Analysis
-
max time kernel
136s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 11:46
Static task
static1
Behavioral task
behavioral1
Sample
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe
Resource
win7-20240221-en
General
-
Target
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe
-
Size
549KB
-
MD5
d3d15e62d61981e85ae81ad54bd23b40
-
SHA1
053d987ff528964bf18ffc1898acd678b8917dd7
-
SHA256
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79
-
SHA512
e3aded35c8474602e7ec556efdf2626a4d58f1b031c1eedbaf0f0c017c33eed607d3913138af52e8c8e408b75533a0e7ed4a5c3f139491fe2e68cd5ba78e3ad8
-
SSDEEP
12288:CTgeIIGY8gGy4QmKrCc6XJvQOR9DHlXQeAs:OgeGYgyNrCc6ZvhDHlXV
Malware Config
Signatures
-
OutSteel batch script 1 IoCs
Detects batch script dropped by OutSteel
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\r.bat outsteel_batch_script -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2016 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exedescription ioc process File opened (read-only) \??\q: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\r: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\y: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\b: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\e: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\k: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\l: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\m: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\z: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\a: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\j: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\p: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\v: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\w: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\t: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\u: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\g: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\h: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\n: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\o: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\s: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\i: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\x: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe -
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2716-4-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-7-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-8-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-9-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-11-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-15-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-27-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-31-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-43-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-47-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-59-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-63-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-81-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral1/memory/2716-157-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exedescription pid process target process PID 2440 set thread context of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2200 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe Token: SeDebugPrivilege 2200 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exedescription pid process target process PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2440 wrote to memory of 2716 2440 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 2716 wrote to memory of 2868 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2868 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2868 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2868 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2460 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2460 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2460 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2460 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2532 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2532 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2532 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2532 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2776 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2776 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2776 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2776 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2160 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2160 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2160 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2160 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1440 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1440 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1440 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1440 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2140 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2140 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2140 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2140 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1508 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1508 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1508 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1508 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2672 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2672 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2672 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2672 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2900 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2900 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2900 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 2900 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1756 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1756 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1756 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1756 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1908 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1908 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1908 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1908 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1520 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1520 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1520 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1520 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 2716 wrote to memory of 1388 2716 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe"C:\Users\Admin\AppData\Local\Temp\6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exeC:\Users\Admin\AppData\Local\Temp\6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A3⤵PID:2868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A3⤵PID:2460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A3⤵PID:2532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵PID:2776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A3⤵PID:2160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A3⤵PID:1440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A3⤵PID:2140
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵PID:1508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A3⤵PID:2672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A3⤵PID:2900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A3⤵PID:1756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A3⤵PID:1908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A3⤵PID:1520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A3⤵PID:1388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A3⤵PID:1368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A3⤵PID:2220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A3⤵PID:516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A3⤵PID:2216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.doc" /S /B /A3⤵PID:2316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.pdf" /S /B /A3⤵PID:2292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.ppt" /S /B /A3⤵PID:2992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.dot" /S /B /A3⤵PID:2496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.xl" /S /B /A3⤵PID:2524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.csv" /S /B /A3⤵PID:2592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.rtf" /S /B /A3⤵PID:2364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.dot" /S /B /A3⤵PID:2164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.mdb" /S /B /A3⤵PID:2792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.accdb" /S /B /A3⤵PID:2312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.pot" /S /B /A3⤵PID:1632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.pps" /S /B /A3⤵PID:2420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.ppa" /S /B /A3⤵PID:1952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.rar" /S /B /A3⤵PID:2284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.zip" /S /B /A3⤵PID:1708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.tar" /S /B /A3⤵PID:1948
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.7z" /S /B /A3⤵PID:1216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "f:\*.txt" /S /B /A3⤵PID:2080
-
C:\Windows\SysWOW64\cmd.execmd /c start /min r.bat3⤵PID:1604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K r.bat4⤵
- Deletes itself
PID:2016 -
C:\Windows\SysWOW64\cmd.execmd /min /c del "C:\Users\Admin\AppData\Local\Temp\r.bat"5⤵PID:2144
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /IM cmd.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\r.batFilesize
256B
MD5481767783ae1eb9829e034b7450c4f97
SHA1f80589536789db32b90772f5f51aa5636cc832b9
SHA256502ef9223631bf62206bfc9082d74e0a0c27a8f04b126416f449acad5c0727c4
SHA5129bf3a50818029083314a423be509551e98384797c44074854a96aa3815712b7de1a101ea2f121539038f9ad41a26eaff6835a82e38126275c2ca269221ce26af
-
memory/2440-0-0x0000000000F90000-0x000000000101E000-memory.dmpFilesize
568KB
-
memory/2440-1-0x0000000074610000-0x0000000074CFE000-memory.dmpFilesize
6.9MB
-
memory/2440-2-0x0000000000680000-0x00000000006C0000-memory.dmpFilesize
256KB
-
memory/2440-3-0x0000000000450000-0x000000000045E000-memory.dmpFilesize
56KB
-
memory/2440-6-0x0000000074610000-0x0000000074CFE000-memory.dmpFilesize
6.9MB
-
memory/2716-15-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-43-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-9-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-11-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-7-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-27-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-31-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-8-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-47-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-59-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-63-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-81-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-157-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2716-4-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB