wscript.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\assets\\wallpaper.jpg"	wscript.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\winnt32\Payloads\files\web.vbs	wscript.exe
File created	C:\Windows\winnt32\Payloads\files\mouse.vbs	wscript.exe
File created	C:\Windows\winnt32\create.vbs	wscript.exe
File opened for modification	C:\Windows\winnt32\create.vbs	wscript.exe
File created	C:\Windows\winnt32\main.cmd	wscript.exe
File created	C:\Windows\winnt32\NOTIFY.vbs	wscript.exe
File created	C:\Windows\winnt32\Payloads\controller.vbs	wscript.exe
File created	C:\Windows\winnt32\Payloads\files\keyboard.vbs	wscript.exe
File created	C:\Windows\winnt32\disableregedit.vbs	wscript.exe
File created	C:\Windows\winnt32\run.cmd	wscript.exe
File created	C:\Windows\winnt32\winnt32.exe	wscript.exe
File created	C:\Windows\winnt32\disabletaskmgr.vbs	wscript.exe
File created	C:\Windows\winnt32\noexecution.vbs	wscript.exe
File created	C:\Windows\winnt32\run.exe	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2820	schtasks.exe
3432	schtasks.exe
1404	schtasks.exe

Kills process with taskkill 10 IoCs

evasion

pid	Process
4584	taskkill.exe
4688	taskkill.exe
5108	taskkill.exe
1004	taskkill.exe
1500	taskkill.exe
1788	taskkill.exe
180	taskkill.exe
3816	taskkill.exe
4976	taskkill.exe
3192	taskkill.exe

Modifies Control Panel 33 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\WindowFrame = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\ActiveBorder = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\ButtonFace = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\Hilight = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\MenuText = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\Window = "255 0 0"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\ButtonDkShadow = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\ButtonHilight = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\InactiveTitleText = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\AppWorkspace = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\ButtonShadow = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\InfoWindow = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\MenuBar = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\Scrollbar = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\HilightText = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\Menu = "255 0 0"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Desktop	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\Background = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\ButtonAlternateFace = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\GradientInactiveTitle = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\GrayText = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\ActiveTitle = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\ButtonLight = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\GradientActiveTitle = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\MenuHilight = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\WindowText = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\HotTrackingColor = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\InactiveTitle = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\TitleText = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\ButtonText = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\InactiveBorder = "255 0 0"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Colors\InfoText = "255 0 0"	wscript.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	Build 29.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3220	reg.exe

Runs regedit.exe 1 IoCs

pid	Process
5028	regedit.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	3192	taskkill.exe
Token: SeDebugPrivilege	1004	taskkill.exe
Token: SeDebugPrivilege	1500	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	4584	taskkill.exe
Token: SeDebugPrivilege	4688	taskkill.exe
Token: SeDebugPrivilege	180	taskkill.exe
Token: SeDebugPrivilege	5108	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
224	wscript.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1540	4932	Build 29.exe	85
PID 4932 wrote to memory of 1540	4932	Build 29.exe	85
PID 4932 wrote to memory of 1540	4932	Build 29.exe	85
PID 1540 wrote to memory of 1212	1540	WScript.exe	86
PID 1540 wrote to memory of 1212	1540	WScript.exe	86
PID 1540 wrote to memory of 1212	1540	WScript.exe	86
PID 1540 wrote to memory of 3144	1540	WScript.exe	88
PID 1540 wrote to memory of 3144	1540	WScript.exe	88
PID 1540 wrote to memory of 3144	1540	WScript.exe	88
PID 3144 wrote to memory of 4400	3144	wscript.exe	89
PID 3144 wrote to memory of 4400	3144	wscript.exe	89
PID 3144 wrote to memory of 4400	3144	wscript.exe	89
PID 4400 wrote to memory of 4976	4400	cmd.exe	126
PID 4400 wrote to memory of 4976	4400	cmd.exe	126
PID 4400 wrote to memory of 4976	4400	cmd.exe	126
PID 1540 wrote to memory of 2692	1540	WScript.exe	92
PID 1540 wrote to memory of 2692	1540	WScript.exe	92
PID 1540 wrote to memory of 2692	1540	WScript.exe	92
PID 1540 wrote to memory of 2840	1540	WScript.exe	94
PID 1540 wrote to memory of 2840	1540	WScript.exe	94
PID 1540 wrote to memory of 2840	1540	WScript.exe	94
PID 1540 wrote to memory of 4488	1540	WScript.exe	95
PID 1540 wrote to memory of 4488	1540	WScript.exe	95
PID 1540 wrote to memory of 4488	1540	WScript.exe	95
PID 1540 wrote to memory of 4912	1540	WScript.exe	98
PID 1540 wrote to memory of 4912	1540	WScript.exe	98
PID 1540 wrote to memory of 4912	1540	WScript.exe	98
PID 4976 wrote to memory of 2820	4976	taskkill.exe	102
PID 4976 wrote to memory of 2820	4976	taskkill.exe	102
PID 4976 wrote to memory of 2820	4976	taskkill.exe	102
PID 1540 wrote to memory of 4120	1540	WScript.exe	100
PID 1540 wrote to memory of 4120	1540	WScript.exe	100
PID 1540 wrote to memory of 4120	1540	WScript.exe	100
PID 1540 wrote to memory of 4408	1540	WScript.exe	104
PID 1540 wrote to memory of 4408	1540	WScript.exe	104
PID 1540 wrote to memory of 4408	1540	WScript.exe	104
PID 1540 wrote to memory of 4796	1540	WScript.exe	105
PID 1540 wrote to memory of 4796	1540	WScript.exe	105
PID 1540 wrote to memory of 4796	1540	WScript.exe	105
PID 2840 wrote to memory of 1916	2840	cmd.exe	111
PID 2840 wrote to memory of 1916	2840	cmd.exe	111
PID 2840 wrote to memory of 1916	2840	cmd.exe	111
PID 1540 wrote to memory of 544	1540	WScript.exe	149
PID 1540 wrote to memory of 544	1540	WScript.exe	149
PID 1540 wrote to memory of 544	1540	WScript.exe	149
PID 2692 wrote to memory of 4208	2692	cmd.exe	109
PID 2692 wrote to memory of 4208	2692	cmd.exe	109
PID 2692 wrote to memory of 4208	2692	cmd.exe	109
PID 4488 wrote to memory of 3852	4488	cmd.exe	112
PID 4488 wrote to memory of 3852	4488	cmd.exe	112
PID 4488 wrote to memory of 3852	4488	cmd.exe	112
PID 4796 wrote to memory of 224	4796	cmd.exe	113
PID 4796 wrote to memory of 224	4796	cmd.exe	113
PID 4796 wrote to memory of 224	4796	cmd.exe	113
PID 1916 wrote to memory of 3160	1916	wscript.exe	114
PID 1916 wrote to memory of 3160	1916	wscript.exe	114
PID 1916 wrote to memory of 3160	1916	wscript.exe	114
PID 4408 wrote to memory of 3536	4408	cmd.exe	115
PID 4408 wrote to memory of 3536	4408	cmd.exe	115
PID 4408 wrote to memory of 3536	4408	cmd.exe	115
PID 4912 wrote to memory of 2576	4912	cmd.exe	116
PID 4912 wrote to memory of 2576	4912	cmd.exe	116
PID 4912 wrote to memory of 2576	4912	cmd.exe	116
PID 4208 wrote to memory of 636	4208	wscript.exe	117

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

C:\Users\Admin\AppData\Local\Temp\Build 29.exe
"C:\Users\Admin\AppData\Local\Temp\Build 29.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\move.vbs"
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Windows\winnt32\create.vbs
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\winnt32\create.vbs"
        5⤵
        
        PID:4976
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "Windows Security Service (WSS)" /sc onlogon /ru Admin /rl highest /tr "wscript.exe C:\Windows\winnt32\run.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wscript assets/accent.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\SysWOW64\wscript.exe
      wscript assets/accent.vbs
      4⤵
      Checks computer location settings
      Modifies Control Panel
      Suspicious use of WriteProcessMemory
      PID:4208
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wscript assets/wallpaper.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\SysWOW64\wscript.exe
      wscript assets/wallpaper.vbs
      4⤵
      Checks computer location settings
      Sets desktop wallpaper using registry
      Modifies Control Panel
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3160
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wscript assets/disabletaskmgr.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\SysWOW64\wscript.exe
      wscript assets/disabletaskmgr.vbs
      4⤵
      Checks computer location settings
      PID:3852
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
    - - C:\Windows\SysWOW64\Taskmgr.exe
        
        "C:\Windows\System32\Taskmgr.exe"
        5⤵
        
        PID:3708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wscript assets/disableregedit.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\SysWOW64\wscript.exe
      wscript assets/disableregedit.vbs
      4⤵
      Checks computer location settings
      PID:2576
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4976
    - - C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe"
        5⤵
        Runs regedit.exe
        
        PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wscript assets/filespam.vbs
    3⤵
    PID:4120
  - - C:\Windows\SysWOW64\wscript.exe
      wscript assets/filespam.vbs
      4⤵
      PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wscript assets/noexecution.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\SysWOW64\wscript.exe
      wscript assets/noexecution.vbs
      4⤵
      Checks computer location settings
      PID:3536
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im schtasks.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3192
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\system32\wscript.exe" C:\Windows\winnt32\NOTIFY.vbs
        5⤵
        
        PID:748
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Taskmgr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\system32\wscript.exe" C:\Windows\winnt32\NOTIFY.vbs
        5⤵
        Checks computer location settings
        
        PID:2256
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\system32\wscript.exe" C:\Windows\winnt32\NOTIFY.vbs
        5⤵
        
        PID:3048
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im WaaSMedicAgent.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\system32\wscript.exe" C:\Windows\winnt32\NOTIFY.vbs
        5⤵
        
        PID:544
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im WaaSMedicAgent.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4584
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\system32\wscript.exe" C:\Windows\winnt32\NOTIFY.vbs
        5⤵
        
        PID:3196
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im WaaSMedicAgent.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\system32\wscript.exe" C:\Windows\winnt32\NOTIFY.vbs
        5⤵
        
        PID:1536
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im SIHClient.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:180
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\system32\wscript.exe" C:\Windows\winnt32\NOTIFY.vbs
        5⤵
        
        PID:5100
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im WaaSMedicAgent.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5108
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\system32\wscript.exe" C:\Windows\winnt32\NOTIFY.vbs
        5⤵
        
        PID:4552
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wscript assets/lock.hta
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\SysWOW64\wscript.exe
      wscript assets/lock.hta
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:224
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wscript assets/lua.vbs
    3⤵
    PID:544
  - - C:\Windows\SysWOW64\wscript.exe
      wscript assets/lua.vbs
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Query /FO CSV /NH /TN "lua.vbs"
        5⤵
        
        PID:392
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\lua.vbs" /CreateTask
        5⤵
        UAC bypass
        Checks computer location settings
        Checks whether UAC is enabled
        System policy modification
        
        PID:648
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC ONCE /TN "lua.vbs" /TR "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\lua.vbs\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:3432
      - C:\Windows\SysWOW64\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Modifies registry key
        
        PID:3220
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "Windows Security Service (WSS)" /sc onlogon /ru Admin /rl highest /tr "wscript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\run.vbs"
        6⤵
        Creates scheduled task(s)
        
        PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\accent.vbs

Filesize
2KB

MD5
6f63cb040631eaf11379f48c84db0c45

SHA1
f13f2cf56b726e5f16205505f7be09f5b5f0abe4

SHA256
eababbf9764a02c82fed6fb02279ed501caa82334480e1a3e515def5ab183076

SHA512
cf2cb6430b1b103fa09328f22603806744f0b2adb406addcff39d2ee9f388129c3fa6b19cfb40c3b851734fb828a7250c9bdb2efd952ca12433cc59f27f9f119

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\disableregedit.vbs

Filesize
557B

MD5
13e14305c9e6147fb03cc617cf7c21de

SHA1
a139b45d72dfb0806d2131a4bca3c64c0d032902

SHA256
72cd09c057c3e8f4502679ac58c477f9177089384409f93af723a6bb5cf3e4b6

SHA512
d62d1a2ae1a484355d1ed210457917b920bd92e674c4732e07d33a44b7e54d2ca7d1b93a4300e362dc5fcdc082edb7e387e77a5b627ff7118617ba6956721d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\disabletaskmgr.vbs

Filesize
551B

MD5
b1f2e196820905ba24ce44687e0622ab

SHA1
d1830d5960a8e6c4c1fe6120e45ee362c6015eb5

SHA256
5f2babe4f208ba37210d370f6bfa301873bf223994f6b75d0c5dd4304411b6e1

SHA512
0d178fe9e8612df36de685872757cffc7a85a728107bb00b5c36489738208a85afc66b48f33d9603141585f1440b28ba37aec638d8ede6f1006781c4b17b6c02

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\filespam.vbs

Filesize
648B

MD5
11bc6610e214e09e769476b5d1160b06

SHA1
05212577332d4166fe7d74f9be35ef95d13cd8ab

SHA256
032519e1b086e57a3131acae26fe336e4931eb344a8b640dbb18907c06785877

SHA512
f5448e28f3a92cfc2308fcaa8c8c41ba9b0eabe72f1e9ac8e52c0a49a4e076439f03c5218261ad84cc55dee550d25f23daee9c3cadf5e4c341163b8a14ed0c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\lua.vbs

Filesize
1KB

MD5
bfd5d34c9e0150abe035e0ffe97bf230

SHA1
294bd7a91a93f864803254c5a3b561786d3ea049

SHA256
31d30db3872d7f86ac7fae2e882eac5100ae0404fadba0846ffe0de95ff4a98c

SHA512
d6355bc4b6ea4542a56c70610ea56ec13dac5ca7242f44bcb16b6233b9666dc016ba1ba9f01c32e44e2c726e29189d55f8c4f338ef392d02312a072a43fc6049

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\move.vbs

Filesize
683B

MD5
b28595dd263d3588daa7b0af48bc54a7

SHA1
9b99e62edff53d4d1598e8e1d554f1f45b789dac

SHA256
040ad46ed6f9d38babffcb99a70291307dda79605f2e66de19935be6dea5fa78

SHA512
93536fb265bd8961e9794c3a82cc8545e7704432432d6a8596a3ee1cee7c4203a430aa581b16b2a47383dd3aa3fd3232e10e654e48f91d7291eb7d4ba1f359ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\noexecution.vbs

Filesize
1KB

MD5
646c51d14238c5b0bc834ae6fa892082

SHA1
80270799f10caa3b4eea579ac394ebd12858b9b2

SHA256
ed30559835994deb69050712342a71d2268f0bc3796b172be2ed1276eb1d3a11

SHA512
e41d6b2626ad88fdbe92755bf673029be7c1d1d407d8e828c0ed7284374bace261a24fd3fa5dfd0ddcee7bc15613040da4eda4b33749ffaaef8878148e75525d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\run.vbs

Filesize
13B

MD5
b0e7ecf4de2a4f52cd7d7467f4303980

SHA1
f3d9eabf8d75bf40970b012a6d1a55333ef82cfa

SHA256
879b81335ae8b36a68c8630095717f3b937bd02e3f46e2ad1d8129d6f74190a0

SHA512
5eb49e4099a153865751baeda7ed0064f21541d75e94b02ab493984e8c7cf909aa32ea953aa6e79b2b3785257cfec93c628f13d354ef103838d47c9669f6d7f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\wallpaper.vbs

Filesize
314B

MD5
e68c1c77515b1cd293edff0c6464894b

SHA1
c810e79433d0b5ea9068e2c8cb89df373aac05d0

SHA256
e33dcddef15590c301a35d73840857bfb48e82c7bf1a84d14f8d9dd289facff4

SHA512
d50e81dfea22d8d3e72cfe35f93518274138310aa6b58bf2ee6b9a3d8231173e4fdfd92e6b6902e258f16f60cd53cbd97634e28da763765e444143f19862a4fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\NOTIFY.vbs

Filesize
278B

MD5
63f9c18195cff5a156f72474002dced3

SHA1
562a55b912d32dd4c06d36bcbed8846bed3e6d50

SHA256
7e8c9eda7ff726f1c9c79eed3272ad9479aa4711731e0c6a14a90765c3d85fce

SHA512
f8cd16c91006c878239393e05acb9dc56f0025cac7184761a70a35575178d2fc53132967504466c9fc8af7afd78964ad704cc165a804be95cac5f2bfe0bb27bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\Payloads\controller.vbs

Filesize
301B

MD5
ebadb2ab66b840df5e357a4d90d045f6

SHA1
17814aa6695eaf3873334bf13159a47114f496a0

SHA256
6737f36eb79f40a3f09e21cfae7ff470a3bad6ee4113ca4260f6305ed0c0a3b7

SHA512
0b6ccbca86873d8f2ead7d0d609d1c355316e580dfc1d7505d87ffd288ab16c90682866f1460ebb3a3b6969d7719edc0d787170ef48b970d42c528c23d85cb3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\Payloads\files\keyboard.vbs

Filesize
324B

MD5
74bc797c1f089c14b9123ec32db15f55

SHA1
682447fa35f18d3cc8b48db35c51491f8eb1524b

SHA256
25d003af891ed63661240c4026970d95ced83f16f93852009aab82cd60b85766

SHA512
61cda93ab244ab8f47506efff413cb1a3d36b465f89fba70995bd5c432e3112c644d3141710d65aa6fb088cfc0d6c376509eef23c41cffe4c9d17d5e0a76ac97

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\Payloads\files\mouse.vbs

Filesize
1012B

MD5
bdb6f1ee08752fd52954246980540592

SHA1
342ab530ad7145ab87d6ecde1e51a42d78169baa

SHA256
f3e1f52c1448289fe671d24c7fb43c88185f8810803cd2a3a65cece18d473ca3

SHA512
1ebd63311d1535dffc2491e65984d6171226946cf353627448fa8804f75f153b6ad6521a7a9b36bc5b117e5370de39aee7cea0856d7a4efc4f452830c2dbda7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\Payloads\files\web.vbs

Filesize
2KB

MD5
c030b1380446596e199e5c1c9f3676b1

SHA1
17c1ede8a396d901308e37856980fcc256ac2b37

SHA256
fb77ae51f0cc65c8369999a34b79faf6d0842d77728e6a07a0aa63d97b9c8a9c

SHA512
cb9dc956ec464307d092ec5a1479ea46f68140e2a121ea242974e19374780443d40ecb49d66b087a8dc1babc678cd9b175922a68bc9db4c89e082fc6737bb71f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\create.vbs

Filesize
364B

MD5
113bf1c19ca6794d8abe806f68a6c027

SHA1
ef087a17b8cbb4701a487c99e15696db3541c9ae

SHA256
564d5a92467424f9779dcbbf16a534e8f0b980dacc2bed352e65d3fed9cae6d2

SHA512
08985811849b3f8dbf9c7b1fd3a13541ce974de9c0e7570acaf00d5a768e30cd496ca6a5ada243a97bca426fff8a4914f4e199b4fbc6ba9c7b4c9c1201a2f792

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\disableregedit.vbs

Filesize
557B

MD5
13e14305c9e6147fb03cc617cf7c21de

SHA1
a139b45d72dfb0806d2131a4bca3c64c0d032902

SHA256
72cd09c057c3e8f4502679ac58c477f9177089384409f93af723a6bb5cf3e4b6

SHA512
d62d1a2ae1a484355d1ed210457917b920bd92e674c4732e07d33a44b7e54d2ca7d1b93a4300e362dc5fcdc082edb7e387e77a5b627ff7118617ba6956721d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\disabletaskmgr.vbs

Filesize
551B

MD5
b1f2e196820905ba24ce44687e0622ab

SHA1
d1830d5960a8e6c4c1fe6120e45ee362c6015eb5

SHA256
5f2babe4f208ba37210d370f6bfa301873bf223994f6b75d0c5dd4304411b6e1

SHA512
0d178fe9e8612df36de685872757cffc7a85a728107bb00b5c36489738208a85afc66b48f33d9603141585f1440b28ba37aec638d8ede6f1006781c4b17b6c02

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\main.cmd

Filesize
7B

MD5
cac0393ea755cef2c9c4a1de4ae2b7c9

SHA1
b76f1621fee955de910d2cc4d2ca4bcd4d7fa90d

SHA256
fdcfa4303a6d42883dcb9df611c4fb2da7053c7e28308be43fae800a73e4452f

SHA512
76bc553f851eada32556d64066094f03f26a735587f65d9cceb2b2197082b3a56d75e244b152a276c07d0abeef8102888b1934b4aed6b2769e579d690012c439

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\noexecution.vbs

Filesize
1KB

MD5
646c51d14238c5b0bc834ae6fa892082

SHA1
80270799f10caa3b4eea579ac394ebd12858b9b2

SHA256
ed30559835994deb69050712342a71d2268f0bc3796b172be2ed1276eb1d3a11

SHA512
e41d6b2626ad88fdbe92755bf673029be7c1d1d407d8e828c0ed7284374bace261a24fd3fa5dfd0ddcee7bc15613040da4eda4b33749ffaaef8878148e75525d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\run.cmd

Filesize
161B

MD5
359a01b70694d3ddc901d62321354f27

SHA1
20b872b35c68c0459c538e688ff015143b742ea9

SHA256
51bd209535ceabfc24e40a26ffad0b2b88cc0ace16640103f7cdf12dc4ebec19

SHA512
ac7db786908ef5e747b082fc29b5e30b40d059266002626f878e6e9f5a2861055a87f92a9b5c30b698178be52698b1067cf7ff5c7e8e323e78a16a7304e77752

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\run.exe

Filesize
184KB

MD5
c6dc3b3fded8cca8e6c7fb64861ab49b

SHA1
f411274067e521d274c5bdc3101deccc5aff944f

SHA256
e7389ceaeb6b3c4d5b3c39c0d02f170385b6f38642fde3d77dc0e0cbb90d632b

SHA512
19ba46e322206cadce46ac43a012bb10ffe3f45ce1fdced2647ee72a0f58e4beb57612aa03c93b8b33b6a18730b2accceb74ea910eafc7f19ef458990942c521

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\assets\winnt32\winnt32.exe

Filesize
184KB

MD5
9dbfbe925f2ef2a0999a5b2f1270648c

SHA1
3376886ec775ff5d2e7544a9108b4797d12756fb

SHA256
b97c4ae27e846835d88f355ca36a1cae597477dee89674512cf34b5bac5bbea8

SHA512
36dbb1fd6ec5234d15e2c2f46659e2836752cb26e8b4fe91d3dc3388b93df401f318dd5aaed331a4d0ab4990facf866c06341b5e381f97c7477cbc9f785d35e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.vbs

Filesize
1KB

MD5
26890fa4f1b6d9a2ca637d0e3daf38ab

SHA1
2e761394318d3152aee9dcbe19b7f5c008307cbd

SHA256
82d8f95b1365f7fe994afa2157afc4f0b8f1ba98f5704a51d97e4e90f6c0c2cc

SHA512
cf821fb7dee819679efa2f73453b14ec698c4512910bd299eacebffcb1bd0e17a7685cb56bc56ad9daa1029c4291fe7e64ab93e5688fa72069c61c4ce6df2f3d

Download Submit
C:\Users\Admin\Desktop\BCIDANROVCERLJDSYNCTKMMFICPEYC

Filesize
81B

MD5
669b102010a3bf4f4993c9adf20623ba

SHA1
72ba13c8e54d541998aed83158e098adea8a6c1c

SHA256
e9df24c12aef74cfbb8550aab603a1fbebb83755a4420bc425f2192c46a92352

SHA512
2f2e86be4654d904bb6405054bc245da81e733907a7a1732a97d5bb98014567d66d64dfcb99fa91dfb6fa26e546f4e2d08ae91c1cc132a56e46eb387630b6e3b

Download Submit
C:\Windows\winnt32\NOTIFY.vbs

Filesize
278B

MD5
63f9c18195cff5a156f72474002dced3

SHA1
562a55b912d32dd4c06d36bcbed8846bed3e6d50

SHA256
7e8c9eda7ff726f1c9c79eed3272ad9479aa4711731e0c6a14a90765c3d85fce

SHA512
f8cd16c91006c878239393e05acb9dc56f0025cac7184761a70a35575178d2fc53132967504466c9fc8af7afd78964ad704cc165a804be95cac5f2bfe0bb27bb

Download Submit
C:\Windows\winnt32\Payloads\controller.vbs

Filesize
301B

MD5
ebadb2ab66b840df5e357a4d90d045f6

SHA1
17814aa6695eaf3873334bf13159a47114f496a0

SHA256
6737f36eb79f40a3f09e21cfae7ff470a3bad6ee4113ca4260f6305ed0c0a3b7

SHA512
0b6ccbca86873d8f2ead7d0d609d1c355316e580dfc1d7505d87ffd288ab16c90682866f1460ebb3a3b6969d7719edc0d787170ef48b970d42c528c23d85cb3f

Download Submit
C:\Windows\winnt32\Payloads\files\keyboard.vbs

Filesize
324B

MD5
74bc797c1f089c14b9123ec32db15f55

SHA1
682447fa35f18d3cc8b48db35c51491f8eb1524b

SHA256
25d003af891ed63661240c4026970d95ced83f16f93852009aab82cd60b85766

SHA512
61cda93ab244ab8f47506efff413cb1a3d36b465f89fba70995bd5c432e3112c644d3141710d65aa6fb088cfc0d6c376509eef23c41cffe4c9d17d5e0a76ac97

Download Submit
C:\Windows\winnt32\Payloads\files\mouse.vbs

Filesize
1012B

MD5
bdb6f1ee08752fd52954246980540592

SHA1
342ab530ad7145ab87d6ecde1e51a42d78169baa

SHA256
f3e1f52c1448289fe671d24c7fb43c88185f8810803cd2a3a65cece18d473ca3

SHA512
1ebd63311d1535dffc2491e65984d6171226946cf353627448fa8804f75f153b6ad6521a7a9b36bc5b117e5370de39aee7cea0856d7a4efc4f452830c2dbda7e

Download Submit
C:\Windows\winnt32\Payloads\files\web.vbs

Filesize
2KB

MD5
c030b1380446596e199e5c1c9f3676b1

SHA1
17c1ede8a396d901308e37856980fcc256ac2b37

SHA256
fb77ae51f0cc65c8369999a34b79faf6d0842d77728e6a07a0aa63d97b9c8a9c

SHA512
cb9dc956ec464307d092ec5a1479ea46f68140e2a121ea242974e19374780443d40ecb49d66b087a8dc1babc678cd9b175922a68bc9db4c89e082fc6737bb71f

Download Submit
C:\Windows\winnt32\create.vbs

Filesize
364B

MD5
113bf1c19ca6794d8abe806f68a6c027

SHA1
ef087a17b8cbb4701a487c99e15696db3541c9ae

SHA256
564d5a92467424f9779dcbbf16a534e8f0b980dacc2bed352e65d3fed9cae6d2

SHA512
08985811849b3f8dbf9c7b1fd3a13541ce974de9c0e7570acaf00d5a768e30cd496ca6a5ada243a97bca426fff8a4914f4e199b4fbc6ba9c7b4c9c1201a2f792

Download Submit
C:\Windows\winnt32\disableregedit.vbs

Filesize
557B

MD5
13e14305c9e6147fb03cc617cf7c21de

SHA1
a139b45d72dfb0806d2131a4bca3c64c0d032902

SHA256
72cd09c057c3e8f4502679ac58c477f9177089384409f93af723a6bb5cf3e4b6

SHA512
d62d1a2ae1a484355d1ed210457917b920bd92e674c4732e07d33a44b7e54d2ca7d1b93a4300e362dc5fcdc082edb7e387e77a5b627ff7118617ba6956721d16

Download Submit
C:\Windows\winnt32\disabletaskmgr.vbs

Filesize
551B

MD5
b1f2e196820905ba24ce44687e0622ab

SHA1
d1830d5960a8e6c4c1fe6120e45ee362c6015eb5

SHA256
5f2babe4f208ba37210d370f6bfa301873bf223994f6b75d0c5dd4304411b6e1

SHA512
0d178fe9e8612df36de685872757cffc7a85a728107bb00b5c36489738208a85afc66b48f33d9603141585f1440b28ba37aec638d8ede6f1006781c4b17b6c02

Download Submit
C:\Windows\winnt32\noexecution.vbs

Filesize
1KB

MD5
646c51d14238c5b0bc834ae6fa892082

SHA1
80270799f10caa3b4eea579ac394ebd12858b9b2

SHA256
ed30559835994deb69050712342a71d2268f0bc3796b172be2ed1276eb1d3a11

SHA512
e41d6b2626ad88fdbe92755bf673029be7c1d1d407d8e828c0ed7284374bace261a24fd3fa5dfd0ddcee7bc15613040da4eda4b33749ffaaef8878148e75525d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads