fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6

Resubmissions

19/01/2024, 01:18

240119-bn7ndadef77

19/01/2024, 01:13

240119-bla7dscefr10

Analysis

max time kernel
4s
max time network
153s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
19/01/2024, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DarkAdventures.exe
Size 139.5MB
Sample240119-bn7ndadef7
SHA256 56a16d12935731e5ea24968320133bb7eaac3be2c02103148a13ce4582a8c887
MD5 4acca1c0306c258f19f673c0fc1ae424
SHA1 5292070989b70618447285a32fbb63f08a527f5d
SHA512 1a27cdfcf89f8e7f898cb844862483360b70e9a929db48de37143ea4d9bd8fcd549de4ce8d2413e82fc213c58a5dd624331984dc4e9fd23fc7466d46f7f1aa4f
SSDEEP 786432:314w5ThzHwQBgmoLWv+K18nCzKdo5DTdvfMQr6SSmPuvh8tSIW68:314kpHwQjCWv+K18CedmVvEQEpcJW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
5096	DarkAdventures.exe
5096	DarkAdventures.exe
5096	DarkAdventures.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
16	ipinfo.io
9	ipinfo.io
10	ipinfo.io

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	DarkAdventures.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	DarkAdventures.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DarkAdventures.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	DarkAdventures.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
10320	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
10436	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
7244	tasklist.exe
7136	tasklist.exe
6792	tasklist.exe
2192	tasklist.exe
6912	tasklist.exe
6844	tasklist.exe
7236	tasklist.exe
7676	tasklist.exe
7532	tasklist.exe
7524	tasklist.exe
7180	tasklist.exe
7068	tasklist.exe
7468	tasklist.exe
7304	tasklist.exe
7172	tasklist.exe
6656	tasklist.exe
7460	tasklist.exe
7716	tasklist.exe
5844	tasklist.exe
6868	tasklist.exe
6784	tasklist.exe
7784	tasklist.exe
7776	tasklist.exe
7220	tasklist.exe
6876	tasklist.exe
5368	tasklist.exe
6556	tasklist.exe
7484	tasklist.exe
7288	tasklist.exe
5648	tasklist.exe
7760	tasklist.exe
7656	tasklist.exe
7032	tasklist.exe
6976	tasklist.exe
6648	tasklist.exe
7100	tasklist.exe
7392	tasklist.exe
7348	tasklist.exe
7128	tasklist.exe
6992	tasklist.exe
7296	tasklist.exe
7272	tasklist.exe
7188	tasklist.exe
5708	tasklist.exe
7212	tasklist.exe
7196	tasklist.exe
6968	tasklist.exe
6836	tasklist.exe
7048	tasklist.exe
7280	tasklist.exe
7264	tasklist.exe
7640	tasklist.exe
6828	tasklist.exe
7160	tasklist.exe
7144	tasklist.exe
7040	tasklist.exe
6932	tasklist.exe
6640	tasklist.exe
7368	tasklist.exe
7516	tasklist.exe
7508	tasklist.exe
11020	tasklist.exe
5348	tasklist.exe
7548	tasklist.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5096	DarkAdventures.exe
5096	DarkAdventures.exe
5096	DarkAdventures.exe
5096	DarkAdventures.exe
1848	DarkAdventures.exe
1848	DarkAdventures.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5096	DarkAdventures.exe
Token: SeCreatePagefilePrivilege	5096	DarkAdventures.exe
Token: SeDebugPrivilege	1436	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4140	WMIC.exe
Token: SeSecurityPrivilege	4140	WMIC.exe
Token: SeTakeOwnershipPrivilege	4140	WMIC.exe
Token: SeLoadDriverPrivilege	4140	WMIC.exe
Token: SeSystemProfilePrivilege	4140	WMIC.exe
Token: SeSystemtimePrivilege	4140	WMIC.exe
Token: SeProfSingleProcessPrivilege	4140	WMIC.exe
Token: SeIncBasePriorityPrivilege	4140	WMIC.exe
Token: SeCreatePagefilePrivilege	4140	WMIC.exe
Token: SeBackupPrivilege	4140	WMIC.exe
Token: SeRestorePrivilege	4140	WMIC.exe
Token: SeShutdownPrivilege	4140	WMIC.exe
Token: SeDebugPrivilege	4140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4140	WMIC.exe
Token: SeRemoteShutdownPrivilege	4140	WMIC.exe
Token: SeUndockPrivilege	4140	WMIC.exe
Token: SeManageVolumePrivilege	4140	WMIC.exe
Token: 33	4140	WMIC.exe
Token: 34	4140	WMIC.exe
Token: 35	4140	WMIC.exe
Token: 36	4140	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4140	WMIC.exe
Token: SeSecurityPrivilege	4140	WMIC.exe
Token: SeTakeOwnershipPrivilege	4140	WMIC.exe
Token: SeLoadDriverPrivilege	4140	WMIC.exe
Token: SeSystemProfilePrivilege	4140	WMIC.exe
Token: SeSystemtimePrivilege	4140	WMIC.exe
Token: SeProfSingleProcessPrivilege	4140	WMIC.exe
Token: SeIncBasePriorityPrivilege	4140	WMIC.exe
Token: SeCreatePagefilePrivilege	4140	WMIC.exe
Token: SeBackupPrivilege	4140	WMIC.exe
Token: SeRestorePrivilege	4140	WMIC.exe
Token: SeShutdownPrivilege	4140	WMIC.exe
Token: SeDebugPrivilege	4140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4140	WMIC.exe
Token: SeRemoteShutdownPrivilege	4140	WMIC.exe
Token: SeUndockPrivilege	4140	WMIC.exe
Token: SeManageVolumePrivilege	4140	WMIC.exe
Token: 33	4140	WMIC.exe
Token: 34	4140	WMIC.exe
Token: 35	4140	WMIC.exe
Token: 36	4140	WMIC.exe
Token: SeShutdownPrivilege	5096	DarkAdventures.exe
Token: SeCreatePagefilePrivilege	5096	DarkAdventures.exe
Token: SeShutdownPrivilege	5096	DarkAdventures.exe
Token: SeCreatePagefilePrivilege	5096	DarkAdventures.exe
Token: SeDebugPrivilege	6556	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4236	5096	DarkAdventures.exe	74
PID 5096 wrote to memory of 4236	5096	DarkAdventures.exe	74
PID 4236 wrote to memory of 1436	4236	cmd.exe	76
PID 4236 wrote to memory of 1436	4236	cmd.exe	76
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 2296	5096	DarkAdventures.exe	78
PID 5096 wrote to memory of 1848	5096	DarkAdventures.exe	79
PID 5096 wrote to memory of 1848	5096	DarkAdventures.exe	79
PID 5096 wrote to memory of 4628	5096	DarkAdventures.exe	80
PID 5096 wrote to memory of 4628	5096	DarkAdventures.exe	80
PID 4628 wrote to memory of 4140	4628	cmd.exe	82
PID 4628 wrote to memory of 4140	4628	cmd.exe	82
PID 5096 wrote to memory of 4528	5096	DarkAdventures.exe	83
PID 5096 wrote to memory of 4528	5096	DarkAdventures.exe	83
PID 5096 wrote to memory of 4348	5096	DarkAdventures.exe	84
PID 5096 wrote to memory of 4348	5096	DarkAdventures.exe	84
PID 5096 wrote to memory of 2756	5096	DarkAdventures.exe	85
PID 5096 wrote to memory of 2756	5096	DarkAdventures.exe	85
PID 5096 wrote to memory of 1708	5096	DarkAdventures.exe	86
PID 5096 wrote to memory of 1708	5096	DarkAdventures.exe	86
PID 5096 wrote to memory of 3876	5096	DarkAdventures.exe	87
PID 5096 wrote to memory of 3876	5096	DarkAdventures.exe	87
PID 5096 wrote to memory of 724	5096	DarkAdventures.exe	279
PID 5096 wrote to memory of 724	5096	DarkAdventures.exe	279
PID 5096 wrote to memory of 4680	5096	DarkAdventures.exe	278
PID 5096 wrote to memory of 4680	5096	DarkAdventures.exe	278

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
10548	attrib.exe

C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe
"C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1436
- C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe
  "C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1492 --field-trial-handle=1632,8163103401104683727,5249754272656294831,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe
  "C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=1820 --field-trial-handle=1632,8163103401104683727,5249754272656294831,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5096 get ExecutablePath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where processid=5096 get ExecutablePath
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4528
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4348
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2756
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1708
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3876
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3948
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4864
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:428
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4652
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1376
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4692
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:820
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1560
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:924
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:652
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4292
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4144
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4596
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2500
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4324
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:5224
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:7328
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:7540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:5212
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:7204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\bind\main.exe"
  2⤵
  PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:5188
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:7008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5176
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5168
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5148
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4932
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4432
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4520
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4164
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3284
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:348
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4800
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4552
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2956
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4640
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:236
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4856
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4160
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4268
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4180
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3832
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2368
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3064
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4468
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:524
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2188
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4888
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4768
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1828
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4620
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4460
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2404
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2228
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2276
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2832
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4540
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1776
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1732
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3736
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3944
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4744
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1768
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4656
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3696
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:716
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1948
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1780
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1940
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1292
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4680
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:724
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:10300
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:10340
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:10352
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn WindowsDriverSetupBtSTxX /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest
    3⤵
    - Creates scheduled task(s)
    PID:10320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:10396
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:10436
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:10448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:10500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:10532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:10740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:10776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:10988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:11020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "& { $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DarkAdventures.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask }"
  2⤵
  PID:10504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:10088
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:10128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
  2⤵
  PID:11060
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
    3⤵
    PID:9212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:10856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\"""
  2⤵
  PID:10480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupBtSTxX /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest"
  2⤵
  PID:10380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupBtSTxX /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe /f"
  2⤵
  PID:10348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5096 get ExecutablePath"
  2⤵
  PID:6552

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 session
1⤵
PID:7428

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=5096 get ExecutablePath
1⤵
PID:5464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\""
1⤵
PID:10420
- C:\Windows\system32\attrib.exe
  "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe
  2⤵
  - Views/modifies file attributes
  PID:10548

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:10740

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupBtSTxX /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe /f
1⤵
PID:10492

C:\Windows\system32\cmd.exe
cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupBtSTxX /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest
1⤵
PID:10300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 755c4768f6e384030805284ab88689a325431667e9ab11d9aeaa55e9739742f2
MD5 5d574dc518025fad52b7886c1bff0e13
SHA1 68217a5f9e9a64ca8fed9eefa4171786a8f9f8f7
SHA512 21de152e07d269b265dae58d46e8c68a3268b2f78d771d4fc44377a14e0c6e73aadae923dcfd34ce2ef53c2eaa53d4df8f281d9b8a627edee213946c9ef37d13
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e202b72a1cda5e628a4ad006320b5aa1afafb52d90eb9d3c2a8371cf2168db44
MD5 1233eb6c0a51ea264c1155f9983ccdc6
SHA1 269f43dbcdee9f6fd56e535574fc5b8c71b092b3
SHA512 ee13f65a1cdb29db2f8a2a088835d13cbf384070e714f15da90b516d76f19adb14cefeb5a0edffb0e42cea3c1e5186d03148f018cb830139b5f0a69f443b057f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f12d29be96eeddde5205eb68fba02785c3794de2f19a82253c8d64ff9d07692f
MD5 961b8db1be3826f3f52daa2930d3fd70
SHA1 e0c6611633384d9e06d94326c3df29d7a902f4d6
SHA512 6206e2895e00f2aee4c34af3c3a9a08e99a0c38b7e8c79ff78a5bd54cc3327adbcf11055b3988cab9c14ba1f30434ffeb3b00faf42eb8e9f0b8fd147ca18e41e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 63297e38035f22e30f3ce0f720d0701f63c2359d4d1a1f6f810d72ae6ac14dc9
MD5 c38d8ff78e262e5168b7e63f619940d6
SHA1 d4d71f3208269c570386578a3737ef0d9a5fc33a
SHA512 ea12a850e08d47a52c977ac9924c0f0761ee69141c6f7ef407ce1d3fd27a07d726acd6705475ddcf5af943c88667c091273de2582138f2669c5fd9bdb460eaf1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wckxcton.fdx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wckxcton.fdx.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe
Size 1.5MB
SHA256 240876fb6dbe3276d9239fa8ff19d6885ce9a5d06d941530f35ca802ae096c4a
MD5 73e24ad908b1b57806dab5e3c4d3d7a5
SHA1 ec6ccec374f369bcb991c1d92d0fa66190a012da
SHA512 23b61ee1043d675a7d6bd6b91126aa21ae703d3c9e95f57562fd21b5acf438e8168c2dd16eb6a277ce96082846717f2f68efa4ca9e075e9c2810026469b01b47
SSDEEP 6144:KvJSAK11yPH4xtMVmehR+b7/78wqtyeYbQaC8ArZj6JrNr/PewEQVJzlLqOy5Kit:K+K/VftUzlLqOy5KigTmAz9cX6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

848df120-4f1d-442b-a5ca-d45a9ac88954.tmp.node

Path \Users\Admin\AppData\Local\Temp\848df120-4f1d-442b-a5ca-d45a9ac88954.tmp.node
Size 1.8MB
SHA256 7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
MD5 3072b68e3c226aff39e6782d025f25a8
SHA1 cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA512 61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
SSDEEP 49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
MD5 SHA1 SHA512 SSDEEP

Submit Download

8d0809f9-f619-4cc7-89a1-47172b29e217.tmp.node

Path \Users\Admin\AppData\Local\Temp\8d0809f9-f619-4cc7-89a1-47172b29e217.tmp.node
Size 663KB
SHA256 da0906c76db455d8000920dcac14f64a326841b17f0b1c86e43fae1f3c5720af
MD5 40ce1601e67dd498b9f14832f1cf2c41
SHA1 0ea248a66a4d72b2a0b183f71b6d4670bcced7ac
SHA512 c837ef13396ec77f854d84293713685fa01b42d770d38f88e8d445b3ff68c94444245a45a01ac5df0f7e8f2ae73a299f4542fc78add2aa9792f3f1c28fd46a42
SSDEEP 6144:SUsD4EfVIV6hKmpaYItaLYV0wBTbjoxBmp3FDsO3oS2CTyIfUo:abfVw6hBIVm0TbjoxeFAOBt
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6cdac11-f218-472f-816a-87500a9c2c88.tmp.node

Path \Users\Admin\AppData\Local\Temp\a6cdac11-f218-472f-816a-87500a9c2c88.tmp.node
Size 643KB
SHA256 44d3866ae7d598380638ec1cd3114d470c6c545234a069695f79eb41c71d4af1
MD5 8a6ab558fbc95a85e01ee691c6c17929
SHA1 b5eaa4c027a9ba3083a1c15a91af9426cb78dfb4
SHA512 4e6ed3af78de833632c3c23b6cfdbad9bf74dc6e3f23fba76fd1a39c5446f22720abf1ae0648f7f80b7795e02dd4fb8f90b839fc66b8d93edd24c4f75589b9f2
SSDEEP 6144:fYwDS9N+qVWUdofd85fOj0nFhAT/PAXir/eAqZfCbeuKOwGnkZ:fnDSvbWUafdEOj0nFhQPnhuy+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2296-17-0x00007FFD72DD0000-0x00007FFD72DD1000-memory.dmp

Download

memory/2296-109-0x0000029530260000-0x00000295303AA000-memory.dmp

Download

memory/2296-277-0x0000029530260000-0x00000295303AA000-memory.dmp

Download

memory/10420-196-0x00007FFD56FF0000-0x00007FFD579DC000-memory.dmp

Download

memory/10420-176-0x0000018CF27F0000-0x0000018CF2800000-memory.dmp

Download

memory/10420-195-0x0000018CF27F0000-0x0000018CF2800000-memory.dmp

Download

memory/10420-174-0x00007FFD56FF0000-0x00007FFD579DC000-memory.dmp

Download

memory/10420-177-0x0000018CF27F0000-0x0000018CF2800000-memory.dmp

Download

memory/10504-257-0x000001C1389D0000-0x000001C1389E0000-memory.dmp

Download

memory/10504-235-0x000001C1389D0000-0x000001C1389E0000-memory.dmp

Download

memory/10504-276-0x00007FFD56FF0000-0x00007FFD579DC000-memory.dmp

Download

memory/10504-236-0x000001C1389D0000-0x000001C1389E0000-memory.dmp

Download

memory/10504-232-0x00007FFD56FF0000-0x00007FFD579DC000-memory.dmp

Download

memory/10504-272-0x000001C1389D0000-0x000001C1389E0000-memory.dmp

Download

memory/10532-52-0x000001D32CE40000-0x000001D32CEB6000-memory.dmp

Download

memory/10532-72-0x00007FFD56FF0000-0x00007FFD579DC000-memory.dmp

Download

memory/10532-71-0x000001D312D60000-0x000001D312D70000-memory.dmp

Download

memory/10532-49-0x000001D32CC90000-0x000001D32CCB2000-memory.dmp

Download

memory/10532-48-0x000001D312D60000-0x000001D312D70000-memory.dmp

Download

memory/10532-47-0x000001D312D60000-0x000001D312D70000-memory.dmp

Download

memory/10532-46-0x00007FFD56FF0000-0x00007FFD579DC000-memory.dmp

Download

memory/10776-104-0x00007FFD56FF0000-0x00007FFD579DC000-memory.dmp

Download

memory/10776-103-0x000001A09B530000-0x000001A09B540000-memory.dmp

Download

memory/10776-80-0x00007FFD56FF0000-0x00007FFD579DC000-memory.dmp

Download

memory/10776-81-0x000001A09B530000-0x000001A09B540000-memory.dmp

Download

memory/10776-82-0x000001A09B530000-0x000001A09B540000-memory.dmp

Download