c3ad48f963fd33ee2a9e19d81ea2f5e27dedb01fabbce23b965d381db5f1c05d

Analysis

max time kernel
104s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
31/12/2023, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LLC.bat
Size

3KB
MD5

1a4a3755af6eb2406f9da11cc06a0a71
SHA1

7e21dd61784d928dde11ab5798a928a8458c374d
SHA256

c3ad48f963fd33ee2a9e19d81ea2f5e27dedb01fabbce23b965d381db5f1c05d
SHA512

86e0128a6fd924db8858d3492a26fd86ea74abd6dbbf26742fe9decb3a23e03c4fc626fed33bd7ce4d5b9077f73913efe5bd4889b45d53619e0c9cb2c638651a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4724	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1199853020-417986905-91977573-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4348	vlc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
2092	msedge.exe
2092	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4348	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	3576	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3576	AUDIODG.EXE
Token: 33	4348	vlc.exe
Token: SeIncBasePriorityPrivilege	4348	vlc.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4348	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2092	412	cmd.exe	82
PID 412 wrote to memory of 2092	412	cmd.exe	82
PID 412 wrote to memory of 4724	412	cmd.exe	85
PID 412 wrote to memory of 4724	412	cmd.exe	85
PID 2092 wrote to memory of 2288	2092	msedge.exe	86
PID 2092 wrote to memory of 2288	2092	msedge.exe	86
PID 412 wrote to memory of 3856	412	cmd.exe	87
PID 412 wrote to memory of 3856	412	cmd.exe	87
PID 412 wrote to memory of 2872	412	cmd.exe	88
PID 412 wrote to memory of 2872	412	cmd.exe	88
PID 412 wrote to memory of 1920	412	cmd.exe	89
PID 412 wrote to memory of 1920	412	cmd.exe	89
PID 412 wrote to memory of 4860	412	cmd.exe	90
PID 412 wrote to memory of 4860	412	cmd.exe	90
PID 412 wrote to memory of 3432	412	cmd.exe	91
PID 412 wrote to memory of 3432	412	cmd.exe	91
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 4792	2092	msedge.exe	92
PID 2092 wrote to memory of 1008	2092	msedge.exe	93
PID 2092 wrote to memory of 1008	2092	msedge.exe	93
PID 2092 wrote to memory of 232	2092	msedge.exe	95
PID 2092 wrote to memory of 232	2092	msedge.exe	95
PID 2092 wrote to memory of 232	2092	msedge.exe	95
PID 2092 wrote to memory of 232	2092	msedge.exe	95
PID 2092 wrote to memory of 232	2092	msedge.exe	95
PID 2092 wrote to memory of 232	2092	msedge.exe	95

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3856	attrib.exe
2872	attrib.exe
4860	attrib.exe
3640	attrib.exe
3576	attrib.exe
3032	attrib.exe
224	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LLC.bat"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://media.discordapp.net/attachments/1171199057348263996/1171261368717037700/Jq9XNeo.jpg?ex=659ca2a7&is=658a2da7&hm=e584359e6d8774a5d4d4f23f6b5f2b20a2715bdcc056d11f5fe0c641e0d9fc15&
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffbba6f3cb8,0x7ffbba6f3cc8,0x7ffbba6f3cd8
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,216666114260197907,3886435028509903258,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,216666114260197907,3886435028509903258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,216666114260197907,3886435028509903258,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,216666114260197907,3886435028509903258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,216666114260197907,3886435028509903258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,216666114260197907,3886435028509903258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4148 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3988
- C:\Windows\system32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:4724
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\LLC.bat
  2⤵
  - Views/modifies file attributes
  PID:3856
- C:\Windows\system32\attrib.exe
  attrib +h /s /d
  2⤵
  - Views/modifies file attributes
  PID:2872
- C:\Windows\system32\cipher.exe
  cipher /e /s /a
  2⤵
  PID:1920
- C:\Windows\system32\attrib.exe
  attrib +h /s /d
  2⤵
  - Views/modifies file attributes
  PID:4860
- C:\Windows\system32\cipher.exe
  cipher /e /s /a
  2⤵
  PID:3432
- C:\Windows\system32\attrib.exe
  attrib +h /s /d
  2⤵
  - Views/modifies file attributes
  PID:3640
- C:\Windows\system32\cipher.exe
  cipher /e /s /a
  2⤵
  PID:3888
- C:\Windows\system32\attrib.exe
  attrib +h /s /d
  2⤵
  - Views/modifies file attributes
  PID:3576
- C:\Windows\system32\cipher.exe
  cipher /e /s /a
  2⤵
  PID:2284
- C:\Windows\system32\attrib.exe
  attrib +h /s /d
  2⤵
  - Views/modifies file attributes
  PID:3032
- C:\Windows\system32\cipher.exe
  cipher /e /s /a
  2⤵
  PID:944
- C:\Windows\system32\attrib.exe
  attrib +h /s /d
  2⤵
  - Views/modifies file attributes
  PID:224
- C:\Windows\system32\cipher.exe
  cipher /e /s /a
  2⤵
  PID:2304
- C:\Windows\system32\curl.exe
  curl -o LC.mp4 "https://cdn.discordapp.com/attachments/1177310897123885067/1191116864877776957/lv_0_20231231143029.mp4?ex=65a44506&is=6591d006&hm=ab14c09f3cb8f91653be510f41d1f2fc5e1c634bb2f47701957dddc9183b5ae8&"
  2⤵
  PID:3412
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4348
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2780
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:1460
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4484
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:1064
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3404
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:1840
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:336
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4388
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:800
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2468
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:5080
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:5076
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2396
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3820
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4104
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:1244
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2444
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2888
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3492
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:1116
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4620
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:432
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3212
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4988
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:5040
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4244
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4288
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:1304
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2780
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4400
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4592
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3844
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3852
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2388
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3524
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2304
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2824
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3520
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:5072
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4576
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:952
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:1436
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3440
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3404
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:1408
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3228
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2824
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2668
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:3184
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:4688
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\LC.mp4"
  2⤵
  PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004BC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
92e040d7c1eeb7646714b53e4a95eb91

SHA1
4eaae5706d13b5f0ca9f2e4c994cfca63890dd7d

SHA256
5342d5a6f08451e0f1c54f8e3658dd91eeba2be804f3582ddf8d6a4e2d0c6468

SHA512
e5b4c0ee79b7536679bf2e54f865f91b4957d4f66e498a026b88a6c14a13163f897f54baa9da747c1523eaf20d29cca960b8949a08a7b0ab9b0bbe92478a34f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
477B

MD5
b48c97183bf8eefa5f93f8cc35d53f61

SHA1
083522bfcfd5e999bab3812a1143eecc26c68b62

SHA256
61d6e3061e34068ad858b13f3b9eec36195b9b50ec4a7d082def73ae3851b752

SHA512
c4f8db1dd2db03b83f7a2a58ec2dad32675b1ba6dd2b047ec36c53d4a85fcb00c0c01d06385ab6d051afd714916b26d4b000daa0b280b5bd5af395bb9ca11a6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
744ed8d5bc0f1e57f2677dc8f47cf09b

SHA1
04654732012af75ca2966383157dd86db4b52513

SHA256
768baded1527480f94af7d8753ec21c9c99de7a97aa5ccbd8c50cc3cdfc14e1e

SHA512
ff0e4ad8376657088f67bec645823f9dc597f9b329e7b2e4bcc199db5737f6c8e6135296c8f58fa8866b65f51bbdfa3c94e6ccc353196e85f52f868c60feece7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbcce05031a85dad825d8392418eaa9a

SHA1
132db1df40bb604c818b430c948c54c571c729e6

SHA256
322d7662b1755f8ded336775a666d0acfa1a6067bc0b9c4d1d63ad3707535e3a

SHA512
ebb5b2ecfd509d70d5d7d49d7c8ba639e91dfc1a685f881c424463968294e0fd4d1df19decafdff1b4c5aceef314a77c79db1ab9fb328d3707bc0f6b15c97023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
eee2fbb6857a779ffe6d81a6475cce9b

SHA1
b163b8f337ff09ee49dfe537960f998b102067d3

SHA256
d885cd9715930ca5d4b2e54e3cf76017d9d9fdc46c1b6a7196476f377144505b

SHA512
3a71d1194b06359c1d8029d549198bd1d5fe56a73adbd215123d32d3ba880660e41fe9fede41f358fddc77d9cee392fe3c213ab3e8408a014fd3e7c0ae0ad28b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7bf036d03f319f665faceaa606d3559a

SHA1
c1688a56a5baffe61a343e81e9ff021e444fd753

SHA256
0e330d9f01baaabd80f262f68998a4a16d3bb24cb4f4248f736c950a97b74bc2

SHA512
73f0470618f8914226b835f8f382b8880aad0a9a109d43b0fda52bfd3fa7be990f3a1ada9c4818745f20031acbe9ddf1b4a4bbe4dcc23957c2af06384ac8fa82

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
66B

MD5
b00bea45adcd41a95463dd463d14bf1d

SHA1
81d70f612006ba31d19f3f163973a03e4a5bd5c0

SHA256
446adf3211ba11382e10403c0826a98449fcbcdeff03e716f0135a82107e9517

SHA512
4f50b4449dd250656a2d66595ffa492f6a040745afc04b29c8ef854dfe0bd58ebbca97afdccbac7d78154f7b0e85a708dd7d22bb64d039f261d2019f80a4a20c

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Ya4348

Filesize
65B

MD5
c19f1d3876adb050f81184b11bca9c6b

SHA1
b477ecae9dd61fc352ccd259803ab806bd36e57c

SHA256
c48689aa862190a7e7a88963674f79b12787db95aeb5575449cc790180d0e265

SHA512
2a0e96819769bfa7ac6099b209d4e1ff301b08083f4f2372a383093dbf7443db701ccff35e2046b282ab9d8449d456e4deee0495228f19ca2e57a3ba231c549e

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

Filesize
18B

MD5
7c8e809e8725cf4e9894e0e0487c8ecf

SHA1
e5a66ebce34fbc44c5caaa8f84228aa3fd3ca312

SHA256
6e63cbe8719a8702b4164d9671bb0a7120f54d9eceb0826f0a1511f28713bf9b

SHA512
ca9717243cb4537f1738bf7d0bf54337e40ebca63eeef26169c07c1958e4bbd7839132efcbf59c8067a4cd9c355c2aca370a20b8a61305540b95ad867a2dc3ef

Download Submit
C:\Users\Admin\Desktop\LC.txt

Filesize
138B

MD5
dc22ee5d7cdb4734c62f4a07b905822d

SHA1
88ab21f5ace9306b039f2d2d675769de70d337fc

SHA256
b500888ab41a08c77422a9b299ebe6c670a15bdee61bb1505fa22e33dd54fb54

SHA512
c61c4405d64d1efea0dba5c11cbbac905b1ed0dfa58c74e4b88091dac954e0988492aec36b4595e21a7c19ce1dec1a76595bf24c7ac7e46e7a558a6775ce27a5

Download Submit
C:\Users\Admin\Downloads\do not close.txt

Filesize
132B

MD5
460791485d870c39dc5273ea2ddfc119

SHA1
a247fb46e29831ebea2c4984061a1c80ed67295f

SHA256
257ea28c54cdb0fea4cb56dd97067978cde53585872fe22eb6f152d20bff1251

SHA512
e64ef367731ba22232fb1112aeafc0f2098a05321098f481d45e6e10b74ff645ed644c8c511e5cfafcf16e0da9c91c2641ed5aa8f6fbb36a43445d013f0e3e52

Download Submit
C:\Users\Admin\Music\LC.mp4

Filesize
4.6MB

MD5
5f7aac998db63acc3b77fd064714659a

SHA1
712c457a83cdba6bccd4b1021f710a0121d9d981

SHA256
09908ae87b8369921c5f7b980d5f4c55b3430984ff33c600f45d3fceab81685e

SHA512
68f788391df5401a097fcf811052414d330a05102947f28d027cd1a2a1f2f07bbd4fab908b9602abd9d14f14d3318fd199159ed952b954ffc4e90a9224a8efd6

Download Submit
memory/336-187-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/432-167-0x00007FFBB9EA0000-0x00007FFBBA154000-memory.dmp

Filesize
2.7MB

Download
memory/432-151-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/432-145-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/432-193-0x00007FFBBAC70000-0x00007FFBBAC88000-memory.dmp

Filesize
96KB

Download
memory/800-149-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/800-165-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/800-191-0x00007FFBB9EA0000-0x00007FFBBA154000-memory.dmp

Filesize
2.7MB

Download
memory/1064-153-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/1064-196-0x00007FFBB9EA0000-0x00007FFBBA154000-memory.dmp

Filesize
2.7MB

Download
memory/1064-170-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/1116-178-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/1116-155-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/1244-157-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/1244-180-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/1460-134-0x00007FFBBAC70000-0x00007FFBBAC88000-memory.dmp

Filesize
96KB

Download
memory/1460-131-0x00007FFBB9EA0000-0x00007FFBBA154000-memory.dmp

Filesize
2.7MB

Download
memory/1460-129-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/1460-127-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/1460-136-0x00007FFBBA290000-0x00007FFBBA2A1000-memory.dmp

Filesize
68KB

Download
memory/1460-135-0x00007FFBBA9A0000-0x00007FFBBA9B7000-memory.dmp

Filesize
92KB

Download
memory/1840-161-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/1840-185-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/2396-147-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/2396-163-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/2444-172-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/2444-154-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/2444-197-0x00007FFBB9EA0000-0x00007FFBBA154000-memory.dmp

Filesize
2.7MB

Download
memory/2468-194-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/2468-168-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/2780-133-0x00007FFBBA290000-0x00007FFBBA2A1000-memory.dmp

Filesize
68KB

Download
memory/2780-126-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/2780-130-0x00007FFBBAC70000-0x00007FFBBAC88000-memory.dmp

Filesize
96KB

Download
memory/2780-132-0x00007FFBBA9A0000-0x00007FFBBA9B7000-memory.dmp

Filesize
92KB

Download
memory/2780-128-0x00007FFBB9EA0000-0x00007FFBBA154000-memory.dmp

Filesize
2.7MB

Download
memory/2780-125-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/2888-192-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/2888-166-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/3212-156-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/3212-179-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/3404-150-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/3404-169-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/3492-183-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/3492-160-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/3820-159-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/3820-182-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/4104-181-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/4104-158-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/4388-152-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/4388-171-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/4484-142-0x00007FFBBA290000-0x00007FFBBA2A1000-memory.dmp

Filesize
68KB

Download
memory/4484-139-0x00007FFBB9EA0000-0x00007FFBBA154000-memory.dmp

Filesize
2.7MB

Download
memory/4484-141-0x00007FFBBA9A0000-0x00007FFBBA9B7000-memory.dmp

Filesize
92KB

Download
memory/4484-138-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/4484-137-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/4484-140-0x00007FFBBAC70000-0x00007FFBBAC88000-memory.dmp

Filesize
96KB

Download
memory/4620-184-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/4988-190-0x00007FFBB9EA0000-0x00007FFBBA154000-memory.dmp

Filesize
2.7MB

Download
memory/4988-148-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/4988-164-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/5040-189-0x00007FFBB9EA0000-0x00007FFBBA154000-memory.dmp

Filesize
2.7MB

Download
memory/5040-162-0x00007FFBBA2B0000-0x00007FFBBA2E4000-memory.dmp

Filesize
208KB

Download
memory/5040-146-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download
memory/5076-188-0x00007FF7D3FB0000-0x00007FF7D40A8000-memory.dmp

Filesize
992KB

Download