Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2023 11:24
Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10v2004-20230621-en
General
-
Target
Server.exe
-
Size
37KB
-
MD5
0ceb4f5cf4dde9a4641c6575f78f72ab
-
SHA1
eb9f46fc0fafd4fd80321444ce642529366534de
-
SHA256
d9be23f04b3af31b16247e792983bd73bf6016c05822614afe545b9f7c291a79
-
SHA512
3f08b4c2f6b7c4c76f27b73a0e1ac911352c70ebd26b13da11ef64591bd3111b9d253f466815d89960c3bf103afb0d5d9561237a1d250593521355babd87915e
-
SSDEEP
384:sNQCT0i9HdTe/kCOyU73oflQDXSikrAF+rMRTyN/0L+EcoinblneHQM3epzXqNrJ:yVt1CFU73oSDSPrM+rMRa8NuA9t
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Server.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Control Panel\International\Geo\Nation Server.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dwm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dwm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
Processes:
dwm.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe -
Suspicious use of AdjustPrivilegeToken 39 IoCs
Processes:
Server.exedwm.exedescription pid process Token: SeDebugPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: SeCreateGlobalPrivilege 10464 dwm.exe Token: SeChangeNotifyPrivilege 10464 dwm.exe Token: 33 10464 dwm.exe Token: SeIncBasePriorityPrivilege 10464 dwm.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe Token: 33 1256 Server.exe Token: SeIncBasePriorityPrivilege 1256 Server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Server.execmd.exedescription pid process target process PID 1256 wrote to memory of 3328 1256 Server.exe netsh.exe PID 1256 wrote to memory of 3328 1256 Server.exe netsh.exe PID 1256 wrote to memory of 3328 1256 Server.exe netsh.exe PID 1256 wrote to memory of 3668 1256 Server.exe cmd.exe PID 1256 wrote to memory of 3668 1256 Server.exe cmd.exe PID 1256 wrote to memory of 3668 1256 Server.exe cmd.exe PID 3668 wrote to memory of 4536 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4536 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4536 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4320 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4320 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4320 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1852 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1852 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1852 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 3256 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 3256 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 3256 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1288 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1288 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1288 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2012 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2012 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2012 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2040 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2040 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2040 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1096 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1096 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1096 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2740 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2740 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2740 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 3608 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 3608 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 3608 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1588 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1588 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1588 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1268 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1268 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1268 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2592 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2592 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2592 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2620 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2620 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2620 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4896 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4896 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4896 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 5060 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 5060 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 5060 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4560 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4560 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 4560 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2744 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2744 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 2744 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1664 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1664 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 1664 3668 cmd.exe cmd.exe PID 3668 wrote to memory of 832 3668 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC890.tmp.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4536
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4320
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:3256
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1288
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1852
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:2012
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:2040
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1096
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:2740
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:3608
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1268
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1404
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4612
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4952
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:832
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1664
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:2744
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4560
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5060
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4896
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:2620
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:2592
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1588
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1340
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:2420
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:796
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4676
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5104
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:208
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:544
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:3428
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1048
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4236
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1072
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:3812
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:3260
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4836
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:2804
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:1168
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4380
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:2900
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:400
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4244
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:2056
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4912
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5144
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5180
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5132
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5244
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5280
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5308
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5348
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5364
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5448
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5492
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5528
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5556
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5660
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5676
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5372
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5336
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5688
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5776
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5768
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5760
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5744
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5728
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5704
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:5696
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6184
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6208
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6200
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6244
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6352
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6368
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6376
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6540
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6532
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6476
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6424
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6408
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6392
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6384
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6812
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6832
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6860
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6900
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6932
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6848
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6840
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7124
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7148
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7132
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6284
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:6660
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4112
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7188
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7216
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7180
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:4408
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7368
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7376
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7392
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7428
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7472
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7508
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7680
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7700
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7656
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7760
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7752
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7640
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7632
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7824
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8000
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:7984
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8044
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8096
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8160
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8064
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8056
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8032
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8232
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8248
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8272
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8312
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8292
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8356
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8496
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8504
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8536
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8564
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8592
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8620
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8520
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8804
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8816
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8840
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8876
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8984
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9000
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9012
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9052
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9040
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9024
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8584
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:8828
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9064
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9288
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9392
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9976
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:10052
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:10044
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:10028
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:10020
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:10012
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:10004
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9996
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9988
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9960
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9944
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9936
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9920
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9904
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9888
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9872
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9856
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9840
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9824
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9816
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9800
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9792
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9784
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9776
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9768
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9760
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9752
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9744
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9736
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9728
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9720
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9712
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9704
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9696
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9688
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9680
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9672
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9664
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9656
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9648
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9640
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9632
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9624
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9616
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9608
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9600
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9592
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9584
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9576
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9568
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9560
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9552
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9544
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9536
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9528
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9520
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9512
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9504
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9496
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9488
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9480
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9472
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9464
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:12044
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9456
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9448
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9440
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9424
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9416
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9404
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9384
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9376
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9368
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9360
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9352
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9344
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9336
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9328
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9320
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9312
-
C:\Windows\SysWOW64\cmd.execmd.exe3⤵PID:9304
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10464
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC890.tmp.batFilesize
32B
MD5c5b1ee6c47dc070b5caba3c8c615b293
SHA1de52c2c615e5f712dc24ce9360779518e462cd89
SHA2562780729b83c91a6fe2dc7128c12ada632f59814e7b2b249c5ce592b77ad277bb
SHA51252074ce0836ad7764fbdeea4f5709df1171d697f328e2257c5332dc6768107e169e17bd59acac55069da41443d312ac6cf83aed7fb7da4c5bec3e574d815fb9b
-
memory/1256-133-0x0000000000ED0000-0x0000000000EE0000-memory.dmpFilesize
64KB
-
memory/1256-134-0x0000000000ED0000-0x0000000000EE0000-memory.dmpFilesize
64KB
-
memory/1256-135-0x0000000000ED0000-0x0000000000EE0000-memory.dmpFilesize
64KB
-
memory/1256-136-0x0000000000ED0000-0x0000000000EE0000-memory.dmpFilesize
64KB