4ef44954ca1192d62c7305a7ba83986a3c98744a112ae7b4ea5a1afe635f5887

Resubmissions

07/04/2024, 23:06

240407-23wgrshd727

07/04/2024, 22:33

240407-2gjwvage2w7

07/04/2024, 22:21

240407-193nzsgd623

Analysis

max time kernel
239s
max time network
245s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Judosa Point.exe
Size 73.4MB
Sample240407-23wgrshd72
SHA256 972c671ab90ff0f6918f9e50b5c03ba03eb137a103d58c8f9296a45198e5795f
MD5 eb3f4d5675cb14b5319088e6f467e75a
SHA1 a6761e558df1db71137ac621bd305def9f77814b
SHA512 b00d4eb2e8802c20b50674d9f0d4de655fb157727f7a85b28adf77a72d9485c79ffe2358e0ff65de5ceaa38e90fed6d00a00f1f816607220b73778a1ae36504b
SSDEEP 1572864:PpJ39Kk9MjWKCKVM5B8ceyIS7nqYdd6hIEhSmnJZxRByuZXFqsB:Pwk9MjxCSE/vP7nMhJnzxRB5ZX5B
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	0x32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	0x32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	0x32.exe

Executes dropped EXE 14 IoCs

pid	Process
4196	0x32.exe
4304	0x32.exe
4420	0x32.exe
2856	0x32.exe
1988	0x32.exe
4312	0x32.exe
1116	0x32.exe
4888	0x32.exe
3596	0x32.exe
1800	0x32.exe
3480	0x32.exe
4244	0x32.exe
3028	elevate.exe
1640	0x32.exe

Loads dropped DLL 36 IoCs

pid	Process
4892	Judosa Point.exe
4892	Judosa Point.exe
4892	Judosa Point.exe
4892	Judosa Point.exe
4892	Judosa Point.exe
4892	Judosa Point.exe
4892	Judosa Point.exe
4196	0x32.exe
4196	0x32.exe
4304	0x32.exe
4420	0x32.exe
4304	0x32.exe
4304	0x32.exe
4304	0x32.exe
4304	0x32.exe
2856	0x32.exe
1988	0x32.exe
1988	0x32.exe
4312	0x32.exe
1116	0x32.exe
4312	0x32.exe
4312	0x32.exe
4312	0x32.exe
4312	0x32.exe
4888	0x32.exe
3596	0x32.exe
3596	0x32.exe
1800	0x32.exe
1800	0x32.exe
3480	0x32.exe
4244	0x32.exe
3480	0x32.exe
3480	0x32.exe
3480	0x32.exe
3480	0x32.exe
1640	0x32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
46	api.ipify.org

An obfuscated cmd.exe command-line is typically used to evade detection. 6 IoCs

pid	Process
2148	cmd.exe
3824	cmd.exe
4240	cmd.exe
848	cmd.exe
620	cmd.exe
3288	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 7 IoCs

Process Discovery

T1057

pid	Process
4720	tasklist.exe
1232	tasklist.exe
1104	tasklist.exe
3212	tasklist.exe
2264	tasklist.exe
4320	tasklist.exe
536	tasklist.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4892	Judosa Point.exe
4892	Judosa Point.exe
536	tasklist.exe
536	tasklist.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
1620	powershell.exe
1620	powershell.exe
1620	powershell.exe
1632	powershell.exe
1632	powershell.exe
4420	0x32.exe
4420	0x32.exe
3968	powershell.exe
3968	powershell.exe
3880	powershell.exe
3880	powershell.exe
3880	powershell.exe
1980	powershell.exe
1980	powershell.exe
1980	powershell.exe
3292	powershell.exe
3292	powershell.exe
1116	0x32.exe
1116	0x32.exe
4732	powershell.exe
4732	powershell.exe
3596	0x32.exe
3596	0x32.exe
3596	0x32.exe
3596	0x32.exe
3328	powershell.exe
3328	powershell.exe
924	powershell.exe
924	powershell.exe
2336	powershell.exe
2336	powershell.exe
4244	0x32.exe
4244	0x32.exe
2572	powershell.exe
2572	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	tasklist.exe
Token: SeSecurityPrivilege	4892	Judosa Point.exe
Token: SeDebugPrivilege	4720	tasklist.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	1232	tasklist.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeShutdownPrivilege	4196	0x32.exe
Token: SeCreatePagefilePrivilege	4196	0x32.exe
Token: SeIncreaseQuotaPrivilege	3100	WMIC.exe
Token: SeSecurityPrivilege	3100	WMIC.exe
Token: SeTakeOwnershipPrivilege	3100	WMIC.exe
Token: SeLoadDriverPrivilege	3100	WMIC.exe
Token: SeSystemProfilePrivilege	3100	WMIC.exe
Token: SeSystemtimePrivilege	3100	WMIC.exe
Token: SeProfSingleProcessPrivilege	3100	WMIC.exe
Token: SeIncBasePriorityPrivilege	3100	WMIC.exe
Token: SeCreatePagefilePrivilege	3100	WMIC.exe
Token: SeBackupPrivilege	3100	WMIC.exe
Token: SeRestorePrivilege	3100	WMIC.exe
Token: SeShutdownPrivilege	3100	WMIC.exe
Token: SeDebugPrivilege	3100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3100	WMIC.exe
Token: SeRemoteShutdownPrivilege	3100	WMIC.exe
Token: SeUndockPrivilege	3100	WMIC.exe
Token: SeManageVolumePrivilege	3100	WMIC.exe
Token: 33	3100	WMIC.exe
Token: 34	3100	WMIC.exe
Token: 35	3100	WMIC.exe
Token: 36	3100	WMIC.exe
Token: SeShutdownPrivilege	4196	0x32.exe
Token: SeCreatePagefilePrivilege	4196	0x32.exe
Token: SeIncreaseQuotaPrivilege	3100	WMIC.exe
Token: SeSecurityPrivilege	3100	WMIC.exe
Token: SeTakeOwnershipPrivilege	3100	WMIC.exe
Token: SeLoadDriverPrivilege	3100	WMIC.exe
Token: SeSystemProfilePrivilege	3100	WMIC.exe
Token: SeSystemtimePrivilege	3100	WMIC.exe
Token: SeProfSingleProcessPrivilege	3100	WMIC.exe
Token: SeIncBasePriorityPrivilege	3100	WMIC.exe
Token: SeCreatePagefilePrivilege	3100	WMIC.exe
Token: SeBackupPrivilege	3100	WMIC.exe
Token: SeRestorePrivilege	3100	WMIC.exe
Token: SeShutdownPrivilege	3100	WMIC.exe
Token: SeDebugPrivilege	3100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3100	WMIC.exe
Token: SeRemoteShutdownPrivilege	3100	WMIC.exe
Token: SeUndockPrivilege	3100	WMIC.exe
Token: SeManageVolumePrivilege	3100	WMIC.exe
Token: 33	3100	WMIC.exe
Token: 34	3100	WMIC.exe
Token: 35	3100	WMIC.exe
Token: 36	3100	WMIC.exe
Token: SeShutdownPrivilege	4196	0x32.exe
Token: SeCreatePagefilePrivilege	4196	0x32.exe
Token: SeShutdownPrivilege	4196	0x32.exe
Token: SeCreatePagefilePrivilege	4196	0x32.exe
Token: SeIncreaseQuotaPrivilege	3564	WMIC.exe
Token: SeSecurityPrivilege	3564	WMIC.exe
Token: SeTakeOwnershipPrivilege	3564	WMIC.exe
Token: SeLoadDriverPrivilege	3564	WMIC.exe
Token: SeSystemProfilePrivilege	3564	WMIC.exe
Token: SeSystemtimePrivilege	3564	WMIC.exe
Token: SeProfSingleProcessPrivilege	3564	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3140	4892	Judosa Point.exe	88
PID 4892 wrote to memory of 3140	4892	Judosa Point.exe	88
PID 4892 wrote to memory of 3140	4892	Judosa Point.exe	88
PID 3140 wrote to memory of 536	3140	cmd.exe	90
PID 3140 wrote to memory of 536	3140	cmd.exe	90
PID 3140 wrote to memory of 536	3140	cmd.exe	90
PID 3140 wrote to memory of 1412	3140	cmd.exe	91
PID 3140 wrote to memory of 1412	3140	cmd.exe	91
PID 3140 wrote to memory of 1412	3140	cmd.exe	91
PID 4196 wrote to memory of 2340	4196	0x32.exe	105
PID 4196 wrote to memory of 2340	4196	0x32.exe	105
PID 4196 wrote to memory of 1988	4196	0x32.exe	106
PID 4196 wrote to memory of 1988	4196	0x32.exe	106
PID 1988 wrote to memory of 4720	1988	cmd.exe	110
PID 1988 wrote to memory of 4720	1988	cmd.exe	110
PID 2340 wrote to memory of 4576	2340	cmd.exe	109
PID 2340 wrote to memory of 4576	2340	cmd.exe	109
PID 4196 wrote to memory of 3260	4196	0x32.exe	111
PID 4196 wrote to memory of 3260	4196	0x32.exe	111
PID 4196 wrote to memory of 2148	4196	0x32.exe	112
PID 4196 wrote to memory of 2148	4196	0x32.exe	112
PID 3260 wrote to memory of 1232	3260	cmd.exe	115
PID 3260 wrote to memory of 1232	3260	cmd.exe	115
PID 2148 wrote to memory of 1620	2148	cmd.exe	139
PID 2148 wrote to memory of 1620	2148	cmd.exe	139
PID 4196 wrote to memory of 3824	4196	0x32.exe	117
PID 4196 wrote to memory of 3824	4196	0x32.exe	117
PID 3824 wrote to memory of 1632	3824	cmd.exe	119
PID 3824 wrote to memory of 1632	3824	cmd.exe	119
PID 4196 wrote to memory of 2668	4196	0x32.exe	121
PID 4196 wrote to memory of 2668	4196	0x32.exe	121
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4304	4196	0x32.exe	120
PID 4196 wrote to memory of 4420	4196	0x32.exe	123
PID 4196 wrote to memory of 4420	4196	0x32.exe	123

C:\Users\Admin\AppData\Local\Temp\Judosa Point.exe
"C:\Users\Admin\AppData\Local\Temp\Judosa Point.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq 0x32.exe" | %SYSTEMROOT%\System32\find.exe "0x32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq 0x32.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:536
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\System32\find.exe "0x32.exe"
    3⤵
    PID:1412

C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe
"C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,207,176,84,217,60,156,184,59,3,27,231,184,96,180,176,22,190,214,124,225,126,33,24,28,196,26,70,57,195,110,188,82,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,30,83,80,130,223,215,209,200,154,200,135,30,7,211,45,117,47,236,133,54,162,197,248,48,15,191,4,221,82,229,239,73,48,0,0,0,242,255,149,87,119,78,203,254,44,206,112,166,170,56,159,42,141,204,250,131,129,122,112,139,143,245,150,254,135,4,213,203,225,73,250,206,251,122,33,94,166,36,90,11,101,93,151,175,64,0,0,0,160,247,120,235,5,145,28,214,21,43,57,158,137,156,192,137,204,32,47,26,118,70,86,248,246,160,26,236,190,176,49,87,14,250,197,37,89,219,92,10,168,37,162,180,48,244,74,4,145,119,28,38,226,69,36,114,141,14,108,246,190,243,105,236), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,207,176,84,217,60,156,184,59,3,27,231,184,96,180,176,22,190,214,124,225,126,33,24,28,196,26,70,57,195,110,188,82,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,30,83,80,130,223,215,209,200,154,200,135,30,7,211,45,117,47,236,133,54,162,197,248,48,15,191,4,221,82,229,239,73,48,0,0,0,242,255,149,87,119,78,203,254,44,206,112,166,170,56,159,42,141,204,250,131,129,122,112,139,143,245,150,254,135,4,213,203,225,73,250,206,251,122,33,94,166,36,90,11,101,93,151,175,64,0,0,0,160,247,120,235,5,145,28,214,21,43,57,158,137,156,192,137,204,32,47,26,118,70,86,248,246,160,26,236,190,176,49,87,14,250,197,37,89,219,92,10,168,37,162,180,48,244,74,4,145,119,28,38,226,69,36,114,141,14,108,246,190,243,105,236), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,65,175,34,250,158,248,47,122,214,12,177,5,236,230,160,214,54,9,146,172,200,64,166,247,115,211,191,65,67,226,141,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,98,178,61,180,99,60,64,189,114,141,41,44,142,240,192,46,164,34,135,204,86,18,252,196,99,31,197,76,32,227,52,191,48,0,0,0,163,242,13,136,184,138,94,89,30,226,191,237,96,45,115,176,235,168,27,29,123,32,152,89,96,235,171,142,225,115,229,222,160,238,79,11,59,253,161,149,56,39,5,178,191,80,16,62,64,0,0,0,170,27,181,16,68,18,53,67,196,152,228,52,101,132,193,39,212,87,252,149,78,100,15,84,48,124,239,144,250,7,17,140,10,229,7,13,35,191,185,220,162,6,217,41,30,90,185,255,149,203,57,70,43,19,17,179,103,72,89,68,171,124,83,118), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,65,175,34,250,158,248,47,122,214,12,177,5,236,230,160,214,54,9,146,172,200,64,166,247,115,211,191,65,67,226,141,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,98,178,61,180,99,60,64,189,114,141,41,44,142,240,192,46,164,34,135,204,86,18,252,196,99,31,197,76,32,227,52,191,48,0,0,0,163,242,13,136,184,138,94,89,30,226,191,237,96,45,115,176,235,168,27,29,123,32,152,89,96,235,171,142,225,115,229,222,160,238,79,11,59,253,161,149,56,39,5,178,191,80,16,62,64,0,0,0,170,27,181,16,68,18,53,67,196,152,228,52,101,132,193,39,212,87,252,149,78,100,15,84,48,124,239,144,250,7,17,140,10,229,7,13,35,191,185,220,162,6,217,41,30,90,185,255,149,203,57,70,43,19,17,179,103,72,89,68,171,124,83,118), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe
  "C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\0x32" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 --field-trial-handle=1996,i,9804405808972716550,3998277134705273630,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name"
  2⤵
  PID:2668
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3100
- C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe
  "C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\0x32" --mojo-platform-channel-handle=2080 --field-trial-handle=1996,i,9804405808972716550,3998277134705273630,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get ProcessorId"
  2⤵
  PID:5096
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get ProcessorId
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product"
  2⤵
  PID:4392
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product
    3⤵
    PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get SerialNumber"
  2⤵
  PID:2236
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber
    3⤵
    PID:4068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption"
  2⤵
  PID:1572
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption
    3⤵
    PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get TotalPhysicalMemory"
  2⤵
  PID:3408
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get TotalPhysicalMemory
    3⤵
    PID:1620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get caption,PNPDeviceID"
  2⤵
  PID:1400
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_videocontroller get caption,PNPDeviceID
    3⤵
    PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber"
  2⤵
  PID:2912
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber
    3⤵
    PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
  2⤵
  PID:3416
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "& {Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\0x32.exe' -ArgumentList 'MtKG8fnPKw' -WindowStyle Hidden}""
  2⤵
  PID:3000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "& {Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\0x32.exe' -ArgumentList 'MtKG8fnPKw' -WindowStyle Hidden}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\0x32.exe
      "C:\Users\Admin\AppData\Local\Temp\0x32.exe" MtKG8fnPKw
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2856
- C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe
  "C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\0x32" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 --field-trial-handle=1996,i,9804405808972716550,3998277134705273630,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2724

C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe
"C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:2000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2004
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:792
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,207,176,84,217,60,156,184,59,3,27,231,184,96,180,176,22,190,214,124,225,126,33,24,28,196,26,70,57,195,110,188,82,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,30,83,80,130,223,215,209,200,154,200,135,30,7,211,45,117,47,236,133,54,162,197,248,48,15,191,4,221,82,229,239,73,48,0,0,0,242,255,149,87,119,78,203,254,44,206,112,166,170,56,159,42,141,204,250,131,129,122,112,139,143,245,150,254,135,4,213,203,225,73,250,206,251,122,33,94,166,36,90,11,101,93,151,175,64,0,0,0,160,247,120,235,5,145,28,214,21,43,57,158,137,156,192,137,204,32,47,26,118,70,86,248,246,160,26,236,190,176,49,87,14,250,197,37,89,219,92,10,168,37,162,180,48,244,74,4,145,119,28,38,226,69,36,114,141,14,108,246,190,243,105,236), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  PID:4240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,207,176,84,217,60,156,184,59,3,27,231,184,96,180,176,22,190,214,124,225,126,33,24,28,196,26,70,57,195,110,188,82,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,30,83,80,130,223,215,209,200,154,200,135,30,7,211,45,117,47,236,133,54,162,197,248,48,15,191,4,221,82,229,239,73,48,0,0,0,242,255,149,87,119,78,203,254,44,206,112,166,170,56,159,42,141,204,250,131,129,122,112,139,143,245,150,254,135,4,213,203,225,73,250,206,251,122,33,94,166,36,90,11,101,93,151,175,64,0,0,0,160,247,120,235,5,145,28,214,21,43,57,158,137,156,192,137,204,32,47,26,118,70,86,248,246,160,26,236,190,176,49,87,14,250,197,37,89,219,92,10,168,37,162,180,48,244,74,4,145,119,28,38,226,69,36,114,141,14,108,246,190,243,105,236), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,65,175,34,250,158,248,47,122,214,12,177,5,236,230,160,214,54,9,146,172,200,64,166,247,115,211,191,65,67,226,141,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,98,178,61,180,99,60,64,189,114,141,41,44,142,240,192,46,164,34,135,204,86,18,252,196,99,31,197,76,32,227,52,191,48,0,0,0,163,242,13,136,184,138,94,89,30,226,191,237,96,45,115,176,235,168,27,29,123,32,152,89,96,235,171,142,225,115,229,222,160,238,79,11,59,253,161,149,56,39,5,178,191,80,16,62,64,0,0,0,170,27,181,16,68,18,53,67,196,152,228,52,101,132,193,39,212,87,252,149,78,100,15,84,48,124,239,144,250,7,17,140,10,229,7,13,35,191,185,220,162,6,217,41,30,90,185,255,149,203,57,70,43,19,17,179,103,72,89,68,171,124,83,118), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  PID:848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,65,175,34,250,158,248,47,122,214,12,177,5,236,230,160,214,54,9,146,172,200,64,166,247,115,211,191,65,67,226,141,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,98,178,61,180,99,60,64,189,114,141,41,44,142,240,192,46,164,34,135,204,86,18,252,196,99,31,197,76,32,227,52,191,48,0,0,0,163,242,13,136,184,138,94,89,30,226,191,237,96,45,115,176,235,168,27,29,123,32,152,89,96,235,171,142,225,115,229,222,160,238,79,11,59,253,161,149,56,39,5,178,191,80,16,62,64,0,0,0,170,27,181,16,68,18,53,67,196,152,228,52,101,132,193,39,212,87,252,149,78,100,15,84,48,124,239,144,250,7,17,140,10,229,7,13,35,191,185,220,162,6,217,41,30,90,185,255,149,203,57,70,43,19,17,179,103,72,89,68,171,124,83,118), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3292
- C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe
  "C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\0x32" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 --field-trial-handle=1936,i,5476611099820741712,10180559769370585673,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name"
  2⤵
  PID:4264
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:1040
- C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe
  "C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\0x32" --mojo-platform-channel-handle=1188 --field-trial-handle=1936,i,5476611099820741712,10180559769370585673,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get ProcessorId"
  2⤵
  PID:1020
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get ProcessorId
    3⤵
    PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product"
  2⤵
  PID:3116
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product
    3⤵
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get SerialNumber"
  2⤵
  PID:4104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption"
  2⤵
  PID:4012
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption
    3⤵
    PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get TotalPhysicalMemory"
  2⤵
  PID:1072
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get TotalPhysicalMemory
    3⤵
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get caption,PNPDeviceID"
  2⤵
  PID:2220
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_videocontroller get caption,PNPDeviceID
    3⤵
    PID:4716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber"
  2⤵
  PID:3524
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber
    3⤵
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
  2⤵
  PID:2336
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "& {Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\0x32.exe' -ArgumentList 'MtKG8fnPKw' -WindowStyle Hidden}""
  2⤵
  PID:2000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "& {Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\0x32.exe' -ArgumentList 'MtKG8fnPKw' -WindowStyle Hidden}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\0x32.exe
      "C:\Users\Admin\AppData\Local\Temp\0x32.exe" MtKG8fnPKw
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4888

C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe
"C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2244
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1624
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,207,176,84,217,60,156,184,59,3,27,231,184,96,180,176,22,190,214,124,225,126,33,24,28,196,26,70,57,195,110,188,82,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,30,83,80,130,223,215,209,200,154,200,135,30,7,211,45,117,47,236,133,54,162,197,248,48,15,191,4,221,82,229,239,73,48,0,0,0,242,255,149,87,119,78,203,254,44,206,112,166,170,56,159,42,141,204,250,131,129,122,112,139,143,245,150,254,135,4,213,203,225,73,250,206,251,122,33,94,166,36,90,11,101,93,151,175,64,0,0,0,160,247,120,235,5,145,28,214,21,43,57,158,137,156,192,137,204,32,47,26,118,70,86,248,246,160,26,236,190,176,49,87,14,250,197,37,89,219,92,10,168,37,162,180,48,244,74,4,145,119,28,38,226,69,36,114,141,14,108,246,190,243,105,236), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  PID:620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,207,176,84,217,60,156,184,59,3,27,231,184,96,180,176,22,190,214,124,225,126,33,24,28,196,26,70,57,195,110,188,82,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,30,83,80,130,223,215,209,200,154,200,135,30,7,211,45,117,47,236,133,54,162,197,248,48,15,191,4,221,82,229,239,73,48,0,0,0,242,255,149,87,119,78,203,254,44,206,112,166,170,56,159,42,141,204,250,131,129,122,112,139,143,245,150,254,135,4,213,203,225,73,250,206,251,122,33,94,166,36,90,11,101,93,151,175,64,0,0,0,160,247,120,235,5,145,28,214,21,43,57,158,137,156,192,137,204,32,47,26,118,70,86,248,246,160,26,236,190,176,49,87,14,250,197,37,89,219,92,10,168,37,162,180,48,244,74,4,145,119,28,38,226,69,36,114,141,14,108,246,190,243,105,236), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,65,175,34,250,158,248,47,122,214,12,177,5,236,230,160,214,54,9,146,172,200,64,166,247,115,211,191,65,67,226,141,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,98,178,61,180,99,60,64,189,114,141,41,44,142,240,192,46,164,34,135,204,86,18,252,196,99,31,197,76,32,227,52,191,48,0,0,0,163,242,13,136,184,138,94,89,30,226,191,237,96,45,115,176,235,168,27,29,123,32,152,89,96,235,171,142,225,115,229,222,160,238,79,11,59,253,161,149,56,39,5,178,191,80,16,62,64,0,0,0,170,27,181,16,68,18,53,67,196,152,228,52,101,132,193,39,212,87,252,149,78,100,15,84,48,124,239,144,250,7,17,140,10,229,7,13,35,191,185,220,162,6,217,41,30,90,185,255,149,203,57,70,43,19,17,179,103,72,89,68,171,124,83,118), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  PID:3288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,39,157,190,44,185,213,196,73,159,101,157,196,251,40,97,204,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,65,175,34,250,158,248,47,122,214,12,177,5,236,230,160,214,54,9,146,172,200,64,166,247,115,211,191,65,67,226,141,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,98,178,61,180,99,60,64,189,114,141,41,44,142,240,192,46,164,34,135,204,86,18,252,196,99,31,197,76,32,227,52,191,48,0,0,0,163,242,13,136,184,138,94,89,30,226,191,237,96,45,115,176,235,168,27,29,123,32,152,89,96,235,171,142,225,115,229,222,160,238,79,11,59,253,161,149,56,39,5,178,191,80,16,62,64,0,0,0,170,27,181,16,68,18,53,67,196,152,228,52,101,132,193,39,212,87,252,149,78,100,15,84,48,124,239,144,250,7,17,140,10,229,7,13,35,191,185,220,162,6,217,41,30,90,185,255,149,203,57,70,43,19,17,179,103,72,89,68,171,124,83,118), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2336
- C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe
  "C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\0x32" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,12775291147091568922,14262064230603767217,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name"
  2⤵
  PID:3812
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:3320
- C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe
  "C:\Users\Admin\AppData\Local\Programs\0x32\0x32.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\0x32" --mojo-platform-channel-handle=2032 --field-trial-handle=1976,i,12775291147091568922,14262064230603767217,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get ProcessorId"
  2⤵
  PID:3596
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get ProcessorId
    3⤵
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product"
  2⤵
  PID:3496
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product
    3⤵
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get SerialNumber"
  2⤵
  PID:3388
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber
    3⤵
    PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption"
  2⤵
  PID:4480
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption
    3⤵
    PID:2284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get TotalPhysicalMemory"
  2⤵
  PID:4040
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get TotalPhysicalMemory
    3⤵
    PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get caption,PNPDeviceID"
  2⤵
  PID:2648
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_videocontroller get caption,PNPDeviceID
    3⤵
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber"
  2⤵
  PID:2528
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber
    3⤵
    PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
  2⤵
  PID:3592
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "& {Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\0x32.exe' -ArgumentList 'MtKG8fnPKw' -WindowStyle Hidden}""
  2⤵
  PID:4240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "& {Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\0x32.exe' -ArgumentList 'MtKG8fnPKw' -WindowStyle Hidden}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\0x32.exe
      "C:\Users\Admin\AppData\Local\Temp\0x32.exe" MtKG8fnPKw
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1640

C:\Users\Admin\AppData\Local\Programs\0x32\resources\elevate.exe
"C:\Users\Admin\AppData\Local\Programs\0x32\resources\elevate.exe"
1⤵
- Executes dropped EXE
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passwords.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\passwords.db
Size 46KB
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
SSDEEP 96:9SXNKLyeymwHCn8MouOFlRGiZqYtFTCG:9SfHG7qqifTCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

webdata.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\webdata.db
Size 92KB
SHA256 12726259350583d4b137a4ca783e463b8629a198d6934a43818bdb726e5d858c
MD5 b10be874867a4f41849b9187cb98d1de
SHA1 2a2ceb44953f4978308e04286872050b5e2071e4
SHA512 1450573f2674676c124f0ee1beedcae92bc265d7c100fa587565ee15f13c94f69b9ece621742b0b840681a0b97bde3314508682ff85de75b78e27f39dfa46e0b
SSDEEP 192:dtxbavrNdl9bH9CxbGsTjOnaVh6is6TJVum3:/Ravrbl9D9pnaVh6lQJVum3
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download

passwords.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db
Size 48KB
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
SSDEEP 96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5 SHA1 SHA512 SSDEEP

Submit Download

webdata.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download