Malware Analysis Report

2025-01-02 12:09

Sample ID 240419-wnm9ysbd73
Target 9092ddc14431abcaa0467e6c56bdb73c1bc77c6a8e0a77f5b12d95717c47aef5
SHA256 9092ddc14431abcaa0467e6c56bdb73c1bc77c6a8e0a77f5b12d95717c47aef5
Tags
rat asyncrat default evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9092ddc14431abcaa0467e6c56bdb73c1bc77c6a8e0a77f5b12d95717c47aef5

Threat Level: Known bad

The file 9092ddc14431abcaa0467e6c56bdb73c1bc77c6a8e0a77f5b12d95717c47aef5 was found to be: Known bad.

Malicious Activity Summary

rat asyncrat default evasion trojan

Async RAT payload

Asyncrat family

AsyncRat

UAC bypass

Async RAT payload

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Unsigned PE

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 18:04

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 18:04

Reported

2024-04-19 18:07

Platform

win7-20240221-en

Max time kernel

141s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe"

Signatures

AsyncRat

rat asyncrat

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2208 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe
PID 2208 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe
PID 2208 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe
PID 2208 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe
PID 2208 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\svchosts.exe
PID 2208 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\svchosts.exe
PID 2208 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\svchosts.exe
PID 2208 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\svchosts.exe
PID 2492 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2524 wrote to memory of 2448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2524 wrote to memory of 2448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2524 wrote to memory of 2448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2380 wrote to memory of 2464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2380 wrote to memory of 2464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2380 wrote to memory of 2464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2380 wrote to memory of 2464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2592 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 1628 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1628 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1628 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1628 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1568 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2380 wrote to memory of 284 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe
PID 2380 wrote to memory of 284 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe
PID 2380 wrote to memory of 284 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe
PID 2380 wrote to memory of 284 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe

"C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe"

C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe

"C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe"

C:\Users\Admin\AppData\Local\Temp\svchosts.exe

"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "MicrosoftCompabilityTelemtry" /tr '"C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1890.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "MicrosoftCompabilityTelemtry" /tr '"C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\,C:\Users\Admin\AppData\Roaming

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C schtasks /create /tn svchosts /tr C:\Users\Admin\AppData\Roaming\svchosts.exe /sc onlogon

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\,C:\Users\Admin\AppData\Roaming

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn svchosts /tr C:\Users\Admin\AppData\Roaming\svchosts.exe /sc onlogon

C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe

"C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
NL 94.156.68.217:3162 tcp
NL 94.156.68.217:3162 tcp
NL 94.156.68.217:3162 tcp
NL 94.156.68.217:3162 tcp
NL 94.156.68.217:3162 tcp
NL 94.156.68.217:3162 tcp

Files

memory/2208-0-0x00000000002B0000-0x00000000002C6000-memory.dmp

memory/2208-1-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchosts.exe

MD5 0ade14069ec4dafe0f02c419da0f9ddd
SHA1 01fce38588ec0cbb6d17be718ba5867551180e32
SHA256 7df0b72ac5875dc5025d2f1e8d1eaa2cac1a4c58f2289603c852d2f9e191c948
SHA512 43e448d4bf3e25d6b154bf98da25dc183404ff35515029570f4554fa048d14ef208c4a8c7ac1024718abbb96c73c3e94ca8c5bcf8f8e8852c152b8c13959c92e

C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe

MD5 fee8e7725f89e5b99e165996d89e0d29
SHA1 827fe03932f7c557703f62b4eec683eb1a14b9c2
SHA256 b56464ef35b43d5e04a3fe655c2e80567fa67acb396221357b852e04952d0809
SHA512 11adb2c2320c21848ecca24cc542a17fc7bf80e74ef54b4f7e1ec088af5614ad04db64ab3ae1b9a8bf7106aaa6355a8ef686b4839a5756405b76425edcf6685e

memory/2208-14-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

memory/2492-16-0x0000000000280000-0x0000000000292000-memory.dmp

memory/2592-15-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

memory/2592-17-0x0000000074210000-0x00000000748FE000-memory.dmp

memory/2492-18-0x0000000074210000-0x00000000748FE000-memory.dmp

memory/2592-19-0x0000000000730000-0x0000000000770000-memory.dmp

memory/2492-20-0x0000000001D70000-0x0000000001DB0000-memory.dmp

memory/2492-30-0x0000000074210000-0x00000000748FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1890.tmp.bat

MD5 0957031fe874300fb62cd02c3b048aff
SHA1 372146ed0a6a4b4450b473c0f816dd855c463516
SHA256 f4e0984370c17cd279cd0f4d1d7e04d0e92d871b6171c0645d6360631f0f715c
SHA512 caeedb83e8151ab352a893fb694dc71c2b3edcfc3bf2f744552c579a31503fa31d20c29d126a423d0e5d2f1fa2396f9974355e245b7afcf086c1e2ebfa78cd37

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar1FE7.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

memory/1604-72-0x00000000005A0000-0x00000000005E0000-memory.dmp

memory/1604-71-0x000000006E9B0000-0x000000006EF5B000-memory.dmp

memory/1604-75-0x00000000005A0000-0x00000000005E0000-memory.dmp

memory/1604-74-0x00000000005A0000-0x00000000005E0000-memory.dmp

memory/1604-73-0x000000006E9B0000-0x000000006EF5B000-memory.dmp

memory/284-79-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

memory/284-81-0x0000000074210000-0x00000000748FE000-memory.dmp

memory/1604-80-0x000000006E9B0000-0x000000006EF5B000-memory.dmp

memory/284-82-0x0000000004220000-0x0000000004260000-memory.dmp

memory/2592-83-0x0000000074210000-0x00000000748FE000-memory.dmp

memory/2592-84-0x0000000000730000-0x0000000000770000-memory.dmp

memory/284-85-0x0000000074210000-0x00000000748FE000-memory.dmp

memory/284-86-0x0000000004220000-0x0000000004260000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 18:04

Reported

2024-04-19 18:07

Platform

win10v2004-20240226-en

Max time kernel

155s

Max time network

169s

Command Line

"C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe"

Signatures

AsyncRat

rat asyncrat

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2992 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe
PID 2992 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe
PID 2992 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe
PID 2992 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\svchosts.exe
PID 2992 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\svchosts.exe
PID 2992 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe C:\Users\Admin\AppData\Local\Temp\svchosts.exe
PID 4288 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 4288 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 4288 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 1952 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 1952 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 1952 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 1952 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 1952 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 1952 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\svchosts.exe C:\Windows\SysWOW64\cmd.exe
PID 4288 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 4288 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 4288 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe C:\Windows\SysWOW64\cmd.exe
PID 3440 wrote to memory of 4028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3440 wrote to memory of 4028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3440 wrote to memory of 4028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2364 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2364 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2364 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 844 wrote to memory of 3016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 844 wrote to memory of 3016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 844 wrote to memory of 3016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4336 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4336 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4336 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2364 wrote to memory of 3912 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe
PID 2364 wrote to memory of 3912 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe
PID 2364 wrote to memory of 3912 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\svchosts.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe

"C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe"

C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe

"C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe"

C:\Users\Admin\AppData\Local\Temp\svchosts.exe

"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "MicrosoftCompabilityTelemtry" /tr '"C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\,C:\Users\Admin\AppData\Roaming

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C schtasks /create /tn svchosts /tr C:\Users\Admin\AppData\Roaming\svchosts.exe /sc onlogon

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA454.tmp.bat""

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\,C:\Users\Admin\AppData\Roaming

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn svchosts /tr C:\Users\Admin\AppData\Roaming\svchosts.exe /sc onlogon

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "MicrosoftCompabilityTelemtry" /tr '"C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe"'

C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe

"C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
NL 94.156.68.217:3162 tcp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
NL 94.156.68.217:3162 tcp

Files

memory/2992-0-0x0000000000100000-0x0000000000116000-memory.dmp

memory/2992-1-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe

MD5 fee8e7725f89e5b99e165996d89e0d29
SHA1 827fe03932f7c557703f62b4eec683eb1a14b9c2
SHA256 b56464ef35b43d5e04a3fe655c2e80567fa67acb396221357b852e04952d0809
SHA512 11adb2c2320c21848ecca24cc542a17fc7bf80e74ef54b4f7e1ec088af5614ad04db64ab3ae1b9a8bf7106aaa6355a8ef686b4839a5756405b76425edcf6685e

C:\Users\Admin\AppData\Local\Temp\svchosts.exe

MD5 0ade14069ec4dafe0f02c419da0f9ddd
SHA1 01fce38588ec0cbb6d17be718ba5867551180e32
SHA256 7df0b72ac5875dc5025d2f1e8d1eaa2cac1a4c58f2289603c852d2f9e191c948
SHA512 43e448d4bf3e25d6b154bf98da25dc183404ff35515029570f4554fa048d14ef208c4a8c7ac1024718abbb96c73c3e94ca8c5bcf8f8e8852c152b8c13959c92e

memory/2992-23-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

memory/4288-26-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/1952-27-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/4288-28-0x0000000000F20000-0x0000000000F32000-memory.dmp

memory/1952-29-0x0000000000170000-0x000000000017A000-memory.dmp

memory/1952-30-0x0000000005020000-0x00000000055C4000-memory.dmp

memory/1952-31-0x0000000004B60000-0x0000000004BF2000-memory.dmp

memory/4288-32-0x0000000005980000-0x0000000005990000-memory.dmp

memory/4288-33-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/1952-34-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/1952-35-0x0000000004D40000-0x0000000004D50000-memory.dmp

memory/1952-36-0x0000000004C20000-0x0000000004C2A000-memory.dmp

memory/4288-37-0x0000000005E70000-0x0000000005F0C000-memory.dmp

memory/4288-38-0x0000000005980000-0x0000000005990000-memory.dmp

memory/1952-39-0x0000000004D40000-0x0000000004D50000-memory.dmp

memory/1952-41-0x0000000004D40000-0x0000000004D50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA454.tmp.bat

MD5 518409fe904cd51efdc80b5cd5f53252
SHA1 af6653d252621349c87346ee54f4d58693fb07bb
SHA256 b3d15d611493c88fb6c59dd5e77d7dfde530b338304b1769642face1a20b7cf5
SHA512 0f2663a9489bb83f8ce98715d946554e646f410be36007103fc1753e09678fbc84c8c93eb10bad13c716e3b1a4c463f51464351e209d2dd14bf8434aad8cd0df

memory/4028-47-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/4028-48-0x0000000002720000-0x0000000002730000-memory.dmp

memory/4028-49-0x00000000025F0000-0x0000000002626000-memory.dmp

memory/4288-50-0x00000000747C0000-0x0000000074F70000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MicrosoftCompabilityTelemtry.exe.log

MD5 acc9090417037dfa2a55b46ed86e32b8
SHA1 53fa6fb25fb3e88c24d2027aca6ae492b2800a4d
SHA256 2412679218bb0a7d05ceee32869bbb223619bde9966c4c460a68304a3367724b
SHA512 d51f7085ec147c708f446b9fb6923cd2fb64596d354ed929e125b30ace57c8cb3217589447a36960e5d3aea87a4e48aaa82c7509eced6d6c2cecd71fcfe3697b

memory/3912-55-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/3912-56-0x0000000003370000-0x0000000003380000-memory.dmp

memory/4028-57-0x0000000004D90000-0x00000000053B8000-memory.dmp

memory/1952-58-0x0000000004D40000-0x0000000004D50000-memory.dmp

memory/4028-59-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/4028-60-0x0000000002720000-0x0000000002730000-memory.dmp

memory/4028-61-0x0000000002720000-0x0000000002730000-memory.dmp

memory/3912-62-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/4028-63-0x0000000004CE0000-0x0000000004D02000-memory.dmp

memory/4028-64-0x00000000053C0000-0x0000000005426000-memory.dmp

memory/4028-65-0x0000000005520000-0x0000000005586000-memory.dmp

memory/3912-66-0x0000000003370000-0x0000000003380000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bb0knvz1.1vz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4028-76-0x0000000005690000-0x00000000059E4000-memory.dmp