Analysis
-
max time kernel
141s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-05-2023 17:43
Static task
static1
Behavioral task
behavioral1
Sample
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe
Resource
win7-20230220-en
General
-
Target
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe
-
Size
3.0MB
-
MD5
4b32941cd92e048e6a2d16c6069edf62
-
SHA1
5d167b4588575ffbc7a06cd9fa22552dced38951
-
SHA256
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d
-
SHA512
8b5c75642960991648fd18fb2c5421f8d082f0982a4b5950dd091547dc53943fccb287a404593fbb08282188c3c94d75e05c28f1a58f83a5b6559f34a516442e
-
SSDEEP
98304:6fFbrdnYUGkQqOSlBk1G4QBeKW0wnpTX5OIX:6fFbhBMqOxFgW3nRr
Malware Config
Extracted
aurora
94.142.138.215:8081
Signatures
-
Detects any file with a triage score of 10 4 IoCs
This file has been assigned a triage score of 10, indicating a high likelihood of malicious behavior.
Processes:
resource yara_rule behavioral1/memory/2036-55-0x0000000001090000-0x00000000018B2000-memory.dmp triage_score_10 behavioral1/memory/2036-56-0x0000000001090000-0x00000000018B2000-memory.dmp triage_score_10 behavioral1/memory/2036-58-0x0000000001090000-0x00000000018B2000-memory.dmp triage_score_10 behavioral1/memory/2036-59-0x0000000001090000-0x00000000018B2000-memory.dmp triage_score_10 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exepid process 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe 1528 powershell.exe 112 powershell.exe 1224 powershell.exe 1796 powershell.exe 1928 powershell.exe 1396 powershell.exe 1528 powershell.exe 660 powershell.exe 1180 powershell.exe 1196 powershell.exe 632 powershell.exe 320 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 1504 WMIC.exe Token: SeSecurityPrivilege 1504 WMIC.exe Token: SeTakeOwnershipPrivilege 1504 WMIC.exe Token: SeLoadDriverPrivilege 1504 WMIC.exe Token: SeSystemProfilePrivilege 1504 WMIC.exe Token: SeSystemtimePrivilege 1504 WMIC.exe Token: SeProfSingleProcessPrivilege 1504 WMIC.exe Token: SeIncBasePriorityPrivilege 1504 WMIC.exe Token: SeCreatePagefilePrivilege 1504 WMIC.exe Token: SeBackupPrivilege 1504 WMIC.exe Token: SeRestorePrivilege 1504 WMIC.exe Token: SeShutdownPrivilege 1504 WMIC.exe Token: SeDebugPrivilege 1504 WMIC.exe Token: SeSystemEnvironmentPrivilege 1504 WMIC.exe Token: SeRemoteShutdownPrivilege 1504 WMIC.exe Token: SeUndockPrivilege 1504 WMIC.exe Token: SeManageVolumePrivilege 1504 WMIC.exe Token: 33 1504 WMIC.exe Token: 34 1504 WMIC.exe Token: 35 1504 WMIC.exe Token: SeIncreaseQuotaPrivilege 1504 WMIC.exe Token: SeSecurityPrivilege 1504 WMIC.exe Token: SeTakeOwnershipPrivilege 1504 WMIC.exe Token: SeLoadDriverPrivilege 1504 WMIC.exe Token: SeSystemProfilePrivilege 1504 WMIC.exe Token: SeSystemtimePrivilege 1504 WMIC.exe Token: SeProfSingleProcessPrivilege 1504 WMIC.exe Token: SeIncBasePriorityPrivilege 1504 WMIC.exe Token: SeCreatePagefilePrivilege 1504 WMIC.exe Token: SeBackupPrivilege 1504 WMIC.exe Token: SeRestorePrivilege 1504 WMIC.exe Token: SeShutdownPrivilege 1504 WMIC.exe Token: SeDebugPrivilege 1504 WMIC.exe Token: SeSystemEnvironmentPrivilege 1504 WMIC.exe Token: SeRemoteShutdownPrivilege 1504 WMIC.exe Token: SeUndockPrivilege 1504 WMIC.exe Token: SeManageVolumePrivilege 1504 WMIC.exe Token: 33 1504 WMIC.exe Token: 34 1504 WMIC.exe Token: 35 1504 WMIC.exe Token: SeIncreaseQuotaPrivilege 596 wmic.exe Token: SeSecurityPrivilege 596 wmic.exe Token: SeTakeOwnershipPrivilege 596 wmic.exe Token: SeLoadDriverPrivilege 596 wmic.exe Token: SeSystemProfilePrivilege 596 wmic.exe Token: SeSystemtimePrivilege 596 wmic.exe Token: SeProfSingleProcessPrivilege 596 wmic.exe Token: SeIncBasePriorityPrivilege 596 wmic.exe Token: SeCreatePagefilePrivilege 596 wmic.exe Token: SeBackupPrivilege 596 wmic.exe Token: SeRestorePrivilege 596 wmic.exe Token: SeShutdownPrivilege 596 wmic.exe Token: SeDebugPrivilege 596 wmic.exe Token: SeSystemEnvironmentPrivilege 596 wmic.exe Token: SeRemoteShutdownPrivilege 596 wmic.exe Token: SeUndockPrivilege 596 wmic.exe Token: SeManageVolumePrivilege 596 wmic.exe Token: 33 596 wmic.exe Token: 34 596 wmic.exe Token: 35 596 wmic.exe Token: SeIncreaseQuotaPrivilege 596 wmic.exe Token: SeSecurityPrivilege 596 wmic.exe Token: SeTakeOwnershipPrivilege 596 wmic.exe Token: SeLoadDriverPrivilege 596 wmic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2036 wrote to memory of 2008 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 2008 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 2008 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 2008 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2008 wrote to memory of 1504 2008 cmd.exe WMIC.exe PID 2008 wrote to memory of 1504 2008 cmd.exe WMIC.exe PID 2008 wrote to memory of 1504 2008 cmd.exe WMIC.exe PID 2008 wrote to memory of 1504 2008 cmd.exe WMIC.exe PID 2036 wrote to memory of 596 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 2036 wrote to memory of 596 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 2036 wrote to memory of 596 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 2036 wrote to memory of 596 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 2036 wrote to memory of 1944 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 1944 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 1944 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 1944 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1944 wrote to memory of 1376 1944 cmd.exe WMIC.exe PID 1944 wrote to memory of 1376 1944 cmd.exe WMIC.exe PID 1944 wrote to memory of 1376 1944 cmd.exe WMIC.exe PID 1944 wrote to memory of 1376 1944 cmd.exe WMIC.exe PID 2036 wrote to memory of 1448 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 1448 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 1448 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 1448 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1448 wrote to memory of 1664 1448 cmd.exe WMIC.exe PID 1448 wrote to memory of 1664 1448 cmd.exe WMIC.exe PID 1448 wrote to memory of 1664 1448 cmd.exe WMIC.exe PID 1448 wrote to memory of 1664 1448 cmd.exe WMIC.exe PID 2036 wrote to memory of 1588 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 1588 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 1588 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 2036 wrote to memory of 1588 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1588 wrote to memory of 1960 1588 cmd.exe systeminfo.exe PID 1588 wrote to memory of 1960 1588 cmd.exe systeminfo.exe PID 1588 wrote to memory of 1960 1588 cmd.exe systeminfo.exe PID 1588 wrote to memory of 1960 1588 cmd.exe systeminfo.exe PID 2036 wrote to memory of 1528 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1528 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1528 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1528 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 112 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 112 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 112 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 112 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1224 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1224 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1224 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1224 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1796 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1796 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1796 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1796 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1928 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1928 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1928 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1928 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1396 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1396 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1396 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1396 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1528 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1528 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1528 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 2036 wrote to memory of 1528 2036 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe"C:\Users\Admin\AppData\Local\Temp\a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wmic csproduct get uuid"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\cmd.execmd "/c " systeminfo2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo3⤵
- Gathers system information
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\XVlBzgbaiC\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History\" \"C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHc\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\tcuAxhxKQFDaFpL\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFf\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\RsWxPLDnJObCsNV\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\lgTeMaPEZQ\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\leQYhYzRyWJjPjz\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\pfRFEgmota\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\FetHsbZRjxAwnwe\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\krBEmfdzdc\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\EkXBAkjQZLCtTMt\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Windows\History\" \"C:\Users\Admin\AppData\Local\Temp\TCoaNatyyi\""2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\EkXBAkjQZLCtTMtFilesize
71KB
MD5dfeffc3924409d9c9d3c8cae05be922b
SHA1a89046cbf54c00e17ff0a5f3e1a8f01eb399bce4
SHA25606ea3ad1c1c1067bfdfaa5ad8a91632fac6cad9776ded85fa65d3b6181d89be6
SHA512d9614ecf528a2bf48cafe99a4c54d5c9f3656d628001fbf575d367d5ad8008cf30a58a7b3d9489d8534064442df89a7263df4a91d0863dcd6cc33574c576da33
-
C:\Users\Admin\AppData\Local\Temp\FetHsbZRjxAwnweFilesize
71KB
MD5dfeffc3924409d9c9d3c8cae05be922b
SHA1a89046cbf54c00e17ff0a5f3e1a8f01eb399bce4
SHA25606ea3ad1c1c1067bfdfaa5ad8a91632fac6cad9776ded85fa65d3b6181d89be6
SHA512d9614ecf528a2bf48cafe99a4c54d5c9f3656d628001fbf575d367d5ad8008cf30a58a7b3d9489d8534064442df89a7263df4a91d0863dcd6cc33574c576da33
-
C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHcFilesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\Local\Temp\RsWxPLDnJObCsNVFilesize
71KB
MD5dfeffc3924409d9c9d3c8cae05be922b
SHA1a89046cbf54c00e17ff0a5f3e1a8f01eb399bce4
SHA25606ea3ad1c1c1067bfdfaa5ad8a91632fac6cad9776ded85fa65d3b6181d89be6
SHA512d9614ecf528a2bf48cafe99a4c54d5c9f3656d628001fbf575d367d5ad8008cf30a58a7b3d9489d8534064442df89a7263df4a91d0863dcd6cc33574c576da33
-
C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFfFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\krBEmfdzdcFilesize
71KB
MD5dfeffc3924409d9c9d3c8cae05be922b
SHA1a89046cbf54c00e17ff0a5f3e1a8f01eb399bce4
SHA25606ea3ad1c1c1067bfdfaa5ad8a91632fac6cad9776ded85fa65d3b6181d89be6
SHA512d9614ecf528a2bf48cafe99a4c54d5c9f3656d628001fbf575d367d5ad8008cf30a58a7b3d9489d8534064442df89a7263df4a91d0863dcd6cc33574c576da33
-
C:\Users\Admin\AppData\Local\Temp\krBEmfdzdcFilesize
71KB
MD5dfeffc3924409d9c9d3c8cae05be922b
SHA1a89046cbf54c00e17ff0a5f3e1a8f01eb399bce4
SHA25606ea3ad1c1c1067bfdfaa5ad8a91632fac6cad9776ded85fa65d3b6181d89be6
SHA512d9614ecf528a2bf48cafe99a4c54d5c9f3656d628001fbf575d367d5ad8008cf30a58a7b3d9489d8534064442df89a7263df4a91d0863dcd6cc33574c576da33
-
C:\Users\Admin\AppData\Local\Temp\leQYhYzRyWJjPjzFilesize
71KB
MD5dfeffc3924409d9c9d3c8cae05be922b
SHA1a89046cbf54c00e17ff0a5f3e1a8f01eb399bce4
SHA25606ea3ad1c1c1067bfdfaa5ad8a91632fac6cad9776ded85fa65d3b6181d89be6
SHA512d9614ecf528a2bf48cafe99a4c54d5c9f3656d628001fbf575d367d5ad8008cf30a58a7b3d9489d8534064442df89a7263df4a91d0863dcd6cc33574c576da33
-
C:\Users\Admin\AppData\Local\Temp\lgTeMaPEZQFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\pfRFEgmotaFilesize
92KB
MD59b43e176b30bab68f88ae294f9f6bc56
SHA1f2a0297791668a2d5f41c5aeb6ebfeb0b835a15b
SHA256afed81e2f90c02e3e723d744fe43ca3f02021b18c4adaccb9f5f340b71a2fea8
SHA5129c8ab7bacbc3a133e602b396c85b9beab8c6ff45b10b762e07ce993b692a8f28dcb429219a40e5457bddfa01b4820d1b4cfc43ccd614d54f2cfbf796f3b9168a
-
C:\Users\Admin\AppData\Local\Temp\tcuAxhxKQFDaFpLFilesize
71KB
MD5dfeffc3924409d9c9d3c8cae05be922b
SHA1a89046cbf54c00e17ff0a5f3e1a8f01eb399bce4
SHA25606ea3ad1c1c1067bfdfaa5ad8a91632fac6cad9776ded85fa65d3b6181d89be6
SHA512d9614ecf528a2bf48cafe99a4c54d5c9f3656d628001fbf575d367d5ad8008cf30a58a7b3d9489d8534064442df89a7263df4a91d0863dcd6cc33574c576da33
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D5OS43B8U08OYAN3KOVK.tempFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5999a72074018ae190a2eda2249df8680
SHA1945910aefaa6adefa8130d0258b12a5fe45a1992
SHA25658a9276a32f176bf03e423b0f3a0846e2e3499a7e002d6589ee30d2ce1bfa620
SHA512ac0ecd934571666a0b164a81bc17227cc6004a46ae16e0d55dc439bb913f8b99255b99fb926152b40e516c9ff6ca1724cb3822ce7185cfbcc18735d322c97f5e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/320-155-0x0000000002720000-0x0000000002760000-memory.dmpFilesize
256KB
-
memory/320-154-0x0000000002720000-0x0000000002760000-memory.dmpFilesize
256KB
-
memory/1396-106-0x0000000002490000-0x00000000024D0000-memory.dmpFilesize
256KB
-
memory/1528-68-0x00000000022F0000-0x0000000002330000-memory.dmpFilesize
256KB
-
memory/1528-115-0x0000000002740000-0x0000000002780000-memory.dmpFilesize
256KB
-
memory/1528-67-0x00000000022F0000-0x0000000002330000-memory.dmpFilesize
256KB
-
memory/1528-66-0x00000000022F0000-0x0000000002330000-memory.dmpFilesize
256KB
-
memory/1528-114-0x0000000002740000-0x0000000002780000-memory.dmpFilesize
256KB
-
memory/2036-54-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-62-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-61-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-60-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-59-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-58-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-56-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-55-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-63-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-75-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-101-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-159-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB
-
memory/2036-166-0x0000000001090000-0x00000000018B2000-memory.dmpFilesize
8.1MB