538dd553c5c9e064cbdea35488d231a5ac1a269971c10ff9edd832ee4c3831d0

Resubmissions

26/03/2024, 23:58

240326-31d1dafc263

26/03/2024, 23:55

25/03/2024, 23:41

25/03/2024, 23:38

25/03/2024, 23:14

25/03/2024, 22:57

25/03/2024, 22:54

25/03/2024, 22:53

Analysis

max time kernel
130s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MegaBoyVM.exe
Size 102KB
Sample240325-2vtm7sdc7x
SHA256 8a16e748ca24d7f8a5205501fd381cef33c6bbbb2e715abf6b91f486ad6afd2d
MD5 f0de1a04aa9ee6d1e8d6fb391ce10034
SHA1 e0ccf4a81f920997b5f2dbb7209844491e774647
SHA512 12818c13cb4084dcfdf0c804ef95eb0c131d71a2ddc1323eee35dbf1848f140bbd24f6e5e6265629eabf5de46ae8cb2e74eb42016e285dbcef7314e4063fe5ab
SSDEEP 1536:3yU9NZjogIvPTr3t3wYujhlht9gOmUrabXYNBalr0y2uCB8u4jx9bSHACiH:CwNeN3w/jhlhE1Z8Nig9L8u4N9bSE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	MegaBoyVM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4516	MegaBoyVM.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4516	MegaBoyVM.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	MegaBoyVM.exe
Token: SeDebugPrivilege	4416	taskmgr.exe
Token: SeSystemProfilePrivilege	4416	taskmgr.exe
Token: SeCreateGlobalPrivilege	4416	taskmgr.exe
Token: 33	4416	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4416	taskmgr.exe
Token: SeDebugPrivilege	13100	taskmgr.exe
Token: SeSystemProfilePrivilege	13100	taskmgr.exe
Token: SeCreateGlobalPrivilege	13100	taskmgr.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4516	MegaBoyVM.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe
13100	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 5012	4516	MegaBoyVM.exe	110
PID 4516 wrote to memory of 5012	4516	MegaBoyVM.exe	110
PID 4516 wrote to memory of 3168	4516	MegaBoyVM.exe	112
PID 4516 wrote to memory of 3168	4516	MegaBoyVM.exe	112
PID 4516 wrote to memory of 64	4516	MegaBoyVM.exe	114
PID 4516 wrote to memory of 64	4516	MegaBoyVM.exe	114
PID 4516 wrote to memory of 3956	4516	MegaBoyVM.exe	116
PID 4516 wrote to memory of 3956	4516	MegaBoyVM.exe	116
PID 4516 wrote to memory of 3060	4516	MegaBoyVM.exe	118
PID 4516 wrote to memory of 3060	4516	MegaBoyVM.exe	118
PID 4516 wrote to memory of 944	4516	MegaBoyVM.exe	120
PID 4516 wrote to memory of 944	4516	MegaBoyVM.exe	120
PID 4516 wrote to memory of 4784	4516	MegaBoyVM.exe	122
PID 4516 wrote to memory of 4784	4516	MegaBoyVM.exe	122
PID 4516 wrote to memory of 4428	4516	MegaBoyVM.exe	124
PID 4516 wrote to memory of 4428	4516	MegaBoyVM.exe	124
PID 4516 wrote to memory of 3584	4516	MegaBoyVM.exe	126
PID 4516 wrote to memory of 3584	4516	MegaBoyVM.exe	126
PID 4516 wrote to memory of 4792	4516	MegaBoyVM.exe	128
PID 4516 wrote to memory of 4792	4516	MegaBoyVM.exe	128
PID 4516 wrote to memory of 3764	4516	MegaBoyVM.exe	130
PID 4516 wrote to memory of 3764	4516	MegaBoyVM.exe	130
PID 4516 wrote to memory of 3432	4516	MegaBoyVM.exe	132
PID 4516 wrote to memory of 3432	4516	MegaBoyVM.exe	132
PID 4516 wrote to memory of 3952	4516	MegaBoyVM.exe	134
PID 4516 wrote to memory of 3952	4516	MegaBoyVM.exe	134
PID 4516 wrote to memory of 5128	4516	MegaBoyVM.exe	136
PID 4516 wrote to memory of 5128	4516	MegaBoyVM.exe	136
PID 4516 wrote to memory of 5168	4516	MegaBoyVM.exe	138
PID 4516 wrote to memory of 5168	4516	MegaBoyVM.exe	138
PID 4516 wrote to memory of 5224	4516	MegaBoyVM.exe	140
PID 4516 wrote to memory of 5224	4516	MegaBoyVM.exe	140
PID 4516 wrote to memory of 5256	4516	MegaBoyVM.exe	142
PID 4516 wrote to memory of 5256	4516	MegaBoyVM.exe	142
PID 4516 wrote to memory of 5316	4516	MegaBoyVM.exe	144
PID 4516 wrote to memory of 5316	4516	MegaBoyVM.exe	144
PID 4516 wrote to memory of 5364	4516	MegaBoyVM.exe	146
PID 4516 wrote to memory of 5364	4516	MegaBoyVM.exe	146
PID 4516 wrote to memory of 5424	4516	MegaBoyVM.exe	148
PID 4516 wrote to memory of 5424	4516	MegaBoyVM.exe	148
PID 4516 wrote to memory of 5456	4516	MegaBoyVM.exe	150
PID 4516 wrote to memory of 5456	4516	MegaBoyVM.exe	150
PID 4516 wrote to memory of 5528	4516	MegaBoyVM.exe	152
PID 4516 wrote to memory of 5528	4516	MegaBoyVM.exe	152
PID 4516 wrote to memory of 5564	4516	MegaBoyVM.exe	154
PID 4516 wrote to memory of 5564	4516	MegaBoyVM.exe	154
PID 4516 wrote to memory of 5648	4516	MegaBoyVM.exe	156
PID 4516 wrote to memory of 5648	4516	MegaBoyVM.exe	156
PID 4516 wrote to memory of 5688	4516	MegaBoyVM.exe	158
PID 4516 wrote to memory of 5688	4516	MegaBoyVM.exe	158
PID 4516 wrote to memory of 5732	4516	MegaBoyVM.exe	160
PID 4516 wrote to memory of 5732	4516	MegaBoyVM.exe	160
PID 4516 wrote to memory of 5768	4516	MegaBoyVM.exe	162
PID 4516 wrote to memory of 5768	4516	MegaBoyVM.exe	162
PID 4516 wrote to memory of 5816	4516	MegaBoyVM.exe	164
PID 4516 wrote to memory of 5816	4516	MegaBoyVM.exe	164
PID 4516 wrote to memory of 5868	4516	MegaBoyVM.exe	166
PID 4516 wrote to memory of 5868	4516	MegaBoyVM.exe	166
PID 4516 wrote to memory of 5916	4516	MegaBoyVM.exe	168
PID 4516 wrote to memory of 5916	4516	MegaBoyVM.exe	168
PID 4516 wrote to memory of 5972	4516	MegaBoyVM.exe	170
PID 4516 wrote to memory of 5972	4516	MegaBoyVM.exe	170
PID 4516 wrote to memory of 6012	4516	MegaBoyVM.exe	172
PID 4516 wrote to memory of 6012	4516	MegaBoyVM.exe	172

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:64
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:10272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:11908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:13008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:13060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:13140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:13184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:12220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:9100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8
1⤵
PID:3372

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:440

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4416

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:13100

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4416-14-0x000002138B120000-0x000002138B121000-memory.dmp

Download

memory/4416-25-0x000002138B120000-0x000002138B121000-memory.dmp

Download

memory/4416-24-0x000002138B120000-0x000002138B121000-memory.dmp

Download

memory/4416-23-0x000002138B120000-0x000002138B121000-memory.dmp

Download

memory/4416-22-0x000002138B120000-0x000002138B121000-memory.dmp

Download

memory/4416-21-0x000002138B120000-0x000002138B121000-memory.dmp

Download

memory/4416-20-0x000002138B120000-0x000002138B121000-memory.dmp

Download

memory/4416-19-0x000002138B120000-0x000002138B121000-memory.dmp

Download

memory/4416-15-0x000002138B120000-0x000002138B121000-memory.dmp

Download

memory/4416-13-0x000002138B120000-0x000002138B121000-memory.dmp

Download

memory/4516-8-0x000000001B510000-0x000000001B52E000-memory.dmp

Download

memory/4516-2-0x000000001B180000-0x000000001B190000-memory.dmp

Download

memory/4516-12-0x000000001B100000-0x000000001B112000-memory.dmp

Download

memory/4516-10-0x000000001B540000-0x000000001B686000-memory.dmp

Download

memory/4516-9-0x000000001B110000-0x000000001B134000-memory.dmp

Download

memory/4516-0-0x0000000000100000-0x0000000000120000-memory.dmp

Download

memory/4516-7-0x000000001B3D0000-0x000000001B3DC000-memory.dmp

Download

memory/4516-6-0x000000001C5F0000-0x000000001C666000-memory.dmp

Download

memory/4516-5-0x000000001B110000-0x000000001B137000-memory.dmp

Download

memory/4516-4-0x000000001B180000-0x000000001B190000-memory.dmp

Download

memory/4516-3-0x00007FF9B60C0000-0x00007FF9B6B81000-memory.dmp

Download

memory/4516-11-0x000000001B110000-0x000000001B134000-memory.dmp

Download

memory/4516-1-0x00007FF9B60C0000-0x00007FF9B6B81000-memory.dmp

Download

memory/4516-26-0x000000001B110000-0x000000001B134000-memory.dmp

Download

memory/4516-27-0x000000001B180000-0x000000001B190000-memory.dmp

Download

memory/4516-30-0x000000001B110000-0x000000001B134000-memory.dmp

Download

memory/4516-31-0x000000001B180000-0x000000001B190000-memory.dmp

Download

memory/4516-32-0x000000001B110000-0x000000001B134000-memory.dmp

Download

memory/4516-33-0x000000001B180000-0x000000001B190000-memory.dmp

Download

memory/4516-35-0x000000001B110000-0x000000001B134000-memory.dmp

Download

memory/4516-36-0x000000001B110000-0x000000001B134000-memory.dmp

Download

memory/4516-37-0x000000001B190000-0x000000001B1A2000-memory.dmp

Download