61d43a11f8831bdcfabc1dfaa8685a3ae4ddf3b512c27c15e9d65dcb2aa897fa

Analysis

max time kernel
106s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41faad402aa16a136d8b8f1364d7e9c3.exe
Size

54KB
MD5

41faad402aa16a136d8b8f1364d7e9c3
SHA1

608dfd83ab573cf15f5ab50fac3bf86eb5e084e4
SHA256

61d43a11f8831bdcfabc1dfaa8685a3ae4ddf3b512c27c15e9d65dcb2aa897fa
SHA512

6fceb1d632ef7cba69091f658d62ca9e7cfca15a05790f257b1d7b7e9f82b9e8860f6c12e6332425ec520fab95a8e91ec411dd21d086ab3b56720e78cf81ba98
SSDEEP

768:hJSrYIiWg9NDz4WnFihPzV2qzj2eWrW/Jm4Xtfa7a3xu9ulHHrnKFBAnPWcCB29o:h49bWcjSDrOUCtSwnrnuAn6B6o

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables RegEdit via registry modification 5 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1"	41faad402aa16a136d8b8f1364d7e9c3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1"	symdebugs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1"	symdebugs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1"	symdebugs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1"	symdebugs.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	41faad402aa16a136d8b8f1364d7e9c3.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	symdebugs.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	symdebugs.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	symdebugs.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	symdebugs.exe

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

Executes dropped EXE 10 IoCs

pid	Process
2824	symdebugs.exe
2688	symdebugs.exe
1564	symdebugs.exe
872	symdebugs.exe
1112	symdebugs.exe
836	symdebugs.exe
892	symdebugs.exe
2740	symdebugs.exe
2308	symdebugs.exe
1156	symdebugs.exe

Loads dropped DLL 10 IoCs

pid	Process
2208	41faad402aa16a136d8b8f1364d7e9c3.exe
2208	41faad402aa16a136d8b8f1364d7e9c3.exe
2688	symdebugs.exe
2688	symdebugs.exe
872	symdebugs.exe
872	symdebugs.exe
836	symdebugs.exe
836	symdebugs.exe
2740	symdebugs.exe
2740	symdebugs.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Symantec Debug Client = "symdebugs.exe"	41faad402aa16a136d8b8f1364d7e9c3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Symantec Debug Client = "symdebugs.exe"	symdebugs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Symantec Debug Client = "symdebugs.exe"	symdebugs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Symantec Debug Client = "symdebugs.exe"	symdebugs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Symantec Debug Client = "symdebugs.exe"	symdebugs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Symantec Debug Client = "symdebugs.exe"	symdebugs.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\symdebugs.exe	41faad402aa16a136d8b8f1364d7e9c3.exe
File opened for modification	C:\Windows\SysWOW64\symdebugs.exe	41faad402aa16a136d8b8f1364d7e9c3.exe
File created	C:\Windows\SysWOW64\symdebugs.exe	symdebugs.exe
File created	C:\Windows\SysWOW64\symdebugs.exe	symdebugs.exe
File created	C:\Windows\SysWOW64\symdebugs.exe	symdebugs.exe
File opened for modification	C:\Windows\SysWOW64\symdebugs.exe	symdebugs.exe
File opened for modification	C:\Windows\SysWOW64\symdebugs.exe	symdebugs.exe
File opened for modification	C:\Windows\SysWOW64\symdebugs.exe	symdebugs.exe
File opened for modification	C:\Windows\SysWOW64\symdebugs.exe	symdebugs.exe
File opened for modification	C:\Windows\SysWOW64\symdebugs.exe	symdebugs.exe
File created	C:\Windows\SysWOW64\symdebugs.exe	symdebugs.exe
File created	C:\Windows\SysWOW64\symdebugs.exe	symdebugs.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2648 set thread context of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2824 set thread context of 2688	2824	symdebugs.exe	30
PID 1564 set thread context of 872	1564	symdebugs.exe	48
PID 1112 set thread context of 836	1112	symdebugs.exe	57
PID 892 set thread context of 2740	892	symdebugs.exe	71
PID 2308 set thread context of 1156	2308	symdebugs.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2208	41faad402aa16a136d8b8f1364d7e9c3.exe
Token: SeIncBasePriorityPrivilege	2688	symdebugs.exe
Token: SeIncBasePriorityPrivilege	872	symdebugs.exe
Token: SeIncBasePriorityPrivilege	836	symdebugs.exe
Token: SeIncBasePriorityPrivilege	2740	symdebugs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2648 wrote to memory of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2648 wrote to memory of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2648 wrote to memory of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2648 wrote to memory of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2648 wrote to memory of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2648 wrote to memory of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2648 wrote to memory of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2648 wrote to memory of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2648 wrote to memory of 2208	2648	41faad402aa16a136d8b8f1364d7e9c3.exe	28
PID 2208 wrote to memory of 2824	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	29
PID 2208 wrote to memory of 2824	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	29
PID 2208 wrote to memory of 2824	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	29
PID 2208 wrote to memory of 2824	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	29
PID 2824 wrote to memory of 2688	2824	symdebugs.exe	30
PID 2824 wrote to memory of 2688	2824	symdebugs.exe	30
PID 2824 wrote to memory of 2688	2824	symdebugs.exe	30
PID 2824 wrote to memory of 2688	2824	symdebugs.exe	30
PID 2208 wrote to memory of 2696	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	31
PID 2208 wrote to memory of 2696	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	31
PID 2208 wrote to memory of 2696	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	31
PID 2208 wrote to memory of 2696	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	31
PID 2208 wrote to memory of 1976	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	32
PID 2208 wrote to memory of 1976	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	32
PID 2208 wrote to memory of 1976	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	32
PID 2208 wrote to memory of 1976	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	32
PID 2208 wrote to memory of 2900	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	40
PID 2208 wrote to memory of 2900	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	40
PID 2208 wrote to memory of 2900	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	40
PID 2208 wrote to memory of 2900	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	40
PID 2208 wrote to memory of 3052	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	39
PID 2208 wrote to memory of 3052	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	39
PID 2208 wrote to memory of 3052	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	39
PID 2208 wrote to memory of 3052	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	39
PID 2208 wrote to memory of 2724	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	38
PID 2208 wrote to memory of 2724	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	38
PID 2208 wrote to memory of 2724	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	38
PID 2208 wrote to memory of 2724	2208	41faad402aa16a136d8b8f1364d7e9c3.exe	38
PID 2824 wrote to memory of 2688	2824	symdebugs.exe	30
PID 2824 wrote to memory of 2688	2824	symdebugs.exe	30
PID 2824 wrote to memory of 2688	2824	symdebugs.exe	30
PID 2824 wrote to memory of 2688	2824	symdebugs.exe	30
PID 2824 wrote to memory of 2688	2824	symdebugs.exe	30
PID 2824 wrote to memory of 2688	2824	symdebugs.exe	30
PID 2688 wrote to memory of 1564	2688	symdebugs.exe	54
PID 2688 wrote to memory of 1564	2688	symdebugs.exe	54
PID 2688 wrote to memory of 1564	2688	symdebugs.exe	54
PID 2688 wrote to memory of 1564	2688	symdebugs.exe	54
PID 2688 wrote to memory of 348	2688	symdebugs.exe	53
PID 2688 wrote to memory of 348	2688	symdebugs.exe	53
PID 2688 wrote to memory of 348	2688	symdebugs.exe	53
PID 2688 wrote to memory of 348	2688	symdebugs.exe	53
PID 2688 wrote to memory of 1528	2688	symdebugs.exe	52
PID 2688 wrote to memory of 1528	2688	symdebugs.exe	52
PID 2688 wrote to memory of 1528	2688	symdebugs.exe	52
PID 2688 wrote to memory of 1528	2688	symdebugs.exe	52
PID 2688 wrote to memory of 2796	2688	symdebugs.exe	51
PID 2688 wrote to memory of 2796	2688	symdebugs.exe	51
PID 2688 wrote to memory of 2796	2688	symdebugs.exe	51
PID 2688 wrote to memory of 2796	2688	symdebugs.exe	51
PID 2688 wrote to memory of 376	2688	symdebugs.exe	50
PID 2688 wrote to memory of 376	2688	symdebugs.exe	50
PID 2688 wrote to memory of 376	2688	symdebugs.exe	50
PID 2688 wrote to memory of 376	2688	symdebugs.exe	50

C:\Users\Admin\AppData\Local\Temp\41faad402aa16a136d8b8f1364d7e9c3.exe
"C:\Users\Admin\AppData\Local\Temp\41faad402aa16a136d8b8f1364d7e9c3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\41faad402aa16a136d8b8f1364d7e9c3.exe
  "C:\Users\Admin\AppData\Local\Temp\41faad402aa16a136d8b8f1364d7e9c3.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\symdebugs.exe
    "C:\Windows\system32\symdebugs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\symdebugs.exe
      "C:\Windows\SysWOW64\symdebugs.exe"
      4⤵
      Disables RegEdit via registry modification
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SYMDEB~1.EXE > nul
        5⤵
        
        PID:484
    - - C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"
        5⤵
        
        PID:376
    - - C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"
        5⤵
        
        PID:2796
    - - C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.com
        5⤵
        
        PID:1528
    - - C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.zip
        5⤵
        
        PID:348
    - - C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\system32\symdebugs.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1564
- - C:\Windows\SysWOW64\CMD.exe
    CMD /C del /F /S /Q *.zip
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\CMD.exe
    CMD /C del /F /S /Q *.com
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\41FAAD~1.EXE > nul
    3⤵
    - Deletes itself
    PID:2724
- - C:\Windows\SysWOW64\CMD.exe
    CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\CMD.exe
    CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"
    3⤵
    PID:2900

C:\Windows\SysWOW64\symdebugs.exe
"C:\Windows\SysWOW64\symdebugs.exe"
1⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:872
- C:\Windows\SysWOW64\symdebugs.exe
  "C:\Windows\system32\symdebugs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1112
- - C:\Windows\SysWOW64\symdebugs.exe
    "C:\Windows\SysWOW64\symdebugs.exe"
    3⤵
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    PID:836
  - - C:\Windows\SysWOW64\symdebugs.exe
      "C:\Windows\system32\symdebugs.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:892
    - - C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\SysWOW64\symdebugs.exe"
        5⤵
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
      - C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\system32\symdebugs.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2308
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\SysWOW64\symdebugs.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1156
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\system32\symdebugs.exe"
        8⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\SysWOW64\symdebugs.exe"
        9⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\system32\symdebugs.exe"
        10⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\SysWOW64\symdebugs.exe"
        11⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\system32\symdebugs.exe"
        12⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\SysWOW64\symdebugs.exe"
        13⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\system32\symdebugs.exe"
        14⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\SysWOW64\symdebugs.exe"
        15⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\system32\symdebugs.exe"
        16⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\symdebugs.exe
        
        "C:\Windows\SysWOW64\symdebugs.exe"
        17⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.zip
        16⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.com
        16⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"
        16⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"
        16⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SYMDEB~1.EXE > nul
        16⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.zip
        14⤵
        
        PID:628
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SYMDEB~1.EXE > nul
        14⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"
        14⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"
        14⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.com
        14⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.com
        12⤵
        
        PID:332
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SYMDEB~1.EXE > nul
        12⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"
        12⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"
        12⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.zip
        12⤵
        
        PID:904
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SYMDEB~1.EXE > nul
        10⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"
        10⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"
        10⤵
        
        PID:768
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.com
        10⤵
        
        PID:656
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.zip
        10⤵
        
        PID:920
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.com
        8⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"
        8⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"
        8⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.zip
        8⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SYMDEB~1.EXE > nul
        8⤵
        
        PID:2940
      - C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.zip
        6⤵
        
        PID:2132
      - C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q *.com
        6⤵
        
        PID:2128
      - C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"
        6⤵
        
        PID:2544
      - C:\Windows\SysWOW64\CMD.exe
        
        CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"
        6⤵
        
        PID:1588
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SYMDEB~1.EXE > nul
        6⤵
        
        PID:2072
  - - C:\Windows\SysWOW64\CMD.exe
      CMD /C del /F /S /Q *.zip
      4⤵
      PID:2292
  - - C:\Windows\SysWOW64\CMD.exe
      CMD /C del /F /S /Q *.com
      4⤵
      PID:600
  - - C:\Windows\SysWOW64\CMD.exe
      CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"
      4⤵
      PID:2416
  - - C:\Windows\SysWOW64\CMD.exe
      CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"
      4⤵
      PID:2328
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SYMDEB~1.EXE > nul
      4⤵
      PID:1808
- C:\Windows\SysWOW64\CMD.exe
  CMD /C del /F /S /Q *.zip
  2⤵
  PID:1236
- C:\Windows\SysWOW64\CMD.exe
  CMD /C del /F /S /Q *.com
  2⤵
  PID:2076
- C:\Windows\SysWOW64\CMD.exe
  CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"
  2⤵
  PID:2100
- C:\Windows\SysWOW64\CMD.exe
  CMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"
  2⤵
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SYMDEB~1.EXE > nul
  2⤵
  PID:3068

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "606632266722820891055956263-92097955264042216417688723511920544821-994134105"
1⤵
PID:600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\drivers\etc\hosts

Filesize
6KB

MD5
187a9b6cc39d35b9e04cba9ffbae519f

SHA1
09f18be24d22828c5b57beac4f3f8073bcf28c4a

SHA256
c542613e38a4670bb119e798664eb5c07ca6dd5541a5fc23f8bb70e04ea19f85

SHA512
b1b07e4e55fca6be43b9e11e9692d0c7aca934a14e76325a76380a8660adff635ffdb822b651f60d80cfc1b504ebca937609dba33c25c3d4824712c59a651229

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
4KB

MD5
fa9befaa7989dccec5c619d71d972485

SHA1
6b486e98f6476ef6d2d35305d4f3877719d888e0

SHA256
99fb6e68f43538b21221560e3c179ef99586b7bba82d10b4272f0d1203346eeb

SHA512
c053448ffc704b34eb8458c38680348819d445c3704e412d2d982969fc8560c2217eb4eef6d3f58441080bb67dda4835d6ab68b1f10426d948d32af37f2f620c

Download Submit
\Windows\SysWOW64\symdebugs.exe

Filesize
54KB

MD5
41faad402aa16a136d8b8f1364d7e9c3

SHA1
608dfd83ab573cf15f5ab50fac3bf86eb5e084e4

SHA256
61d43a11f8831bdcfabc1dfaa8685a3ae4ddf3b512c27c15e9d65dcb2aa897fa

SHA512
6fceb1d632ef7cba69091f658d62ca9e7cfca15a05790f257b1d7b7e9f82b9e8860f6c12e6332425ec520fab95a8e91ec411dd21d086ab3b56720e78cf81ba98

Download Submit
memory/1564-79-0x0000000000010000-0x0000000000025000-memory.dmp

Filesize
84KB

Download
memory/2208-7-0x0000000000010000-0x000000000001E000-memory.dmp

Filesize
56KB

Download
memory/2208-13-0x0000000000010000-0x000000000001E000-memory.dmp

Filesize
56KB

Download
memory/2208-18-0x0000000000010000-0x000000000001E000-memory.dmp

Filesize
56KB

Download
memory/2208-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2208-10-0x0000000000010000-0x000000000001E000-memory.dmp

Filesize
56KB

Download
memory/2208-0-0x0000000000010000-0x000000000001E000-memory.dmp

Filesize
56KB

Download
memory/2208-4-0x0000000000010000-0x000000000001E000-memory.dmp

Filesize
56KB

Download
memory/2208-2-0x0000000000010000-0x000000000001E000-memory.dmp

Filesize
56KB

Download
memory/2648-17-0x0000000000010000-0x0000000000025000-memory.dmp

Filesize
84KB

Download
memory/2824-50-0x0000000000010000-0x0000000000025000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads