Overview
overview
10Static
static
3b58456e3c4...4c.exe
windows7-x64
10b58456e3c4...4c.exe
windows10-2004-x64
10$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1azkzkzz.exe
windows7-x64
10azkzkzz.exe
windows10-2004-x64
10d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...dex.js
windows7-x64
1resources/...dex.js
windows10-2004-x64
1resources/....2.bat
windows7-x64
7resources/....2.bat
windows10-2004-x64
7resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-03-2024 03:40
Static task
static1
Behavioral task
behavioral1
Sample
b58456e3c4b2fd055f01e7fcbb732bb91bd5d98209ffd71687046fd45b92094c.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
b58456e3c4b2fd055f01e7fcbb732bb91bd5d98209ffd71687046fd45b92094c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240319-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
azkzkzz.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral10
Sample
azkzkzz.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
swiftshader/libEGL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral25
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral27
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240221-en
windows7-x64
General
-
Target
azkzkzz.exe
-
Size
134.3MB
-
MD5
d731a941b7e19d97e648a8814c2261b7
-
SHA1
7d4dab7356bcaad4b8ddfa9e1aa123e070453fc5
-
SHA256
3357e2751c152a44e9ec41d08205d70f9fc185d59ec0bf30b2e5a1009c917046
-
SHA512
9c634c9530232715bf8984cc1f51042891e049abd47a946257c098bfeca5b1755fb99be4a4928ca49e29cd8a86a212e7a35537b23c0f80c87bb7429e40a3aa5a
-
SSDEEP
1572864:XicLgaO9p7sMMcmhRhgBx/CyhwGKsME1:khTRsJE1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation azkzkzz.exe -
Loads dropped DLL 2 IoCs
pid Process 2912 azkzkzz.exe 2912 azkzkzz.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsBootManager = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\0\\WindowsBootManager.exe" reg.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ipinfo.io 3 ipinfo.io -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1768 WMIC.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1412 tasklist.exe 2056 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2776 azkzkzz.exe 2912 azkzkzz.exe 2912 azkzkzz.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2488 WMIC.exe Token: SeSecurityPrivilege 2488 WMIC.exe Token: SeTakeOwnershipPrivilege 2488 WMIC.exe Token: SeLoadDriverPrivilege 2488 WMIC.exe Token: SeSystemProfilePrivilege 2488 WMIC.exe Token: SeSystemtimePrivilege 2488 WMIC.exe Token: SeProfSingleProcessPrivilege 2488 WMIC.exe Token: SeIncBasePriorityPrivilege 2488 WMIC.exe Token: SeCreatePagefilePrivilege 2488 WMIC.exe Token: SeBackupPrivilege 2488 WMIC.exe Token: SeRestorePrivilege 2488 WMIC.exe Token: SeShutdownPrivilege 2488 WMIC.exe Token: SeDebugPrivilege 2488 WMIC.exe Token: SeSystemEnvironmentPrivilege 2488 WMIC.exe Token: SeRemoteShutdownPrivilege 2488 WMIC.exe Token: SeUndockPrivilege 2488 WMIC.exe Token: SeManageVolumePrivilege 2488 WMIC.exe Token: 33 2488 WMIC.exe Token: 34 2488 WMIC.exe Token: 35 2488 WMIC.exe Token: SeIncreaseQuotaPrivilege 2488 WMIC.exe Token: SeSecurityPrivilege 2488 WMIC.exe Token: SeTakeOwnershipPrivilege 2488 WMIC.exe Token: SeLoadDriverPrivilege 2488 WMIC.exe Token: SeSystemProfilePrivilege 2488 WMIC.exe Token: SeSystemtimePrivilege 2488 WMIC.exe Token: SeProfSingleProcessPrivilege 2488 WMIC.exe Token: SeIncBasePriorityPrivilege 2488 WMIC.exe Token: SeCreatePagefilePrivilege 2488 WMIC.exe Token: SeBackupPrivilege 2488 WMIC.exe Token: SeRestorePrivilege 2488 WMIC.exe Token: SeShutdownPrivilege 2488 WMIC.exe Token: SeDebugPrivilege 2488 WMIC.exe Token: SeSystemEnvironmentPrivilege 2488 WMIC.exe Token: SeRemoteShutdownPrivilege 2488 WMIC.exe Token: SeUndockPrivilege 2488 WMIC.exe Token: SeManageVolumePrivilege 2488 WMIC.exe Token: 33 2488 WMIC.exe Token: 34 2488 WMIC.exe Token: 35 2488 WMIC.exe Token: SeDebugPrivilege 1412 tasklist.exe Token: SeIncreaseQuotaPrivilege 1584 WMIC.exe Token: SeSecurityPrivilege 1584 WMIC.exe Token: SeTakeOwnershipPrivilege 1584 WMIC.exe Token: SeLoadDriverPrivilege 1584 WMIC.exe Token: SeSystemProfilePrivilege 1584 WMIC.exe Token: SeSystemtimePrivilege 1584 WMIC.exe Token: SeProfSingleProcessPrivilege 1584 WMIC.exe Token: SeIncBasePriorityPrivilege 1584 WMIC.exe Token: SeCreatePagefilePrivilege 1584 WMIC.exe Token: SeBackupPrivilege 1584 WMIC.exe Token: SeRestorePrivilege 1584 WMIC.exe Token: SeShutdownPrivilege 1584 WMIC.exe Token: SeDebugPrivilege 1584 WMIC.exe Token: SeSystemEnvironmentPrivilege 1584 WMIC.exe Token: SeRemoteShutdownPrivilege 1584 WMIC.exe Token: SeUndockPrivilege 1584 WMIC.exe Token: SeManageVolumePrivilege 1584 WMIC.exe Token: 33 1584 WMIC.exe Token: 34 1584 WMIC.exe Token: 35 1584 WMIC.exe Token: SeIncreaseQuotaPrivilege 1584 WMIC.exe Token: SeSecurityPrivilege 1584 WMIC.exe Token: SeTakeOwnershipPrivilege 1584 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 112 2912 azkzkzz.exe 28 PID 2912 wrote to memory of 112 2912 azkzkzz.exe 28 PID 2912 wrote to memory of 112 2912 azkzkzz.exe 28 PID 112 wrote to memory of 2488 112 cmd.exe 30 PID 112 wrote to memory of 2488 112 cmd.exe 30 PID 112 wrote to memory of 2488 112 cmd.exe 30 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 2156 2912 azkzkzz.exe 31 PID 2912 wrote to memory of 1060 2912 azkzkzz.exe 33 PID 2912 wrote to memory of 1060 2912 azkzkzz.exe 33 PID 2912 wrote to memory of 1060 2912 azkzkzz.exe 33 PID 2912 wrote to memory of 2316 2912 azkzkzz.exe 35 PID 2912 wrote to memory of 2316 2912 azkzkzz.exe 35 PID 2912 wrote to memory of 2316 2912 azkzkzz.exe 35 PID 2912 wrote to memory of 2400 2912 azkzkzz.exe 37 PID 2912 wrote to memory of 2400 2912 azkzkzz.exe 37 PID 2912 wrote to memory of 2400 2912 azkzkzz.exe 37 PID 1060 wrote to memory of 2304 1060 cmd.exe 39 PID 1060 wrote to memory of 2304 1060 cmd.exe 39 PID 1060 wrote to memory of 2304 1060 cmd.exe 39 PID 2316 wrote to memory of 2260 2316 cmd.exe 40 PID 2316 wrote to memory of 2260 2316 cmd.exe 40 PID 2316 wrote to memory of 2260 2316 cmd.exe 40 PID 2400 wrote to memory of 1412 2400 cmd.exe 41 PID 2400 wrote to memory of 1412 2400 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe"C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"2⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\System32\Wbem\WMIC.exewmic CsProduct Get UUID3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
-
C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe"C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe" --type=gpu-process --field-trial-handle=1004,16923892679218296054,15231565249126564527,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\azkzkzz" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1032 /prefetch:22⤵PID:2156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""2⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"3⤵PID:2304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"2⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath3⤵PID:2260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"2⤵PID:1696
-
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2096
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:1768
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"2⤵PID:1640
-
C:\Windows\system32\cmd.execmd /c chcp 650013⤵PID:2440
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:852
-
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵PID:856
-
-
-
C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe"C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1004,16923892679218296054,15231565249126564527,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\azkzkzz" --mojo-platform-channel-handle=1576 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe"C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe" --type=gpu-process --field-trial-handle=1004,16923892679218296054,15231565249126564527,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\azkzkzz" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1184 /prefetch:22⤵PID:2692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"2⤵PID:1192
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f3⤵
- Adds Run key to start application
PID:1232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1912
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:2056
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD5810ae82f863a5ffae14d3b3944252a4e
SHA15393e27113753191436b14f0cafa8acabcfe6b2a
SHA256453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c
SHA5122421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112
-
Filesize
231B
MD5dec2be4f1ec3592cea668aa279e7cc9b
SHA1327cf8ab0c895e10674e00ea7f437784bb11d718
SHA256753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc
SHA51281728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66
-
Filesize
652KB
MD562e1d2c1e9f2479c3bdb64616b6d47bd
SHA1e0bdf6bdfdf2565b55ea4a34b89d98359ea04028
SHA256b825114f3e6cacfc4807bba2825fd281930704ea56e977083fb5a48d6bd7e854
SHA5126408b8141b37ece131359cb94a3a6d015119099a59473fa7d55cf5cfb1746178c0f40d32772d607ed872ff135f27a40971895a7687f92182a1d40dba9285e07c
-
Filesize
2.7MB
MD5e72c7a160113e02f2154990f33eb444b
SHA1631daf946d96a54ddb5b55b810e0643c488d2d5c
SHA25625597c0ab98fe98ba9de6256e4aa6879a273fe9d475c8616e370d3334ba8b359
SHA5123981a2bdf33f6c5cae8d7592aa23ab3f6462c3905b90b5ac5de5e8f7dee90c894c7a30dc227a7a8cce6c9567ad674b6fa839e3ac81cfeece6c71d2ab7e15de3f