Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2023 00:12
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231020-en
General
-
Target
file.exe
-
Size
288KB
-
MD5
8df50cf52274c76c80901ea6f29ac7f3
-
SHA1
d95b8221dd9054f36775237f164bfd16bf4a4467
-
SHA256
190a3b8cb53cc76a04666d9453d30527902b0ea67d56d6462d9732b91768d106
-
SHA512
527d7c93658fa10a01a8f012ce2f6a83c29509367d14ff4e5fa2b87f41cc3663dac5c2b5ff93a3511ab0fb59e7355364b4589fa4933a860400ad7ec1fd6e32e9
-
SSDEEP
3072:usxu5M2SGMFJz+M9E251tCyCa4N1xfepQ5mgYXDR5kVyBk3eFx/RiPB:Po5DMzzZ/nCagfex5XD9+
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
amadey
4.12
http://185.172.128.19
-
install_dir
cd1f156d67
-
install_file
Utsysc.exe
-
strings_key
0dd3e5ee91b367c60c9e575983554b30
-
url_paths
/ghsdh39s/index.php
Extracted
redline
LogsDiller Cloud (Bot: @logsdillabot)
194.49.94.181:40264
Extracted
smokeloader
pub1
Extracted
djvu
http://zexeq.com/lancer/get.php
-
extension
.gycc
-
offline_id
nN1rRlTxKTPo66pmJEAHwufZ2Dhz4MsNxIlOk6t1
-
payload_url
http://brusuax.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-CDZ4hMgp2X Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0829ASdw
Signatures
-
DcRat 8 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exefile.exe44B5.exe288c47bbc1871b439df19ff4df68f076.exepid process 4176 schtasks.exe 4220 schtasks.exe 3912 schtasks.exe 1280 schtasks.exe 1864 schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\c78d5d42-d8fa-4e57-9c67-357866e6a4be\\44B5.exe\" --AutoStart" 44B5.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 288c47bbc1871b439df19ff4df68f076.exe -
Detected Djvu ransomware 12 IoCs
Processes:
resource yara_rule behavioral2/memory/4656-158-0x00000000048B0000-0x00000000049CB000-memory.dmp family_djvu behavioral2/memory/3112-159-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3112-160-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3112-157-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3112-154-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3112-177-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-204-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-205-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-206-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-207-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-208-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-265-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Glupteba payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/632-186-0x0000000002D40000-0x000000000362B000-memory.dmp family_glupteba behavioral2/memory/632-188-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/632-194-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/632-234-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/632-283-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1104-88-0x0000000000400000-0x000000000043C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
49E7.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 49E7.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
49E7.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 49E7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 49E7.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
44B5.exe5E0E.exe69E7.exe44B5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation 44B5.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation 5E0E.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation 69E7.exe Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation 44B5.exe -
Deletes itself 1 IoCs
Processes:
pid process 3192 -
Executes dropped EXE 22 IoCs
Processes:
44B5.exe49E7.exe4B7E.exe5449.exe5E0E.exe61B9.exe69E7.exe288c47bbc1871b439df19ff4df68f076.exeInstallSetup8.exeBroom.exe44B5.exeConhost.exe69E7.exe44B5.exe288c47bbc1871b439df19ff4df68f076.execsrss.exe69E7.exemstsca.exemstsca.exeinjector.exewindefender.exewindefender.exepid process 4656 44B5.exe 800 49E7.exe 4092 4B7E.exe 4980 5449.exe 3680 5E0E.exe 4016 61B9.exe 440 69E7.exe 632 288c47bbc1871b439df19ff4df68f076.exe 2696 InstallSetup8.exe 2088 Broom.exe 3112 44B5.exe 2456 Conhost.exe 216 69E7.exe 3108 44B5.exe 4544 288c47bbc1871b439df19ff4df68f076.exe 4856 csrss.exe 4128 69E7.exe 980 mstsca.exe 2228 mstsca.exe 4324 injector.exe 1744 windefender.exe 3816 windefender.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeAddInProcess32.exepid process 4684 regsvr32.exe 4256 AddInProcess32.exe 4256 AddInProcess32.exe 4256 AddInProcess32.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\49E7.exe themida C:\Users\Admin\AppData\Local\Temp\49E7.exe themida behavioral2/memory/800-47-0x00000000009C0000-0x00000000011F2000-memory.dmp themida behavioral2/memory/800-193-0x00000000009C0000-0x00000000011F2000-memory.dmp themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
44B5.exe288c47bbc1871b439df19ff4df68f076.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\c78d5d42-d8fa-4e57-9c67-357866e6a4be\\44B5.exe\" --AutoStart" 44B5.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
49E7.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 49E7.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 62 api.2ip.ua 63 api.2ip.ua 72 api.2ip.ua -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
49E7.exepid process 800 49E7.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
4B7E.exe44B5.exeConhost.exebuild2.exebuild3.exe61B9.exemstsca.exedescription pid process target process PID 4092 set thread context of 1104 4092 4B7E.exe AppLaunch.exe PID 4656 set thread context of 3112 4656 44B5.exe 44B5.exe PID 2456 set thread context of 3108 2456 Conhost.exe 44B5.exe PID 4704 set thread context of 4768 4704 build2.exe build2.exe PID 1976 set thread context of 3432 1976 build3.exe build3.exe PID 4016 set thread context of 4256 4016 61B9.exe AddInProcess32.exe PID 980 set thread context of 2228 980 mstsca.exe mstsca.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
288c47bbc1871b439df19ff4df68f076.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 288c47bbc1871b439df19ff4df68f076.exe -
Drops file in Windows directory 4 IoCs
Processes:
288c47bbc1871b439df19ff4df68f076.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 288c47bbc1871b439df19ff4df68f076.exe File created C:\Windows\rss\csrss.exe 288c47bbc1871b439df19ff4df68f076.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2424 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5449.exefile.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5449.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5449.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5449.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4176 schtasks.exe 4220 schtasks.exe 3912 schtasks.exe 1280 schtasks.exe 1864 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1216 timeout.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exe288c47bbc1871b439df19ff4df68f076.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 288c47bbc1871b439df19ff4df68f076.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 1892 file.exe 1892 file.exe 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3192 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
file.exe5449.exepid process 1892 file.exe 3192 3192 3192 3192 4980 5449.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
61B9.exe49E7.exeAppLaunch.exepowershell.exe288c47bbc1871b439df19ff4df68f076.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 4016 61B9.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 800 49E7.exe Token: SeDebugPrivilege 1104 AppLaunch.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 5040 powershell.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 632 288c47bbc1871b439df19ff4df68f076.exe Token: SeImpersonatePrivilege 632 288c47bbc1871b439df19ff4df68f076.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 3092 powershell.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 4364 powershell.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 60 powershell.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 1060 powershell.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 1712 powershell.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 2772 powershell.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeSystemEnvironmentPrivilege 4856 csrss.exe Token: SeSecurityPrivilege 2424 sc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Broom.exepid process 2088 Broom.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3192 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exe5E0E.exe4B7E.exe69E7.exeInstallSetup8.exe44B5.exe44B5.exedescription pid process target process PID 3192 wrote to memory of 4656 3192 44B5.exe PID 3192 wrote to memory of 4656 3192 44B5.exe PID 3192 wrote to memory of 4656 3192 44B5.exe PID 3192 wrote to memory of 4020 3192 regsvr32.exe PID 3192 wrote to memory of 4020 3192 regsvr32.exe PID 4020 wrote to memory of 4684 4020 regsvr32.exe regsvr32.exe PID 4020 wrote to memory of 4684 4020 regsvr32.exe regsvr32.exe PID 4020 wrote to memory of 4684 4020 regsvr32.exe regsvr32.exe PID 3192 wrote to memory of 800 3192 49E7.exe PID 3192 wrote to memory of 800 3192 49E7.exe PID 3192 wrote to memory of 800 3192 49E7.exe PID 3192 wrote to memory of 4092 3192 4B7E.exe PID 3192 wrote to memory of 4092 3192 4B7E.exe PID 3192 wrote to memory of 4092 3192 4B7E.exe PID 3192 wrote to memory of 4980 3192 5449.exe PID 3192 wrote to memory of 4980 3192 5449.exe PID 3192 wrote to memory of 4980 3192 5449.exe PID 3192 wrote to memory of 3680 3192 5E0E.exe PID 3192 wrote to memory of 3680 3192 5E0E.exe PID 3192 wrote to memory of 3680 3192 5E0E.exe PID 3192 wrote to memory of 4016 3192 61B9.exe PID 3192 wrote to memory of 4016 3192 61B9.exe PID 3192 wrote to memory of 4016 3192 61B9.exe PID 3192 wrote to memory of 440 3192 69E7.exe PID 3192 wrote to memory of 440 3192 69E7.exe PID 3192 wrote to memory of 440 3192 69E7.exe PID 3192 wrote to memory of 4620 3192 explorer.exe PID 3192 wrote to memory of 4620 3192 explorer.exe PID 3192 wrote to memory of 4620 3192 explorer.exe PID 3192 wrote to memory of 4620 3192 explorer.exe PID 3680 wrote to memory of 632 3680 5E0E.exe 288c47bbc1871b439df19ff4df68f076.exe PID 3680 wrote to memory of 632 3680 5E0E.exe 288c47bbc1871b439df19ff4df68f076.exe PID 3680 wrote to memory of 632 3680 5E0E.exe 288c47bbc1871b439df19ff4df68f076.exe PID 4092 wrote to memory of 1104 4092 4B7E.exe AppLaunch.exe PID 4092 wrote to memory of 1104 4092 4B7E.exe AppLaunch.exe PID 4092 wrote to memory of 1104 4092 4B7E.exe AppLaunch.exe PID 4092 wrote to memory of 1104 4092 4B7E.exe AppLaunch.exe PID 4092 wrote to memory of 1104 4092 4B7E.exe AppLaunch.exe PID 4092 wrote to memory of 1104 4092 4B7E.exe AppLaunch.exe PID 4092 wrote to memory of 1104 4092 4B7E.exe AppLaunch.exe PID 4092 wrote to memory of 1104 4092 4B7E.exe AppLaunch.exe PID 3192 wrote to memory of 4788 3192 explorer.exe PID 3192 wrote to memory of 4788 3192 explorer.exe PID 3192 wrote to memory of 4788 3192 explorer.exe PID 3680 wrote to memory of 2696 3680 5E0E.exe InstallSetup8.exe PID 3680 wrote to memory of 2696 3680 5E0E.exe InstallSetup8.exe PID 3680 wrote to memory of 2696 3680 5E0E.exe InstallSetup8.exe PID 440 wrote to memory of 4176 440 69E7.exe schtasks.exe PID 440 wrote to memory of 4176 440 69E7.exe schtasks.exe PID 440 wrote to memory of 4176 440 69E7.exe schtasks.exe PID 2696 wrote to memory of 2088 2696 InstallSetup8.exe Broom.exe PID 2696 wrote to memory of 2088 2696 InstallSetup8.exe Broom.exe PID 2696 wrote to memory of 2088 2696 InstallSetup8.exe Broom.exe PID 4656 wrote to memory of 3112 4656 44B5.exe 44B5.exe PID 4656 wrote to memory of 3112 4656 44B5.exe 44B5.exe PID 4656 wrote to memory of 3112 4656 44B5.exe 44B5.exe PID 4656 wrote to memory of 3112 4656 44B5.exe 44B5.exe PID 4656 wrote to memory of 3112 4656 44B5.exe 44B5.exe PID 4656 wrote to memory of 3112 4656 44B5.exe 44B5.exe PID 4656 wrote to memory of 3112 4656 44B5.exe 44B5.exe PID 4656 wrote to memory of 3112 4656 44B5.exe 44B5.exe PID 4656 wrote to memory of 3112 4656 44B5.exe 44B5.exe PID 4656 wrote to memory of 3112 4656 44B5.exe 44B5.exe PID 3112 wrote to memory of 432 3112 44B5.exe AddInProcess32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\44B5.exeC:\Users\Admin\AppData\Local\Temp\44B5.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44B5.exeC:\Users\Admin\AppData\Local\Temp\44B5.exe2⤵
- DcRat
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\c78d5d42-d8fa-4e57-9c67-357866e6a4be" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\44B5.exe"C:\Users\Admin\AppData\Local\Temp\44B5.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\44B5.exe"C:\Users\Admin\AppData\Local\Temp\44B5.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\178461c4-cb82-459a-9783-ec7174311dbf\build2.exe"C:\Users\Admin\AppData\Local\178461c4-cb82-459a-9783-ec7174311dbf\build2.exe"5⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\178461c4-cb82-459a-9783-ec7174311dbf\build2.exe"C:\Users\Admin\AppData\Local\178461c4-cb82-459a-9783-ec7174311dbf\build2.exe"6⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\178461c4-cb82-459a-9783-ec7174311dbf\build2.exe" & del "C:\ProgramData\*.dll"" & exit7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\178461c4-cb82-459a-9783-ec7174311dbf\build3.exe"C:\Users\Admin\AppData\Local\178461c4-cb82-459a-9783-ec7174311dbf\build3.exe"5⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\178461c4-cb82-459a-9783-ec7174311dbf\build3.exe"C:\Users\Admin\AppData\Local\178461c4-cb82-459a-9783-ec7174311dbf\build3.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\46D9.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\46D9.dll2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\49E7.exeC:\Users\Admin\AppData\Local\Temp\49E7.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4B7E.exeC:\Users\Admin\AppData\Local\Temp\4B7E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5449.exeC:\Users\Admin\AppData\Local\Temp\5449.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5E0E.exeC:\Users\Admin\AppData\Local\Temp\5E0E.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- DcRat
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\61B9.exeC:\Users\Admin\AppData\Local\Temp\61B9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\69E7.exeC:\Users\Admin\AppData\Local\Temp\69E7.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN 69E7.exe /TR "C:\Users\Admin\AppData\Local\Temp\69E7.exe" /F2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\69E7.exeC:\Users\Admin\AppData\Local\Temp\69E7.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\69E7.exeC:\Users\Admin\AppData\Local\Temp\69E7.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"3⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
1File and Directory Permissions Modification
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\38QC82jWDTPmFilesize
92KB
MD5985339a523cfa3862ebc174380d3340c
SHA173bf03c8f7bc58b4e28bcbfdd1c2ba52dea5dfb7
SHA25657c7f10cd97c8db447281ad0f47d4694035056e050b85b81f5a5124f461621a2
SHA512b5d34c43330f8070b3f353c826a54aecd99b7129a214913a365b66009a1a6744093bf085d3f86681ed40c714d6ebdfff40d99d7bd7a3508a0a0caed6304ac27c
-
C:\Users\Admin\AppData\LocalLow\Z60Ypi5kt4uIFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\44B5.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\44B5.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\44B5.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\44B5.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\44B5.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\46D9.dllFilesize
1.6MB
MD54164fa66f608eb71f038fa7ee6ece5bc
SHA1d879704e3d4f1ddb97cde3100962dfb684458c27
SHA256b43fbe5adf27e984234a4abff46adc22241bcb5b894ce7b518aa024a4c6556f8
SHA51235dbc13c03cb155ad920fc82de78456cc0aa174671a7ac96953693111596be2bd30e4a0d35e2002f66ddc4e3341f90c3a2d71f35607eaca4673e6a5b6b76edb0
-
C:\Users\Admin\AppData\Local\Temp\46D9.dllFilesize
1.6MB
MD54164fa66f608eb71f038fa7ee6ece5bc
SHA1d879704e3d4f1ddb97cde3100962dfb684458c27
SHA256b43fbe5adf27e984234a4abff46adc22241bcb5b894ce7b518aa024a4c6556f8
SHA51235dbc13c03cb155ad920fc82de78456cc0aa174671a7ac96953693111596be2bd30e4a0d35e2002f66ddc4e3341f90c3a2d71f35607eaca4673e6a5b6b76edb0
-
C:\Users\Admin\AppData\Local\Temp\49E7.exeFilesize
2.9MB
MD52f084751d838cb9bfcc8538401245ca6
SHA16353a9b23d8e4b50e85cd8e352d4f8d33111b9c0
SHA256c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c
SHA51293b8fc0d072f4c162267dcfe9e25e1ec5fe305f4e6e0a87dd84698ded16089430c2bda52129064efdfe22c8ea66566d85e55829837e044459c0fe7e0be55011d
-
C:\Users\Admin\AppData\Local\Temp\49E7.exeFilesize
2.9MB
MD52f084751d838cb9bfcc8538401245ca6
SHA16353a9b23d8e4b50e85cd8e352d4f8d33111b9c0
SHA256c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c
SHA51293b8fc0d072f4c162267dcfe9e25e1ec5fe305f4e6e0a87dd84698ded16089430c2bda52129064efdfe22c8ea66566d85e55829837e044459c0fe7e0be55011d
-
C:\Users\Admin\AppData\Local\Temp\4B7E.exeFilesize
1.1MB
MD5acfa549f63796da0e45b5d96755c425b
SHA1e0b9ab6d6878926c95e7ead1dd5578aec686566a
SHA2564d588cff4cf07df5dc8e999f0962c2bfc83f69e8e6ec8df6acb06eb729b26480
SHA51295d5f5c71e25aa327b723893a0aefc7545993448d7c7e99fb2aa7dfbf7f699e2e5584ab745dcb1c18867520a0bb558c0a33371709174cf1c80c0be2e7e025743
-
C:\Users\Admin\AppData\Local\Temp\4B7E.exeFilesize
1.1MB
MD5acfa549f63796da0e45b5d96755c425b
SHA1e0b9ab6d6878926c95e7ead1dd5578aec686566a
SHA2564d588cff4cf07df5dc8e999f0962c2bfc83f69e8e6ec8df6acb06eb729b26480
SHA51295d5f5c71e25aa327b723893a0aefc7545993448d7c7e99fb2aa7dfbf7f699e2e5584ab745dcb1c18867520a0bb558c0a33371709174cf1c80c0be2e7e025743
-
C:\Users\Admin\AppData\Local\Temp\5449.exeFilesize
288KB
MD5e46a2677fe5342b0876181cb1ee3bbed
SHA17e7afea9d5d259a1477b6ebe7bcd7416b315dcc5
SHA256d548abf6933d51e8542495a3c7b764316175638a9bd953870459cacc03f17fb4
SHA5121c1825a8259613542b92572272863177d46e737a65fa9f93291a47082577b537aa4648f263896ea1ee9c16fa74a777bcb2c16e25172a77117bc02a012f864c5d
-
C:\Users\Admin\AppData\Local\Temp\5449.exeFilesize
288KB
MD5e46a2677fe5342b0876181cb1ee3bbed
SHA17e7afea9d5d259a1477b6ebe7bcd7416b315dcc5
SHA256d548abf6933d51e8542495a3c7b764316175638a9bd953870459cacc03f17fb4
SHA5121c1825a8259613542b92572272863177d46e737a65fa9f93291a47082577b537aa4648f263896ea1ee9c16fa74a777bcb2c16e25172a77117bc02a012f864c5d
-
C:\Users\Admin\AppData\Local\Temp\5E0E.exeFilesize
6.4MB
MD5faa78f58b4f091f8c56ea622d8576703
SHA12bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1
SHA256464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0
SHA5123037aef0866b9957fd9f56691baa0e6557a9f46cd3695016dc3c829fc270393360b05e39fba19dc10cac06c2f51998716b3c15c57c3f0afe8c11b2a3709d467b
-
C:\Users\Admin\AppData\Local\Temp\5E0E.exeFilesize
6.4MB
MD5faa78f58b4f091f8c56ea622d8576703
SHA12bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1
SHA256464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0
SHA5123037aef0866b9957fd9f56691baa0e6557a9f46cd3695016dc3c829fc270393360b05e39fba19dc10cac06c2f51998716b3c15c57c3f0afe8c11b2a3709d467b
-
C:\Users\Admin\AppData\Local\Temp\61B9.exeFilesize
1.8MB
MD5fac406eb3a620ec45654e087f68ccd9e
SHA102c21bd71ec411685102670cd4342a332ebaade0
SHA256de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340
SHA5122668c162ccc01f61a1a9ffec6b35a0c2f64b6f0f5a724f1563b3b23460ed17faa7e64d6817f0eaf7f9c38f3a1ac4fb730351d197b9fff051f25d6e1aac4d2b11
-
C:\Users\Admin\AppData\Local\Temp\61B9.exeFilesize
1.8MB
MD5fac406eb3a620ec45654e087f68ccd9e
SHA102c21bd71ec411685102670cd4342a332ebaade0
SHA256de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340
SHA5122668c162ccc01f61a1a9ffec6b35a0c2f64b6f0f5a724f1563b3b23460ed17faa7e64d6817f0eaf7f9c38f3a1ac4fb730351d197b9fff051f25d6e1aac4d2b11
-
C:\Users\Admin\AppData\Local\Temp\69E7.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\69E7.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\69E7.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\69E7.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeFilesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kciicr5y.vfp.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\c78d5d42-d8fa-4e57-9c67-357866e6a4be\44B5.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
299KB
MD541b883a061c95e9b9cb17d4ca50de770
SHA11daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
299KB
MD541b883a061c95e9b9cb17d4ca50de770
SHA11daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
299KB
MD541b883a061c95e9b9cb17d4ca50de770
SHA11daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
-
C:\Users\Admin\AppData\Roaming\igiigigFilesize
288KB
MD5e46a2677fe5342b0876181cb1ee3bbed
SHA17e7afea9d5d259a1477b6ebe7bcd7416b315dcc5
SHA256d548abf6933d51e8542495a3c7b764316175638a9bd953870459cacc03f17fb4
SHA5121c1825a8259613542b92572272863177d46e737a65fa9f93291a47082577b537aa4648f263896ea1ee9c16fa74a777bcb2c16e25172a77117bc02a012f864c5d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD528c135dd207acfee2b458aaef30d66f7
SHA11c382049f337417dd908296e6b7f42db3a5788d4
SHA256baad40b0c754135a0038696754029efa17cb3098b635ba8b90c45ac208ea3abf
SHA51232d92a6df89ee0c555e9395f2df7ce4d6061cadc908c08cf1134af89db23af29ecb82b945e13b08e4348affdf25378f692c34a17813f6dd191d2722d90ab4dd6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD58499ac6447b38456dadf381c25eb6b7d
SHA14d9bbacf59778ac28bce84e113952cad7881acce
SHA256516d41014688c8c1e2e235987a7c65f78724d8549ae6dee6c999678c23ae765b
SHA512f7902d0afcc6ced9e7aad83bdf60bb99c080d25061a8b044ca813ae41194bd4c6cb16a2de4abacf93a5cf25d3525fa555adf3717222bc57bbc1feab793eb03ef
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD59b09b1dff16d6a10f8cafa2b73130b8d
SHA18fa09ea0d3ccfbcee69b93baf992bae7a3ee1007
SHA256c04a6f1dd1b35eb5072f9cf8e83d43cd461ab55ec01467aa0cd4e8dc4481e8b0
SHA512fffc389f8d8bc54ad844a21bc5c3443a9819ba0f4f51cb3584efe371f57d162cb38032930e5c28f78280f1b714ed67cce67eb592ad1f47ba1cf8ff31550aa668
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD56b77d2a4bf9dc1cfc76602719fd3ff41
SHA1ff76b1a9a847474d6a016bf3b814275dceb0f962
SHA256b0cc691d1ee351a30d273438945ede5f0eff4657042f8797aa4b67d9362073e0
SHA512ebd234454641d697c799a01482ea0499921b9777598d5431ed1a39f30b40029b66d6ca0d411068c3e8ad819e3a54a9b2b61e24164d0e394e839f1f92a2d8f4db
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD54074973d9da5b456cad7cedd73ae15d1
SHA1f215f58ad0752e3075f081eab1018e82227df0f4
SHA2561ab5dff5df5230aab1c4113c9ab17518ed2a62d0cd1178d713c35e30b3d75260
SHA512601848ab02705f7923f6e4c2c71afa440cad15c8f3e2ff77ccd968660238c86ab9271e5c97eabbbb4c33517f8d22b5b343ef62b13f4ea9f97332d0de3ace1f31
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/632-183-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/632-283-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/632-188-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/632-234-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/632-194-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/632-185-0x0000000002940000-0x0000000002D3E000-memory.dmpFilesize
4.0MB
-
memory/632-186-0x0000000002D40000-0x000000000362B000-memory.dmpFilesize
8.9MB
-
memory/800-42-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-28-0x00000000009C0000-0x00000000011F2000-memory.dmpFilesize
8.2MB
-
memory/800-128-0x00000000009C0000-0x00000000011F2000-memory.dmpFilesize
8.2MB
-
memory/800-130-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-193-0x00000000009C0000-0x00000000011F2000-memory.dmpFilesize
8.2MB
-
memory/800-37-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-134-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-136-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-137-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-138-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-35-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-59-0x0000000007A20000-0x0000000007A5C000-memory.dmpFilesize
240KB
-
memory/800-36-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-133-0x0000000008410000-0x0000000008476000-memory.dmpFilesize
408KB
-
memory/800-62-0x0000000007A60000-0x0000000007AAC000-memory.dmpFilesize
304KB
-
memory/800-57-0x00000000079C0000-0x00000000079D2000-memory.dmpFilesize
72KB
-
memory/800-45-0x0000000077544000-0x0000000077546000-memory.dmpFilesize
8KB
-
memory/800-145-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-40-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-34-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-151-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-153-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-30-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-38-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-47-0x00000000009C0000-0x00000000011F2000-memory.dmpFilesize
8.2MB
-
memory/800-53-0x0000000007770000-0x0000000007802000-memory.dmpFilesize
584KB
-
memory/800-56-0x0000000007AD0000-0x0000000007BDA000-memory.dmpFilesize
1.0MB
-
memory/800-49-0x0000000007C40000-0x00000000081E4000-memory.dmpFilesize
5.6MB
-
memory/800-54-0x0000000007740000-0x000000000774A000-memory.dmpFilesize
40KB
-
memory/800-162-0x0000000009230000-0x0000000009280000-memory.dmpFilesize
320KB
-
memory/800-196-0x0000000075A00000-0x0000000075AF0000-memory.dmpFilesize
960KB
-
memory/800-168-0x000000000A880000-0x000000000ADAC000-memory.dmpFilesize
5.2MB
-
memory/800-55-0x0000000008810000-0x0000000008E28000-memory.dmpFilesize
6.1MB
-
memory/800-166-0x000000000A180000-0x000000000A342000-memory.dmpFilesize
1.8MB
-
memory/1104-88-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1104-104-0x0000000073140000-0x00000000738F0000-memory.dmpFilesize
7.7MB
-
memory/1104-121-0x00000000074F0000-0x0000000007500000-memory.dmpFilesize
64KB
-
memory/1892-1-0x0000000002C40000-0x0000000002D40000-memory.dmpFilesize
1024KB
-
memory/1892-5-0x0000000000400000-0x0000000002ABF000-memory.dmpFilesize
38.7MB
-
memory/1892-8-0x0000000004800000-0x000000000480B000-memory.dmpFilesize
44KB
-
memory/1892-3-0x0000000000400000-0x0000000002ABF000-memory.dmpFilesize
38.7MB
-
memory/1892-2-0x0000000004800000-0x000000000480B000-memory.dmpFilesize
44KB
-
memory/2088-256-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/2088-184-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/2088-140-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/3108-205-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3108-265-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3108-204-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3108-206-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3108-207-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3108-208-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3112-177-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3112-154-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3112-159-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3112-157-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3112-160-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3192-4-0x00000000033A0000-0x00000000033B6000-memory.dmpFilesize
88KB
-
memory/3192-163-0x0000000003440000-0x0000000003456000-memory.dmpFilesize
88KB
-
memory/3680-65-0x0000000073140000-0x00000000738F0000-memory.dmpFilesize
7.7MB
-
memory/3680-64-0x00000000002F0000-0x0000000000964000-memory.dmpFilesize
6.5MB
-
memory/3680-106-0x0000000073140000-0x00000000738F0000-memory.dmpFilesize
7.7MB
-
memory/4016-91-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/4016-70-0x0000000073140000-0x00000000738F0000-memory.dmpFilesize
7.7MB
-
memory/4016-72-0x0000000000050000-0x0000000000218000-memory.dmpFilesize
1.8MB
-
memory/4016-73-0x0000000005160000-0x00000000051FC000-memory.dmpFilesize
624KB
-
memory/4016-187-0x0000000073140000-0x00000000738F0000-memory.dmpFilesize
7.7MB
-
memory/4016-143-0x0000000005FD0000-0x0000000006014000-memory.dmpFilesize
272KB
-
memory/4620-87-0x0000000001080000-0x00000000010EB000-memory.dmpFilesize
428KB
-
memory/4620-84-0x00000000010F0000-0x0000000001165000-memory.dmpFilesize
468KB
-
memory/4620-142-0x0000000001080000-0x00000000010EB000-memory.dmpFilesize
428KB
-
memory/4656-155-0x0000000004800000-0x00000000048A2000-memory.dmpFilesize
648KB
-
memory/4656-158-0x00000000048B0000-0x00000000049CB000-memory.dmpFilesize
1.1MB
-
memory/4684-161-0x0000000002F30000-0x0000000003040000-memory.dmpFilesize
1.1MB
-
memory/4684-148-0x0000000002F30000-0x0000000003040000-memory.dmpFilesize
1.1MB
-
memory/4684-139-0x0000000002E00000-0x0000000002F2D000-memory.dmpFilesize
1.2MB
-
memory/4684-22-0x00000000011A0000-0x00000000011A6000-memory.dmpFilesize
24KB
-
memory/4684-23-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/4684-152-0x0000000002F30000-0x0000000003040000-memory.dmpFilesize
1.1MB
-
memory/4768-261-0x0000000000400000-0x000000000063A000-memory.dmpFilesize
2.2MB
-
memory/4768-306-0x0000000000400000-0x000000000063A000-memory.dmpFilesize
2.2MB
-
memory/4768-287-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/4768-285-0x0000000000400000-0x000000000063A000-memory.dmpFilesize
2.2MB
-
memory/4768-284-0x0000000000400000-0x000000000063A000-memory.dmpFilesize
2.2MB
-
memory/4768-257-0x0000000000400000-0x000000000063A000-memory.dmpFilesize
2.2MB
-
memory/4788-98-0x0000000000D60000-0x0000000000D6C000-memory.dmpFilesize
48KB
-
memory/4788-110-0x0000000000D60000-0x0000000000D6C000-memory.dmpFilesize
48KB
-
memory/4980-146-0x0000000002B40000-0x0000000002C40000-memory.dmpFilesize
1024KB
-
memory/4980-144-0x0000000000400000-0x0000000002ABF000-memory.dmpFilesize
38.7MB
-
memory/4980-141-0x0000000002B10000-0x0000000002B1B000-memory.dmpFilesize
44KB
-
memory/4980-165-0x0000000000400000-0x0000000002ABF000-memory.dmpFilesize
38.7MB