Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
04-05-2024 04:04
General
-
Target
order list.exe
-
Size
644KB
-
MD5
d2bdfbfa39edbb7b3823e241290a567b
-
SHA1
2a36ff5df72bbcc71ae4a47c6db12d3f36e47eec
-
SHA256
94b7faaa8caa0ffc8b44bce17629f8f758d79db26276a2b2844d6ac1fde122d3
-
SHA512
02be573dfe4e12505404973d55f196e088e2663940317e849eefad49c0a22a5f6b5d34230e2285bbe500716774f19851cb608edd614789c03574eec0cb602a70
-
SSDEEP
12288:QNHoLQeRh4W8ZJ76qXIvhMPmMXCiQ3dGfAWipVzCqo1r9zu4V:2HoLQeRh4P/6qXIv6+MXT+cizdgr9zuQ
Score
10/10
Malware Config
Extracted
Family
netwire
C2
213.183.58.34:1030
blackhills.ddns.net:1030
blackhills.ddns.net:1031
213.183.58.34:1031
Attributes
-
activex_autorun
true
-
activex_key
{P2HS6W4T-M16S-63O5-N061-BDQICW15LK6G}
-
copy_executable
true
-
delete_original
true
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
mutex
HxAduTti
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
svchost
-
use_mutex
true
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
NetWire RAT payload 2 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 22 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 64 IoCs
-
Suspicious use of SetThreadContext 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 22 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z95"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\c496228d2aee918eb567f499a542387ea28.exec496228d2aee918eb567f499a542387ea28.exe"C:\Users\Admin\AppData\Local\Temp\c496228d2aee918eb567f499a542387ea28.exec496228d2aee918eb567f499a542387ea28.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z373"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Host.exeHost.exe"C:\Users\Admin\AppData\Local\Temp\Host.exeHost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\Host.exeHost.exe"4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Local\Temp\c496228d2aee918eb567f499a542387ea28.exec496228d2aee918eb567f499a542387ea28.exe"C:\Users\Admin\AppData\Local\Temp\c496228d2aee918eb567f499a542387ea28.exec496228d2aee918eb567f499a542387ea28.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\rundll.exeC:\Users\Admin\AppData\Local\Temp\rundll.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 5043⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z436"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z441"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z488"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z844"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z3"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z74"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z68"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z119"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z388"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z828"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z934"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z789"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z199"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z357"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z104"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z373"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z977"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z832"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z524"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\conhost" /XML "C:\Users\Admin\AppData\Local\Temp\z737"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Adds Run key to start application
-
C:\ProgramData\adobe\svchost.exe"C:\ProgramData\adobe\svchost.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2312 -ip 23121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
496B
MD5cb76b18ebed3a9f05a14aed43d35fba6
SHA1836a4b4e351846fca08b84149cb734cb59b8c0d6
SHA2568d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349
SHA5127631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c
-
Filesize
88KB
MD5886a38f318cf5d03cda1b7b97e9746d4
SHA1809f6d9069515c0c43d8dde63e574bca1a9dd597
SHA256109d87b79191cc55290af0244a3ade9c07f28c3d375919cefd2a5b1fcc9596ea
SHA512aa07d656ed059187cfc0fd3f8498517a9df0fe80facb670b89584a2bfc2898e7b08fcb29342636fcc629921c0bef5a2e7ec762be478de1ae2f96407d71b947d6
-
Filesize
216KB
MD5221ec94084afaafc916a271b13f75d09
SHA1b1fc96ac5f482e0451ed9a493e6db577e29b1304
SHA256de9d8f4d7ff65c81d3a2dd9c1b75a327ee24fffba25926a912f4d287d8999ccf
SHA51287f89d64bcb4d3295c4ac0b483062e700374129b830415d64b9d9b90820abc967b5520bf2ef8df0d96083d1671fbb30d19a6fd51ffbb9a30a02a111263c9187f
-
Filesize
644KB
MD5d2bdfbfa39edbb7b3823e241290a567b
SHA12a36ff5df72bbcc71ae4a47c6db12d3f36e47eec
SHA25694b7faaa8caa0ffc8b44bce17629f8f758d79db26276a2b2844d6ac1fde122d3
SHA51202be573dfe4e12505404973d55f196e088e2663940317e849eefad49c0a22a5f6b5d34230e2285bbe500716774f19851cb608edd614789c03574eec0cb602a70
-
Filesize
8KB
MD53b43488997e498313ddf322481621b2b
SHA1ca9329e3129fe83fe0b084b91a6016a16edcb9c0
SHA2563a5bf0b0c1650b75a6cc29186456666bee4be6cb0573377bb8e1af777eed169c
SHA5124931eb21aa376d6b0728f75ee97020d0ec14d1aec5773e29fa61a7a087ecc1e960837a39a5563d789e680d0c94389f383d35d7c074df133c2aa964c0d514f8ec
-
Filesize
1KB
MD55caa36f90120e95e0618bfdfa6e1a5dd
SHA16f313f295334d96e3439400a6b4ef2026be68c18
SHA2566b6b3a5e5b017861f32dd459e61ddea8cb20f4a9982ef9b68f2894d9d34abc88
SHA512bf9f0f392b0ac996278d8c8fd782b67939169a4bb579435d3cf71e36eb61999b50fa537ef66dfa1246771e0e9e76b2f80c2a7e2cdf840330a166511393d28d0a
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
128KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB