Analysis
-
max time kernel
129s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2023 04:17
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
remcos
BILLETE
cactus.con-ip.com:7770
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-9927QM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Rdo. 2023-6840562-18223-1150..exepid process 2816 Rdo. 2023-6840562-18223-1150..exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3968 2384 WerFault.exe csc.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 463f6b4fe4add901 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2300243748" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395727634" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2311183667" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2300243748" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{7A14FCD6-0D88-484B-94D3-3B6DF31B221B}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31044325" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B49F27E8-1ED8-11EE-AF72-568A90FD2F1B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31044325" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31044325" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Modifies registry class 3 IoCs
Processes:
OpenWith.exefirefox.exeiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings iexplore.exe -
NTFS ADS 1 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\Downloads\Rdo. 2023-6840562-18223-1150.tar:Zone.Identifier firefox.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
firefox.exe7zG.exedescription pid process Token: SeDebugPrivilege 5088 firefox.exe Token: SeDebugPrivilege 5088 firefox.exe Token: SeDebugPrivilege 5088 firefox.exe Token: SeRestorePrivilege 4972 7zG.exe Token: 35 4972 7zG.exe Token: SeSecurityPrivilege 4972 7zG.exe Token: SeSecurityPrivilege 4972 7zG.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
iexplore.exefirefox.exe7zG.exepid process 1912 iexplore.exe 1912 iexplore.exe 5088 firefox.exe 5088 firefox.exe 5088 firefox.exe 5088 firefox.exe 4972 7zG.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 5088 firefox.exe 5088 firefox.exe 5088 firefox.exe -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
iexplore.exeIEXPLORE.EXEOpenWith.exefirefox.exepid process 1912 iexplore.exe 1912 iexplore.exe 312 IEXPLORE.EXE 312 IEXPLORE.EXE 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 4800 OpenWith.exe 5088 firefox.exe 5088 firefox.exe 5088 firefox.exe 5088 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exeOpenWith.exefirefox.exefirefox.exedescription pid process target process PID 1912 wrote to memory of 312 1912 iexplore.exe IEXPLORE.EXE PID 1912 wrote to memory of 312 1912 iexplore.exe IEXPLORE.EXE PID 1912 wrote to memory of 312 1912 iexplore.exe IEXPLORE.EXE PID 4800 wrote to memory of 2416 4800 OpenWith.exe firefox.exe PID 4800 wrote to memory of 2416 4800 OpenWith.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 2416 wrote to memory of 5088 2416 firefox.exe firefox.exe PID 5088 wrote to memory of 4756 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4756 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe PID 5088 wrote to memory of 4792 5088 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://docs.google.com/uc?export=download&id=1mISRevPn4CJ8Q8HnBkUDfpSSiO4oWsIp1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1ERYC57B\Rdo. 2023-6840562-18223-1150.tar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1ERYC57B\Rdo. 2023-6840562-18223-1150.tar"3⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5088.0.1376753307\1665637229" -parentBuildID 20221007134813 -prefsHandle 1848 -prefMapHandle 1844 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30e6efcc-c266-4d47-a3d4-f0c029b523d6} 5088 "\\.\pipe\gecko-crash-server-pipe.5088" 1928 1c0276db458 gpu4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5088.1.1090088029\408428189" -parentBuildID 20221007134813 -prefsHandle 2340 -prefMapHandle 2328 -prefsLen 21754 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdb96a4f-ea76-4321-ba0e-cd076cdfd3d1} 5088 "\\.\pipe\gecko-crash-server-pipe.5088" 2352 1c0275fd258 socket4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5088.2.519773409\2057553000" -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2900 -prefsLen 21857 -prefMapSize 232675 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1cf8b99-2fab-4da2-81ba-78f1c3999c63} 5088 "\\.\pipe\gecko-crash-server-pipe.5088" 2944 1c02b2f5d58 tab4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5088.3.922373891\1518663615" -childID 2 -isForBrowser -prefsHandle 3488 -prefMapHandle 3484 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0642e10-d0ff-4267-b5d0-2fae5315529f} 5088 "\\.\pipe\gecko-crash-server-pipe.5088" 3496 1c01ae64f58 tab4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5088.6.1189254781\446568381" -childID 5 -isForBrowser -prefsHandle 5264 -prefMapHandle 5268 -prefsLen 26671 -prefMapSize 232675 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02f2c1d9-b61a-4c82-b3e5-ade05aa4391e} 5088 "\\.\pipe\gecko-crash-server-pipe.5088" 5256 1c02ef30258 tab4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5088.5.1250365771\1806140096" -childID 4 -isForBrowser -prefsHandle 5064 -prefMapHandle 5068 -prefsLen 26671 -prefMapSize 232675 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {147757f7-68d8-465c-9d1c-3bb4152b7b90} 5088 "\\.\pipe\gecko-crash-server-pipe.5088" 4940 1c02dd20658 tab4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5088.4.1942757160\585283007" -childID 3 -isForBrowser -prefsHandle 4948 -prefMapHandle 4916 -prefsLen 26671 -prefMapSize 232675 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24401727-3244-415c-ad82-3158fcf3586e} 5088 "\\.\pipe\gecko-crash-server-pipe.5088" 4936 1c02d7e6358 tab4⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Rdo. 2023-6840562-18223-1150\" -spe -an -ai#7zMap27064:118:7zEvent10061⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\Rdo. 2023-6840562-18223-1150\Rdo. 2023-6840562-18223-1150..exe"C:\Users\Admin\Downloads\Rdo. 2023-6840562-18223-1150\Rdo. 2023-6840562-18223-1150..exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\Downloads\Rdo. 2023-6840562-18223-1150\Rdo. 2023-6840562-18223-1150..exe" "C:\Users\Admin\AppData\Roaming\AppData.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\Downloads\Rdo. 2023-6840562-18223-1150\Rdo. 2023-6840562-18223-1150..exe'"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 5403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2384 -ip 23841⤵
-
C:\Users\Admin\AppData\Roaming\AppData.exeC:\Users\Admin\AppData\Roaming\AppData.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1ERYC57B\Rdo. 2023-6840562-18223-1150.tar.60oiap0.partialFilesize
1.5MB
MD581891a02ce27c0aba96153c88b73b156
SHA1bfc139f4798faccbfebe910d67b5992ecdf7a961
SHA256519b6d35396d7aba15c902bc7c8a332e8e6780271a73e3fe55a40729b14ac931
SHA5121c2e7c55c058f5571e418e5cc1febffa1c4064ebc7dc1656a375769e8328d992831d7c5393c33954e29484ef5873ab41323b64e2b075d6e147f043a4ec1b62f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\42JDD8EA\Rdo.%202023-6840562-18223-1150[1].tarFilesize
1.5MB
MD581891a02ce27c0aba96153c88b73b156
SHA1bfc139f4798faccbfebe910d67b5992ecdf7a961
SHA256519b6d35396d7aba15c902bc7c8a332e8e6780271a73e3fe55a40729b14ac931
SHA5121c2e7c55c058f5571e418e5cc1febffa1c4064ebc7dc1656a375769e8328d992831d7c5393c33954e29484ef5873ab41323b64e2b075d6e147f043a4ec1b62f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\42JDD8EA\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\activity-stream.discovery_stream.json.tmpFilesize
141KB
MD5cface8a0c7004cbe9f97b9bb509d0f2c
SHA18a960277412217f6858e94d981f91dbafad95c7c
SHA256ceed9d67caaff69681977573c820db3020119700cd60e62205912729e45322bb
SHA5127e1fd87d80d0b075b07aa82854cfac4f4af5cab8a4d0201b86ca541f9383a1b1424f537010a99301a4edee98179bb1cf70c321197643f5c58d9ac5c716e4bdd3
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0Filesize
14KB
MD516b04d820c878c6ebd393c420ed558ba
SHA18aeb915f75d9763e91fa5ec00362f1844c0df51b
SHA2566c5f9e044b34cc6b1be36f508d9aa2cd6a2f82d55e865182343a881e451eeb0c
SHA5122e8dad273568f66f332b5dcf062a5cbc5d82ff6288ff4d476a349abd4cfc54e3e22ed773df358f11bbfca838f88079c4d36292f7a64d27039f9a65ce50142d7a
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4vnkwq1m.olq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpaddonFilesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dllFilesize
997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.infoFilesize
116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txtFilesize
479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\manifest.jsonFilesize
372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dllFilesize
11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.libFilesize
1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sigFilesize
1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.jsFilesize
8KB
MD525013819ceeef2b5c46bddcf43cc2907
SHA1d60b5a94f60822877adc889fe36ef1f4308709db
SHA256ab27944b0a7e76a622231678496d12d7f4eb0a22f9f6faf9a6e4c52c1a164e95
SHA5124a6280b713eb1b9fcd02d8659592d756130240f16717dab86e1ef75066200d502899edf18de2cfbc8ab6e6256f6387b73692234ddcc533fbbf2e34036388eef2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.jsFilesize
7KB
MD54b3b79e4271ef040a5ff797992debd97
SHA1c9a3387d6e7af636f5f8aac26968e7734de9b752
SHA25620c0a20693b9f2a325a8bc8602c60f01235150aedb5ae74a67e8c6dc31cf7c0c
SHA512c051f925ad9e1d5511b6342b4c91a0af2c9974a31ce635fd8076d553aadb38c09cb38e4fbcc9c50bd0de91920cbc1924b49753bb86603e42cf40f32ef4ea56fa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1003B
MD578ef1e96f263a8948a079b12ce2243d7
SHA16700aef576fac9e5323d8c2948e8b910583d3cbe
SHA25642b08a6674a3306657ea7e8b1a2213b94adf507a40a470af521386ef289ef491
SHA512128791a1eedee22226739c08bb996a796ccb4848eab9cf323616d56962f8371590f417ac7bb0470a6c7a9835313206ec6d7b74aa51dec18724945399e9c8581c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteFilesize
1.3MB
MD5983e2ba9e4df8218f385c392a5d00556
SHA1a9c8e7f06611dbf3a7771410811d3fb3e8a3e912
SHA256b5b45565c736422fba96b0b978701ebbaad24105a9aab213f5ab73c4cc9a88da
SHA512b3b731e9f8eb8578499e12065620e1458dfba331548644653931400d742a31c6898a55675c4af4ac064156a553ed7362a8ff1fb3146d652f8b5178994e331090
-
C:\Users\Admin\Downloads\Rdo. 2023-6840562-18223-1150.tarFilesize
1.5MB
MD581891a02ce27c0aba96153c88b73b156
SHA1bfc139f4798faccbfebe910d67b5992ecdf7a961
SHA256519b6d35396d7aba15c902bc7c8a332e8e6780271a73e3fe55a40729b14ac931
SHA5121c2e7c55c058f5571e418e5cc1febffa1c4064ebc7dc1656a375769e8328d992831d7c5393c33954e29484ef5873ab41323b64e2b075d6e147f043a4ec1b62f6
-
C:\Users\Admin\Downloads\Rdo. 2023-6840562-18223-1150\Rdo. 2023-6840562-18223-1150..exeFilesize
91.9MB
MD5e6c89c72eb6dade08fed6b0fbe0176da
SHA159958cc0aaf06a3dfeacff1b98d69cd51f2c4bfe
SHA2560299b006f59367901ffd3f227ddb91a221ec234a14417f851e1bf25282837b83
SHA51260fece85866343e7e9d90cb928f5c66422595ef79a6cfe5306bf8a9032dbec615005660483d11b450cb6e7b40093fa4a7670d2ac3e95dc4f92d5cf5441ed596c
-
C:\Users\Admin\Downloads\Rdo. 2023-6840562-18223-1150\Rdo. 2023-6840562-18223-1150..exeFilesize
91.8MB
MD5250e671469d0f3867cc9334cd365ad40
SHA1e3d4b4c5e09567ee8499f70eabe4c3e54a0a7d96
SHA256c59cf4fee6a44e0d884fec46875c572f4b3b589ff761d78817db4cdec6dbeb0f
SHA51274812f01def797711e88034ae4c992d8aec572fc578c58c2c959ff27de79d4787a20d327598cadd5f9516428c3d8192abba72d04f58a090431dd030141b12092
-
memory/2384-297-0x0000000000800000-0x0000000000880000-memory.dmpFilesize
512KB
-
memory/2384-292-0x0000000000800000-0x0000000000880000-memory.dmpFilesize
512KB
-
memory/2384-285-0x0000000000800000-0x0000000000880000-memory.dmpFilesize
512KB
-
memory/2816-282-0x0000000005C90000-0x0000000006234000-memory.dmpFilesize
5.6MB
-
memory/2816-281-0x0000000000B30000-0x0000000000C62000-memory.dmpFilesize
1.2MB
-
memory/4652-312-0x0000000006540000-0x000000000655E000-memory.dmpFilesize
120KB
-
memory/4652-329-0x0000000007EF0000-0x000000000856A000-memory.dmpFilesize
6.5MB
-
memory/4652-330-0x00000000078B0000-0x00000000078CA000-memory.dmpFilesize
104KB
-
memory/4652-331-0x0000000007930000-0x000000000793A000-memory.dmpFilesize
40KB
-
memory/4652-332-0x0000000007B20000-0x0000000007BB6000-memory.dmpFilesize
600KB
-
memory/4652-333-0x0000000007AE0000-0x0000000007AEE000-memory.dmpFilesize
56KB
-
memory/4652-334-0x0000000007BE0000-0x0000000007BFA000-memory.dmpFilesize
104KB
-
memory/4652-335-0x0000000007BD0000-0x0000000007BD8000-memory.dmpFilesize
32KB
-
memory/4652-327-0x0000000003000000-0x0000000003010000-memory.dmpFilesize
64KB
-
memory/4652-328-0x000000007F490000-0x000000007F4A0000-memory.dmpFilesize
64KB
-
memory/4652-326-0x0000000006B10000-0x0000000006B2E000-memory.dmpFilesize
120KB
-
memory/4652-316-0x000000006FBE0000-0x000000006FC2C000-memory.dmpFilesize
304KB
-
memory/4652-315-0x0000000006B50000-0x0000000006B82000-memory.dmpFilesize
200KB
-
memory/4652-307-0x0000000005F90000-0x0000000005FF6000-memory.dmpFilesize
408KB
-
memory/4652-301-0x0000000005EB0000-0x0000000005F16000-memory.dmpFilesize
408KB
-
memory/4652-300-0x0000000003000000-0x0000000003010000-memory.dmpFilesize
64KB
-
memory/4652-299-0x0000000003000000-0x0000000003010000-memory.dmpFilesize
64KB
-
memory/4652-298-0x00000000055F0000-0x0000000005612000-memory.dmpFilesize
136KB
-
memory/4652-287-0x0000000005730000-0x0000000005D58000-memory.dmpFilesize
6.2MB
-
memory/4652-283-0x0000000003010000-0x0000000003046000-memory.dmpFilesize
216KB