Malware Analysis Report

2024-10-10 10:06

Sample ID 240511-yy9xtaaa96
Target 7ebabb8b4bb51cf.exe
SHA256 16771b819b03044356bad5b6d2a6b0f84e7fbd94c336743b58bbe5dc2e2ccbe8
Tags
dcrat umbral evasion execution infostealer rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16771b819b03044356bad5b6d2a6b0f84e7fbd94c336743b58bbe5dc2e2ccbe8

Threat Level: Known bad

The file 7ebabb8b4bb51cf.exe was found to be: Known bad.

Malicious Activity Summary

dcrat umbral evasion execution infostealer rat spyware stealer trojan

UAC bypass

Detect Umbral payload

Process spawned unexpected child process

Umbral

DcRat

DCRat payload

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Reads user/profile data of web browsers

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Creates scheduled task(s)

Modifies registry class

Runs ping.exe

Detects videocard installed

Suspicious behavior: EnumeratesProcesses

Views/modifies file attributes

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

System policy modification

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-11 20:12

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-11 20:12

Reported

2024-05-11 20:28

Platform

win11-20240426-en

Max time kernel

536s

Max time network

597s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\sppsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\sppsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\sppsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Umbral

stealer umbral

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\sppsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\sppsvc.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5080 set thread context of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\5940a34987c991 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\RCXB0BD.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXB340.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCXB545.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\7-Zip\wininit.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\RCXA1BD.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\RCXB0BE.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXB33F.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXA43F.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Configuration\RCXAE3A.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\Internet Explorer\SIGNUP\5940a34987c991 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\WindowsPowerShell\Configuration\OfficeClickToRun.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\29c1c3cc0f7685 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\System.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Internet Explorer\SIGNUP\RCX9B8D.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXA4AD.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\7-Zip\wininit.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Google\Update\Registry.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\7-Zip\56085415360792 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\dllhost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Google\Update\ee2ad38f3d4382 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\System.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Configuration\RCXAE3B.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\WindowsPowerShell\Configuration\e6c9b481da804f C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\27d1bcfc3c54e0 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Configuration\OfficeClickToRun.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\dllhost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Internet Explorer\SIGNUP\RCX9B8C.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\RCXA1BC.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Registry.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCXB546.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\RCX9707.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\assembly\dllhost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\IdentityCRL\INT\RCX9DA2.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\assembly\dllhost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\IdentityCRL\INT\55b276f4edf653 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\System\Speech\RuntimeBroker.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\assembly\RCX9689.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\IdentityCRL\INT\RCX9DA3.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\IdentityCRL\INT\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\assembly\5940a34987c991 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\IdentityCRL\INT\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Default User\sppsvc.exe N/A
N/A N/A C:\Users\Default User\sppsvc.exe N/A
N/A N/A C:\Users\Default User\sppsvc.exe N/A
N/A N/A C:\Users\Default User\sppsvc.exe N/A
N/A N/A C:\Users\Default User\sppsvc.exe N/A
N/A N/A C:\Users\Default User\sppsvc.exe N/A
N/A N/A C:\Users\Default User\sppsvc.exe N/A
N/A N/A C:\Users\Default User\sppsvc.exe N/A
N/A N/A C:\Users\Default User\sppsvc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Default User\sppsvc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5080 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5080 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5080 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5080 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5080 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5080 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5080 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5080 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5080 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4956 wrote to memory of 1428 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 4956 wrote to memory of 1428 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 4956 wrote to memory of 1428 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 4956 wrote to memory of 996 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 4956 wrote to memory of 996 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 1428 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 1428 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 1428 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 996 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\attrib.exe
PID 996 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\attrib.exe
PID 996 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 996 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 996 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 996 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 996 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 996 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 996 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 996 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 996 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 996 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 996 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 996 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 996 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 996 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 996 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 996 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 996 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 996 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 1520 wrote to memory of 4892 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1520 wrote to memory of 4892 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1520 wrote to memory of 4892 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4892 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe
PID 4892 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe
PID 996 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\cmd.exe
PID 996 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\cmd.exe
PID 1140 wrote to memory of 3304 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 1140 wrote to memory of 3304 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 1128 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe C:\Windows\System32\cmd.exe
PID 1128 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe C:\Windows\System32\cmd.exe
PID 3604 wrote to memory of 4092 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3604 wrote to memory of 4092 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3604 wrote to memory of 344 N/A C:\Windows\System32\cmd.exe C:\Users\Default User\sppsvc.exe
PID 3604 wrote to memory of 344 N/A C:\Windows\System32\cmd.exe C:\Users\Default User\sppsvc.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\sppsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\sppsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\sppsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe

"C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\discord\KVGHJrchTtXZ1.vbe"

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\discord\91XI5GEPShJXCgG0eVHRJ.bat" "

C:\Users\Admin\AppData\Roaming\discord\savesref.exe

"C:\Users\Admin\AppData\Roaming\discord\savesref.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\assembly\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\assembly\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /f

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\explorer.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Windows\IdentityCRL\INT\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\IdentityCRL\INT\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Update\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\7-Zip\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\Configuration\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Configuration\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OyPGkKXBTT.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\sppsvc.exe

"C:\Users\Default User\sppsvc.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe

"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe"

C:\Recovery\WindowsRE\winlogon.exe

C:\Recovery\WindowsRE\winlogon.exe

C:\Program Files\7-Zip\wininit.exe

"C:\Program Files\7-Zip\wininit.exe"

C:\Recovery\WindowsRE\services.exe

C:\Recovery\WindowsRE\services.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 artemis.community udp
GB 216.58.201.99:443 gstatic.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 162.159.136.232:443 discord.com tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

memory/5080-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

memory/5080-1-0x0000000000CA0000-0x00000000014CA000-memory.dmp

memory/5080-2-0x0000000074D00000-0x00000000754B1000-memory.dmp

memory/5080-3-0x0000000005F40000-0x0000000005F50000-memory.dmp

memory/5080-4-0x0000000007AB0000-0x0000000007AB8000-memory.dmp

memory/4956-5-0x0000000000400000-0x000000000060E000-memory.dmp

memory/4956-8-0x0000000074D00000-0x00000000754B1000-memory.dmp

memory/5080-7-0x0000000074D00000-0x00000000754B1000-memory.dmp

memory/4956-9-0x0000000005750000-0x00000000057EC000-memory.dmp

memory/4956-12-0x0000000074D00000-0x00000000754B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 45008c4cc3fc25a5d5184742ae2fe72b
SHA1 f5e7b3110df6917df0e07a822c313c52eec335fd
SHA256 09d240d54a5458bcc9362ea0f06e23a345b69e196e127462d5f33e8a475ccd57
SHA512 3059e4e59cb103f08fd13f776bf65d41b4cfec7a7f6610a2c945e134d4b913185f64bdf357bbc3c52e26da77f9e04a19c121611ad11fb40bf486aade1751e335

C:\Users\Admin\AppData\Local\Temp\explorer.exe

MD5 5a006cd74e0225a15746bee6928d62f1
SHA1 a17dabdb634d9667c3590436998252148a5fab92
SHA256 0350fdb32852f781665e056a04f318e94c746612f7b4e3cd430d808c894aae4c
SHA512 59d6b467cf48cf1aafaf13e1acfdd6ae4806403f0bc92e759590b04da4ecd719488300ecd412d92931e7b65daf0ab2229d7a165b31595334676b40942bb30f81

memory/996-31-0x0000020DF6390000-0x0000020DF63D0000-memory.dmp

memory/4956-38-0x0000000074D00000-0x00000000754B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\discord\KVGHJrchTtXZ1.vbe

MD5 cdb5dc99d1017d58fdbfce66f048da76
SHA1 e1903f365d81996da9810b9f0dc40bc65b3324c7
SHA256 bd9e0e5f3e6379d03907896d71843cc2dbfef7e209cc0896b4755fa0422a3b43
SHA512 72e3e2f3b5f385c402faf7ac89690a99806f648f90e85f46b01db66284f247c10dbe03e612e41c46775cd29fecaeede2fd26bc8dc2e22e252f9f1ce9b801f88d

memory/3760-46-0x000002B5F9DC0000-0x000002B5F9DE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxu2ooow.xk0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d0a4a3b9a52b8fe3b019f6cd0ef3dad6
SHA1 fed70ce7834c3b97edbd078eccda1e5effa527cd
SHA256 21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31
SHA512 1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

memory/996-65-0x0000020DF8BC0000-0x0000020DF8C36000-memory.dmp

memory/996-66-0x0000020DF8B40000-0x0000020DF8B90000-memory.dmp

memory/996-67-0x0000020DF8B90000-0x0000020DF8BAE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 711b161528f4959c4b7463036c7324ec
SHA1 53b30cc796c0dfe0cd4c4406202a19139cb5407d
SHA256 7c077fb04d4911778ab648b657b43c9b464393d734dc7fa029ee0f085c6a5638
SHA512 565d0e3e229894de91ad37a16c261bf380e983ffda750f32e8ad361c0606c62043a0188f45d252fecabc6438bc9e7b2c424b101073162ba9633bacd03b42af9b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 57083a8e45ebe4fd84c7c0f137ec3e21
SHA1 857b5ea57f7bcf03cadee122106c6e58792a9b84
SHA256 f20102c4dc409cad3cdaf7a330c3a18a730a9d7d902b9fbee2a84186cba93d40
SHA512 4bbc21c07c05ee1f783242f0fb59324d5ff9ae18bdf892f02980d582fed83380888eeba58e1a6a321507cfd5d4fe82a328a0d3482b29633be4e3ebbeac636f87

memory/996-101-0x0000020DF8890000-0x0000020DF889A000-memory.dmp

memory/996-102-0x0000020DF88C0000-0x0000020DF88D2000-memory.dmp

C:\Users\Admin\AppData\Roaming\discord\91XI5GEPShJXCgG0eVHRJ.bat

MD5 84814a18997996f8a95ba8e868396e90
SHA1 30b79b2158d922433ba25117fb79f8720470fb44
SHA256 92c8ccb6b3a9abc0798ad760255c47356c3750a74b11e38590876c68927f3797
SHA512 b1b820e12c49fe4993229222a218a769e5d6913f303d382baaff735f3b24a5b068adcfb344397004dd9d7aa637c4e9baedf2e3ca3dfb3f56e86c8c8f8cf9cf7e

C:\Users\Admin\AppData\Roaming\discord\savesref.exe

MD5 0a32536cc1d5e2a35d7d289b4ff0e76b
SHA1 98736b0b5a6f3709f81365c9e6477819074c3170
SHA256 8d31ae46e123de0d23937d664298428e37b45a7a135a95d73f5887779ee48710
SHA512 b2d5d91eb7ecfc6eb295c63ecba5c3ceb4b4a865fc9a9f90bd1e82bff4bc39905baf9ab2962580ee708761632e5499694f3f823aa2f139bce809398262eb3b73

memory/1128-110-0x00000000008C0000-0x0000000000A4C000-memory.dmp

memory/1128-111-0x0000000002BD0000-0x0000000002BEC000-memory.dmp

memory/1128-113-0x000000001B6F0000-0x000000001B706000-memory.dmp

memory/1128-112-0x0000000002BF0000-0x0000000002C00000-memory.dmp

memory/1128-114-0x0000000002C00000-0x0000000002C10000-memory.dmp

memory/1128-115-0x000000001B710000-0x000000001B71A000-memory.dmp

memory/1128-116-0x000000001B720000-0x000000001B728000-memory.dmp

memory/1128-119-0x000000001B760000-0x000000001B768000-memory.dmp

memory/1128-117-0x000000001B730000-0x000000001B73C000-memory.dmp

memory/1128-118-0x000000001B740000-0x000000001B748000-memory.dmp

memory/1128-120-0x000000001B770000-0x000000001B77C000-memory.dmp

memory/1128-121-0x000000001B780000-0x000000001B78A000-memory.dmp

memory/1128-122-0x000000001B790000-0x000000001B79C000-memory.dmp

C:\Recovery\WindowsRE\RCX9281.tmp

MD5 bf164fec3cd078761a70462be31050fb
SHA1 48ebbb45426cbe2056e5f0bca1bd03e06ddfa5a2
SHA256 1d547dd97ae48345cae40c0a76258b3efa12dd8e9ea689f3d022e482584aa173
SHA512 fc4dbc0aa8d172b2b6c706e778acf5e49a5fc4c1c1fa763bd01a6d4332f1731ae5a87bfb500027067c3bb1b7508326c81b0462c08667b2b7a68bdc1ec38e748b

C:\Recovery\WindowsRE\RCXAC15.tmp

MD5 be84958ddbb233e67cb3e095cf9491b1
SHA1 f50bb881559c23507e32a133e49d9d40da1e206d
SHA256 a7623e6e6051ac6f89605d7c439496756192e8f80e2972b26c57634a766dc684
SHA512 8f75ab42dba28f5bc7d370f366e34aa7d971f24327efaf49118f218b8828a837f28df29eeb06156f9024c84a804bb7cc606947bb8b0edde977fd7d1daabd6ae1

C:\Users\Admin\AppData\Local\Temp\OyPGkKXBTT.bat

MD5 63c0e65922b207230a0b06480ca4b12a
SHA1 3af1c69f46048268d5ee727c8d05c15fe7684594
SHA256 16092e13880764ac793bccb98710afe46e89a3ce4b666075cc29e1e9c74ca432
SHA512 22ee6a7cca9868c6502eefa5a0d275d77b3e9309db1c91e36f2a284da843ac8d3fe621ff1bf999e2634cfdad535f4eb63f2b9c9b3afa4ece8058d74c069acbd9

C:\Recovery\WindowsRE\winlogon.exe

MD5 b9a64ec3d28e0716e7c6fc04abb9bd34
SHA1 73aaac64f0e66acc744a4a2f17b040a41c82330b
SHA256 c7c30b1d67f4d3fa9e78b7f2421ef44da1d3a6b1f19c01aef0e6c9f099a30563
SHA512 aaddbab6a9dff5f91cb56211c5c2f94e4b406435abc7afdeb3b9b9f0725aa3d8d659a9ba41c032a1327a788033d4d6c5584f3fd8b6db0a7ac4f6a5369a60ffc4

memory/4128-359-0x0000000000E30000-0x0000000000FBC000-memory.dmp

C:\Program Files\7-Zip\wininit.exe

MD5 ce522ce69d9c4ab6f1d6ef48085242ed
SHA1 7f9f9c0edd22473dd3a8ab3a7980199e2ac518a8
SHA256 cc3f1dffb690497b6b8c9d819458ec681da9d91e8e7d0f471aca44aa6337c220
SHA512 72b6417bc90c3eb31700f3072b0267aa465a729025bf7c60a27f8ea5f3a555707aac9044e0a2c2ec04fb4516d2079e646c7474759cab7eefb6a83b8f79b70008

memory/1096-364-0x00000000007E0000-0x000000000096C000-memory.dmp