d9be23f04b3af31b16247e792983bd73bf6016c05822614afe545b9f7c291a79

General

Target

Server.exe
Size

37KB
MD5

0ceb4f5cf4dde9a4641c6575f78f72ab
SHA1

eb9f46fc0fafd4fd80321444ce642529366534de
SHA256

d9be23f04b3af31b16247e792983bd73bf6016c05822614afe545b9f7c291a79
SHA512

3f08b4c2f6b7c4c76f27b73a0e1ac911352c70ebd26b13da11ef64591bd3111b9d253f466815d89960c3bf103afb0d5d9561237a1d250593521355babd87915e
SSDEEP

384:sNQCT0i9HdTe/kCOyU73oflQDXSikrAF+rMRTyN/0L+EcoinblneHQM3epzXqNrJ:yVt1CFU73oSDSPrM+rMRa8NuA9t

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

3328 netsh.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Server.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Control Panel\International\Geo\Nation Server.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3328	netsh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Control Panel\International\Geo\Nation	Server.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

Server.exedwm.exe

description	pid	process
Token: SeDebugPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: SeCreateGlobalPrivilege	10464	dwm.exe
Token: SeChangeNotifyPrivilege	10464	dwm.exe
Token: 33	10464	dwm.exe
Token: SeIncBasePriorityPrivilege	10464	dwm.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe
Token: 33	1256	Server.exe
Token: SeIncBasePriorityPrivilege	1256	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Server.execmd.exe

description	pid	process	target process
PID 1256 wrote to memory of 3328	1256	Server.exe	netsh.exe
PID 1256 wrote to memory of 3328	1256	Server.exe	netsh.exe
PID 1256 wrote to memory of 3328	1256	Server.exe	netsh.exe
PID 1256 wrote to memory of 3668	1256	Server.exe	cmd.exe
PID 1256 wrote to memory of 3668	1256	Server.exe	cmd.exe
PID 1256 wrote to memory of 3668	1256	Server.exe	cmd.exe
PID 3668 wrote to memory of 4536	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4536	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4536	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4320	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4320	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4320	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1852	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1852	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1852	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 3256	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 3256	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 3256	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1288	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1288	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1288	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2012	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2012	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2012	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2040	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2040	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2040	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1096	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1096	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1096	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2740	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2740	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2740	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 3608	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 3608	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 3608	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1588	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1588	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1588	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1268	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1268	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1268	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2592	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2592	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2592	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2620	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2620	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2620	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4896	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4896	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4896	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 5060	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 5060	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 5060	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4560	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4560	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 4560	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2744	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2744	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 2744	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1664	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1664	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 1664	3668	cmd.exe	cmd.exe
PID 3668 wrote to memory of 832	3668	cmd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:3328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC890.tmp.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:3668

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4536

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4320

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:3256

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1852

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1096

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:3608

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1268

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1404

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4612

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4952

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1664

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4560

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5060

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4896

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:2620

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:2592

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1588

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1340

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:2420

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:796

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4676

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5104

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:208

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:544

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:3428

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1048

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4236

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1072

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:3812

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:3260

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4836

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:1168

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4380

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:2900

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:400

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4244

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:2056

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4912

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5144

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5180

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5132

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5244

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5280

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5308

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5348

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5364

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5448

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5492

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5528

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5556

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5660

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5676

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5372

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5336

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5688

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5776

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5768

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5760

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5744

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5728

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5704

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:5696

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6184

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6208

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6200

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6244

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6352

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6368

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6376

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6540

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6532

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6476

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6424

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6408

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6392

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6384

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6812

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6832

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6860

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6900

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6932

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6848

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6840

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7124

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7148

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7132

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6284

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:6660

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4112

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7188

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7216

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7180

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:4408

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7368

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7376

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7392

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7428

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7472

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7508

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7680

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7700

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7656

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7760

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7752

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7640

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7632

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7824

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8000

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:7984

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8044

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8096

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8160

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8064

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8056

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8032

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8232

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8248

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8272

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8312

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8292

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8356

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8496

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8504

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8536

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8564

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8592

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8620

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8520

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8804

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8816

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8840

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8876

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8984

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9000

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9012

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9052

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9040

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9024

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8584

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:8828

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9064

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9288

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9392

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9976

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:10052

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:10044

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:10028

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:10020

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:10012

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:10004

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9996

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9988

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9960

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9944

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9936

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9920

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9904

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9888

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9872

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9856

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9840

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9824

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9816

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9800

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9792

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9784

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9776

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9768

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9760

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9752

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9744

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9736

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9728

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9720

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9712

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9704

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9696

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9688

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9680

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9672

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9664

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9656

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9648

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9640

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9632

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9624

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9616

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9608

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9600

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9592

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9584

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9576

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9568

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9560

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9552

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9544

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9536

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9528

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9520

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9512

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9504

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9496

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9488

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9480

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9472

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9464

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:12044

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9456

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9448

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9440

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9424

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9416

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9404

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9384

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9376

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9368

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9360

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9352

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9344

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9336

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9328

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9320

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9312

C:\Windows\SysWOW64\cmd.exe
cmd.exe
3⤵
PID:9304

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10464

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC890.tmp.bat
Filesize
32B

MD5
c5b1ee6c47dc070b5caba3c8c615b293

SHA1
de52c2c615e5f712dc24ce9360779518e462cd89

SHA256
2780729b83c91a6fe2dc7128c12ada632f59814e7b2b249c5ce592b77ad277bb

SHA512
52074ce0836ad7764fbdeea4f5709df1171d697f328e2257c5332dc6768107e169e17bd59acac55069da41443d312ac6cf83aed7fb7da4c5bec3e574d815fb9b

Download Submit
memory/1256-133-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Filesize
64KB

Download
memory/1256-134-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Filesize
64KB

Download
memory/1256-135-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Filesize
64KB

Download
memory/1256-136-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads