zgrat | c252cbd5898c1d562170a12c1e2262ad101616ec0583cb647c01a5e3d1568fef

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BlastedCracked.exe
Size 3.6MB
Sample240512-vvarrsag98
SHA256 c252cbd5898c1d562170a12c1e2262ad101616ec0583cb647c01a5e3d1568fef
MD5 efa8a9b8529959e7384cce67f59420d8
SHA1 54159f633070d03a71ed6d5e1d9e40f2893510fe
SHA512 7a97920a93a05d076ea6ddade8dbe82553b69d89c0a3d86fb11627193753bf12a85975ff01ccf84bcb9b030a38d4e0d7c3957d08a2ad11831601e80f24fd5aef
SSDEEP 98304:1syC4u5x0b8dF6eaeSjBeKxATO7IiiOra+Hc8:7C4u5x0wn6eaeSdyTO4Ora+Hc8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat persistence rat

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/files/0x00080000000232a4-6.dat	family_zgrat_v1
behavioral2/files/0x000800000002343f-36.dat	family_zgrat_v1
behavioral2/memory/916-38-0x0000000000700000-0x0000000000A8E000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\", \"C:\\ProviderSession\\sihost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\", \"C:\\ProviderSession\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\", \"C:\\ProviderSession\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\", \"C:\\ProviderSession\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\winlogon.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Microsoft\\Registry.exe\", \"C:\\ProviderSession\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\sppsvc.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\winlogon.exe\", \"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3584	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	3584	schtasks.exe	94

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	BlastedCracked.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Cracker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	surrogatesessionsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winlogon.exe

Executes dropped EXE 13 IoCs

pid	Process
2376	Cracker.exe
1408	BlastedCrack.exe
916	surrogatesessionsvc.exe
1996	winlogon.exe
1000	winlogon.exe
1480	winlogon.exe
3580	winlogon.exe
4616	winlogon.exe
3936	winlogon.exe
1180	winlogon.exe
1480	winlogon.exe
4316	winlogon.exe
1204	winlogon.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\ProviderSession\\sihost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Google\\Temp\\winlogon.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\surrogatesessionsvc = "\"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Microsoft\\Registry.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\ProviderSession\\sihost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\sppsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Google\\Temp\\winlogon.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\surrogatesessionsvc = "\"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Microsoft\\Registry.exe\""	surrogatesessionsvc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC190B833CA20412BA27A44BBDF15DD8D.TMP	csc.exe
File created	\??\c:\Windows\System32\iehhk_.exe	csc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Temp\winlogon.exe	surrogatesessionsvc.exe
File created	C:\Program Files (x86)\Google\Temp\cc11b995f2a76d	surrogatesessionsvc.exe
File created	C:\Program Files (x86)\Google\Temp\winlogon.exe	surrogatesessionsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\sppsvc.exe	surrogatesessionsvc.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\0a1fd5f707cd16	surrogatesessionsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3940	schtasks.exe
968	schtasks.exe
2024	schtasks.exe
4596	schtasks.exe
4200	schtasks.exe
4204	schtasks.exe
4532	schtasks.exe
5076	schtasks.exe
1736	schtasks.exe
5040	schtasks.exe
4072	schtasks.exe
3376	schtasks.exe
3156	schtasks.exe
2864	schtasks.exe
1808	schtasks.exe
548	schtasks.exe
1868	schtasks.exe
4840	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	Cracker.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	surrogatesessionsvc.exe

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
4588	PING.EXE
2400	PING.EXE
4540	PING.EXE
1468	PING.EXE
1072	PING.EXE
976	PING.EXE
4056	PING.EXE
4140	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe
916	surrogatesessionsvc.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	surrogatesessionsvc.exe
Token: SeDebugPrivilege	1996	winlogon.exe
Token: SeDebugPrivilege	1000	winlogon.exe
Token: SeDebugPrivilege	1480	winlogon.exe
Token: SeDebugPrivilege	3580	winlogon.exe
Token: SeDebugPrivilege	4616	winlogon.exe
Token: SeDebugPrivilege	3936	winlogon.exe
Token: SeDebugPrivilege	1180	winlogon.exe
Token: SeDebugPrivilege	1480	winlogon.exe
Token: SeDebugPrivilege	4316	winlogon.exe
Token: SeDebugPrivilege	1204	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 2376	740	BlastedCracked.exe	82
PID 740 wrote to memory of 2376	740	BlastedCracked.exe	82
PID 740 wrote to memory of 2376	740	BlastedCracked.exe	82
PID 740 wrote to memory of 1408	740	BlastedCracked.exe	85
PID 740 wrote to memory of 1408	740	BlastedCracked.exe	85
PID 740 wrote to memory of 1408	740	BlastedCracked.exe	85
PID 2376 wrote to memory of 4328	2376	Cracker.exe	86
PID 2376 wrote to memory of 4328	2376	Cracker.exe	86
PID 2376 wrote to memory of 4328	2376	Cracker.exe	86
PID 4328 wrote to memory of 1240	4328	WScript.exe	91
PID 4328 wrote to memory of 1240	4328	WScript.exe	91
PID 4328 wrote to memory of 1240	4328	WScript.exe	91
PID 1240 wrote to memory of 916	1240	cmd.exe	93
PID 1240 wrote to memory of 916	1240	cmd.exe	93
PID 916 wrote to memory of 3832	916	surrogatesessionsvc.exe	98
PID 916 wrote to memory of 3832	916	surrogatesessionsvc.exe	98
PID 3832 wrote to memory of 4012	3832	csc.exe	100
PID 3832 wrote to memory of 4012	3832	csc.exe	100
PID 916 wrote to memory of 4112	916	surrogatesessionsvc.exe	117
PID 916 wrote to memory of 4112	916	surrogatesessionsvc.exe	117
PID 4112 wrote to memory of 3252	4112	cmd.exe	119
PID 4112 wrote to memory of 3252	4112	cmd.exe	119
PID 4112 wrote to memory of 4588	4112	cmd.exe	120
PID 4112 wrote to memory of 4588	4112	cmd.exe	120
PID 4112 wrote to memory of 1996	4112	cmd.exe	121
PID 4112 wrote to memory of 1996	4112	cmd.exe	121
PID 1996 wrote to memory of 4340	1996	winlogon.exe	123
PID 1996 wrote to memory of 4340	1996	winlogon.exe	123
PID 4340 wrote to memory of 3080	4340	cmd.exe	125
PID 4340 wrote to memory of 3080	4340	cmd.exe	125
PID 4340 wrote to memory of 2400	4340	cmd.exe	126
PID 4340 wrote to memory of 2400	4340	cmd.exe	126
PID 4340 wrote to memory of 1000	4340	cmd.exe	127
PID 4340 wrote to memory of 1000	4340	cmd.exe	127
PID 1000 wrote to memory of 4072	1000	winlogon.exe	128
PID 1000 wrote to memory of 4072	1000	winlogon.exe	128
PID 4072 wrote to memory of 1328	4072	cmd.exe	130
PID 4072 wrote to memory of 1328	4072	cmd.exe	130
PID 4072 wrote to memory of 4540	4072	cmd.exe	131
PID 4072 wrote to memory of 4540	4072	cmd.exe	131
PID 4072 wrote to memory of 1480	4072	cmd.exe	132
PID 4072 wrote to memory of 1480	4072	cmd.exe	132
PID 1480 wrote to memory of 4840	1480	winlogon.exe	133
PID 1480 wrote to memory of 4840	1480	winlogon.exe	133
PID 4840 wrote to memory of 1536	4840	cmd.exe	135
PID 4840 wrote to memory of 1536	4840	cmd.exe	135
PID 4840 wrote to memory of 1468	4840	cmd.exe	136
PID 4840 wrote to memory of 1468	4840	cmd.exe	136
PID 4840 wrote to memory of 3580	4840	cmd.exe	137
PID 4840 wrote to memory of 3580	4840	cmd.exe	137
PID 3580 wrote to memory of 1436	3580	winlogon.exe	138
PID 3580 wrote to memory of 1436	3580	winlogon.exe	138
PID 1436 wrote to memory of 2084	1436	cmd.exe	140
PID 1436 wrote to memory of 2084	1436	cmd.exe	140
PID 1436 wrote to memory of 1072	1436	cmd.exe	141
PID 1436 wrote to memory of 1072	1436	cmd.exe	141
PID 1436 wrote to memory of 4616	1436	cmd.exe	142
PID 1436 wrote to memory of 4616	1436	cmd.exe	142
PID 4616 wrote to memory of 2476	4616	winlogon.exe	143
PID 4616 wrote to memory of 2476	4616	winlogon.exe	143
PID 2476 wrote to memory of 1108	2476	cmd.exe	145
PID 2476 wrote to memory of 1108	2476	cmd.exe	145
PID 2476 wrote to memory of 976	2476	cmd.exe	146
PID 2476 wrote to memory of 976	2476	cmd.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BlastedCracked.exe
"C:\Users\Admin\AppData\Local\Temp\BlastedCracked.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\Cracker.exe
  "C:\Users\Admin\AppData\Local\Temp\Cracker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProviderSession\bsSZWUX62rbs.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProviderSession\zpmu3ESIavPlU5h4gyS3YPEo2FY3dCgO4x55.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1240
    - - C:\ProviderSession\surrogatesessionsvc.exe
        
        "C:\ProviderSession/surrogatesessionsvc.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:916
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\khqzhh5s\khqzhh5s.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBDE.tmp" "c:\Windows\System32\CSC190B833CA20412BA27A44BBDF15DD8D.TMP"
        7⤵
        
        PID:4012
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fnmu8oM0U5.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3252
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:4588
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7iP34BoyNV.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:3080
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:2400
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ge8uHQboyx.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:4540
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mpHYiEZ4vY.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        Runs ping.exe
        
        PID:1468
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FT8q7RDVDe.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2084
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:1072
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\va0LlUybli.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:976
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8xEBZwnpYP.bat"
        18⤵
        
        PID:3652
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4064
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ahsqPXjhJl.bat"
        20⤵
        
        PID:4464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:3856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:516
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat"
        22⤵
        
        PID:1176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:4056
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\40vfctpQnk.bat"
        24⤵
        
        PID:4776
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:5016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3680
        
        C:\Program Files (x86)\Google\Temp\winlogon.exe
        
        "C:\Program Files (x86)\Google\Temp\winlogon.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9cbgcnWXuE.bat"
        26⤵
        
        PID:2412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:1776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        Runs ping.exe
        
        PID:4140
- C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe
  "C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe"
  2⤵
  - Executes dropped EXE
  PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\ProviderSession\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\ProviderSession\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\ProviderSession\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_32\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\GAC_32\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_32\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Temp\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Temp\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvcs" /sc MINUTE /mo 10 /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvc" /sc ONLOGON /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvcs" /sc MINUTE /mo 11 /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bsSZWUX62rbs.vbe

Path C:\ProviderSession\bsSZWUX62rbs.vbe
Size 230B
SHA256 4edef9b23ac770fb41a5dec471ddf37d3d1c5dc868999b79358bbdd34523b7c1
MD5 c59360784e5ae0db16c6e319cc53bf8d
SHA1 7e7b6afc92d466512f383f01d24d3fc0ba5d249d
SHA512 8a3fcbcc366567b11444bcc033dbf4597c33ab3230c9f6d603bb60fb2b9ee746271e4f6b332109973eb54a9247569feac76691dcc2602a9727e960e78f0968ff
MD5 SHA1 SHA512

Submit Download

surrogatesessionsvc.exe

Path C:\ProviderSession\surrogatesessionsvc.exe
Size 3.5MB
SHA256 651072ebbd54a10b843d35b050186915e876b513d09d3cdbf864e4277f5ebb6a
MD5 5a75e59d28b7b443280c733ebd3c22cf
SHA1 8d4781c8cf4a42ec9f6d5a57633eaf0e589dd11b
SHA512 4674881eb1923cbe19456d6b7822153213dd2a914a7f66f9898ea6ab8569e42f09b7702c0eabbcdb7182c4b37afa2b9d0edfa92b53e68ef9c213c0ee7903f2fc
SSDEEP 49152:v+PXziP3LZ03CBx2WZlyffxg4UHZN182DLIj9Pnw5CzuY2y3TJ1X+a:v+yLZ/fyyN18OM9PnQCzuKTJtX
MD5 SHA1 SHA512 SSDEEP

Submit Download

zpmu3ESIavPlU5h4gyS3YPEo2FY3dCgO4x55.bat

Path C:\ProviderSession\zpmu3ESIavPlU5h4gyS3YPEo2FY3dCgO4x55.bat
Size 74B
SHA256 222da2e8abc8fe3b8acb5c84f61f635078fc7237816126348e600f458506398c
MD5 bdd66a5a523ff5c2d0546fdefcfde8aa
SHA1 76eb5ea9114693dc22b4241732fe5dd6b25037bb
SHA512 b79c03ffb10bfdc16268a6872e4b9b522366b9d7edca992212c315133ce920768a0726595b65c0aa4878d25b143e65c42ec271863e9be8ad726dfe63062a6e3c
MD5 SHA1 SHA512

Submit Download

winlogon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log
Size 1KB
SHA256 c45f52a36b283b46aae313b5a4fcbfbfb67b3c5ac4ee3ecd921087ddadb691a1
MD5 8ee01a9d8d8d1ecf515b687bf5e354ca
SHA1 c3b943dce30e425ae34e6737c7d5c3cdd92f79c5
SHA512 6cb43253ddb3d2e5bdedcf76bc299e91ce970c6ccc53a2d9df7ba621435a6a704ce3990bdf59d939e513e609bab3daf8f110c1cca8485e1a9fe8536a67d41dda
MD5 SHA1 SHA512

Submit Download

40vfctpQnk.bat

Path C:\Users\Admin\AppData\Local\Temp\40vfctpQnk.bat
Size 223B
SHA256 4a758cd17c9fbdb6ef11b351c9c7cc2384706df17f598fd3980b48a5fa73fa41
MD5 88a593a87d2116610fafc1b600bb9729
SHA1 757d69e900e083cf4b27229e139404953c80fef7
SHA512 36c91aaddb0d24a00f0cc11028ba2dbfae1fbfecacd93f3e41306bb638d62892eec6e6bbdba4f6b34842b163fe2d72aa62196cdec9549f0d1a82192944790c9b
MD5 SHA1 SHA512

Submit Download

6UZvaQo7Ba.bat

Path C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat
Size 175B
SHA256 1e36a296b1d798cccbe1a5f73643cba7576b82ab81fe83c6e92008ae9439d564
MD5 2cba35fdf482626aebb830c96e0714dc
SHA1 97e51b27c7d289af7fe88cfde116d0642b3227f9
SHA512 eba39e5ee2dbb1d4cad1ddd821eafa677c43489840d3edbc86ecfba3c07d6d65c9b07cfa2f482ec5f73cf7a2d168cf473d87955c78dc9a7a8e8516b6b765f987
MD5 SHA1 SHA512

Submit Download

7iP34BoyNV.bat

Path C:\Users\Admin\AppData\Local\Temp\7iP34BoyNV.bat
Size 175B
SHA256 32aecbcc6f164005acb658eb1707f108332507d1c73e696d67baa45b482b1982
MD5 268740a5e0a01d272f8295f4a34427db
SHA1 b39e172b7dd826a326b6201d11cc120b3e5487d8
SHA512 5c90aa5e97ffca2e796063ef8ecc1df6a010c68a43f77704bf589c41d0e719d800788cde5f6d59b5a59234a3aafc05c05fd83141852452af3ae019e8810d4d51
MD5 SHA1 SHA512

Submit Download

8xEBZwnpYP.bat

Path C:\Users\Admin\AppData\Local\Temp\8xEBZwnpYP.bat
Size 223B
SHA256 a18305c6652762fc0c6a706ed790fcdbe29b7cdbdd660cb6e46ff135f75029d9
MD5 bd08c821bd3b5ec52af29f31f2c1aba4
SHA1 a21422be68cf8d3e1d91024fcc0ed3813c6a360f
SHA512 98b0e01c549a531baa38d92b3bbea4404bd6a77db2bb55fa69fc5cea2f46f44ea8ad20f757d6838fbb28e2971ad2dab61e8063b6c60899560f7e14c5392e3a27
MD5 SHA1 SHA512

Submit Download

9cbgcnWXuE.bat

Path C:\Users\Admin\AppData\Local\Temp\9cbgcnWXuE.bat
Size 175B
SHA256 c3524fa1f9abc58a3306d5fa4f8b42df9e2907a302b0d27ebac4b080920843ba
MD5 2cc7ad6ad4efdc51280faf31bb5cac26
SHA1 80364ba4c9ab7bec09b969b8da078ad5c1967fa2
SHA512 6582fdf36b40be9fba83c09d99eba8ea0d1c324d423cbfe35140b3ec71e7e74936c5494cffb5222cb5956df5e59b28624c2db65687da90c167b13726ea4cf1b4
MD5 SHA1 SHA512

Submit Download

BlastedCrack.exe

Path C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe
Size 17KB
SHA256 ea2e948a4c0224a15195153a0aa10600047d04aa634a19fd388c26810db6847e
MD5 21f525dd782bb2ccf33e2f3ec6c85660
SHA1 5bc5763dd316385d5feab0274b24ac7cbb2790a0
SHA512 0f56a381db55c17f570aaccfa46ab17900e563a0307bb232b61b17cebf305dbe7b762ad722daa239e71dfedc024df076806cdf9b4702d009457a6b054a753c0c
SSDEEP 384:zuffX5PKdQv8cuDERajLyohXVO3mncFLwgr8QDEUcpVARUffcQIptYcFA/Vc03K:N7xLyotVOWa8+rKubQctYcFA/Vc6K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cracker.exe

Path C:\Users\Admin\AppData\Local\Temp\Cracker.exe
Size 4.0MB
SHA256 568030e4ac1923f3d261c5bb137481c2db277a30957db6fef76b60381f75051b
MD5 2b7ed32dc61c861ffd3e9e35a208aafe
SHA1 307dcf28a2b397e8b22a3f31290bb30045853787
SHA512 a1550f037c74ffee99ca0db21fcc46e06f24394c88c8b3b9171de97dc8eb7f5aa74eb4c3185b9956c529430da5511c901a5488c54b7370d7758476e31dfe254d
SSDEEP 49152:TBLzP+PXziP3LZ03CBx2WZlyffxg4UHZN182DLIj9Pnw5CzuY2y3TJ1X+a3j:tLL+yLZ/fyyN18OM9PnQCzuKTJtXT
MD5 SHA1 SHA512 SSDEEP

Submit Download

FT8q7RDVDe.bat

Path C:\Users\Admin\AppData\Local\Temp\FT8q7RDVDe.bat
Size 175B
SHA256 5ab4ff35308d0106f2d8c17db7564e88c0d7571ef0f89575f084a7bb8f9459aa
MD5 3bf9382fc8674e44a793f05b7aef4ca7
SHA1 40721fa81d229e3e6c079e92e38717ad759f0ba1
SHA512 59f9b9d299af9c32225e4d132a0a5b8cd0fab698dc2195e182880d1d6949b1c0686edaeb83cbb81a280a9c17930244d29194d00a1fbc85c1afaa052541a1447b
MD5 SHA1 SHA512

Submit Download

RESBBDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBBDE.tmp
Size 1KB
SHA256 01f51c479f5541b0e02008ca8a04a8d93ed2dc8a9e1d4b4fce7c384c8a2e5b54
MD5 d6785ac3566bbea2ec6156e5a071e3ab
SHA1 803f9160950419e00b8a8ca2962138dddb2651a6
SHA512 89ee6750097e9e3d1acd059c2127892b5197d485a7c44e480dc7e793fb3c2f2464c62b5d4ca3a0f2f3190d522d446c792a060a85c5e92091ef30891d4e239301
MD5 SHA1 SHA512

Submit Download

ahsqPXjhJl.bat

Path C:\Users\Admin\AppData\Local\Temp\ahsqPXjhJl.bat
Size 223B
SHA256 d206e6fcd7115eaa3ea540d75dde04c1c9e88feefd033ad035f0fadfca350575
MD5 e51f68e9265f9c5b75de0116b871c7b9
SHA1 6ed75b54ff22fcc2fe37e960c705db1121fc2f32
SHA512 77136bb9ed7714bdf73eb758cfc7121bb8a6e4911487d867c88e9bbc88e509ca27ce9f32ff1bcb0ed1d2d0357f0dc09e7f5d17110822ec0e6dd9f1ee66c713dd
MD5 SHA1 SHA512

Submit Download

fnmu8oM0U5.bat

Path C:\Users\Admin\AppData\Local\Temp\fnmu8oM0U5.bat
Size 175B
SHA256 52d9377f53d6e050daaf8a75ea041fbf62321ff27b673c5af85d1e319f941a9f
MD5 d05667eee4034c26eb90ffa7a61e7d58
SHA1 afb0146eb6be106f0e04288b456735a6052d6f4f
SHA512 77a816d5068bb293c4a9fe85f2155a323bb2c69b5c128845278f29625616adf35425df275134f9a710b9b4edff17421da814fcc109a1f34cd7bc06ef5ad25695
MD5 SHA1 SHA512

Submit Download

ge8uHQboyx.bat

Path C:\Users\Admin\AppData\Local\Temp\ge8uHQboyx.bat
Size 175B
SHA256 a096a47902b33db7d3a238068618b25eacc8eaeb4166975b35c947c2001cf57c
MD5 5c254302b49ba631191d747264e4f783
SHA1 26dd680e84bcf9a4b510596301e1c69cb509fad5
SHA512 475fb54df19157f35aecda9c55ded3f360f434b9bd895a387bdfd5b458b876b4c080e79f58a8f229c8d14a53796061bc8fc5b5a86d7892a3343367c8fdfbadf4
MD5 SHA1 SHA512

Submit Download

mpHYiEZ4vY.bat

Path C:\Users\Admin\AppData\Local\Temp\mpHYiEZ4vY.bat
Size 175B
SHA256 6e08d5d4a34149731a5231efed23e818204a987c15b6b03e19a27fc57d3c854a
MD5 d3b3aa8ce477dfbefca45e3e6b985a6e
SHA1 550adf19e17e2f95942d0a5329b2d8e04faef8cf
SHA512 49ed7dfc4530e8e03297665f456e5cd6e3dfe1b923c6abc29bf02f32af640cfdb524a2a203954afcb72873bf631e876501747e4b6717017dd021ef4aed730a04
MD5 SHA1 SHA512

Submit Download

va0LlUybli.bat

Path C:\Users\Admin\AppData\Local\Temp\va0LlUybli.bat
Size 175B
SHA256 bc6cd3b17a48010dd8262163e9291ce39246a3d07c5650529ef48ae74e0857c3
MD5 bc92101c9cc3fa0adf62ecabd206c775
SHA1 a837875e51515fa16d4e450426c12d30631c4a4a
SHA512 a7b029fd7ef06f4d7528fd9ceed57e3b61ab01cfa7b15be8f65aee4ba5523b74d232ef848f2b69d49f16df453efb73a2a1b4f7887e9022347355400f2604e48e
MD5 SHA1 SHA512

Submit Download

khqzhh5s.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\khqzhh5s\khqzhh5s.0.cs
Size 373B
SHA256 0da606dc68f598afda91ef5645434f9ded7297142952c694ca972da1c1b97bba
MD5 cf4e321f1d65268885b2c9b43b34f886
SHA1 f4e65948a0c403f0036ac9357578cd388a0a1df4
SHA512 25b2f28277120ab25969bfee974da15b97966b1abddd21607b7b22731bdc3d06b3ef57478e9083c0798b6a1ba8bd5886df77539cba9be04e09a3e0bba9840798
MD5 SHA1 SHA512

Submit Download

khqzhh5s.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\khqzhh5s\khqzhh5s.cmdline
Size 235B
SHA256 686d60d4477351686e5da1ddc83a4ef670e4c46a6b477e5a874a7ab16c810933
MD5 9de92ecc594e539e65b9c70cb9514764
SHA1 348b16e4437468acddeaa24efea7e30d64d86662
SHA512 e156a66e71aac01b35148fb250f88049ac085ecc557902dc80930c393d3cc6588745da6f3e1bbea2d2a4eeac6402601bf869deb930df21b296db7a5938fb4750
MD5 SHA1 SHA512

Submit Download

CSC190B833CA20412BA27A44BBDF15DD8D.TMP

Path \??\c:\Windows\System32\CSC190B833CA20412BA27A44BBDF15DD8D.TMP
Size 1KB
SHA256 9e6e446a2e264c8af311438fc1e8b4456c3b56aa4836ff9448f4385e6b77ca5d
MD5 6c8d705f12e071558058fc19e815fe28
SHA1 25c4f0b2bfaff4f8264f6cc36185e4b148c0e0b7
SHA512 9195980872a010dc9c6d7012cd8b6f195dda94b50b19aa2024295e13651af6c9e89e0778d2f2e337ba84bafeb7d6cb5a2fc5ac0e4a94eee1d924ddb177e3e955
MD5 SHA1 SHA512

Submit Download

memory/916-114-0x000000001C750000-0x000000001C81D000-memory.dmp

Download

memory/916-57-0x000000001BBE0000-0x000000001BBF2000-memory.dmp

Download

memory/916-63-0x000000001BC20000-0x000000001BC32000-memory.dmp

Download

memory/916-64-0x000000001C170000-0x000000001C698000-memory.dmp

Download

memory/916-66-0x000000001BB70000-0x000000001BB7E000-memory.dmp

Download

memory/916-68-0x000000001BB80000-0x000000001BB90000-memory.dmp

Download

memory/916-70-0x000000001BC40000-0x000000001BC50000-memory.dmp

Download

memory/916-72-0x000000001BCB0000-0x000000001BD0A000-memory.dmp

Download

memory/916-74-0x000000001BC50000-0x000000001BC5E000-memory.dmp

Download

memory/916-76-0x000000001BC60000-0x000000001BC70000-memory.dmp

Download

memory/916-78-0x000000001BC70000-0x000000001BC7E000-memory.dmp

Download

memory/916-80-0x000000001BF10000-0x000000001BF28000-memory.dmp

Download

memory/916-82-0x000000001BC80000-0x000000001BC8C000-memory.dmp

Download

memory/916-84-0x000000001BF80000-0x000000001BFCE000-memory.dmp

Download

memory/916-59-0x000000001BB60000-0x000000001BB70000-memory.dmp

Download

memory/916-42-0x000000001B640000-0x000000001B64E000-memory.dmp

Download

memory/916-55-0x000000001B7F0000-0x000000001B7FE000-memory.dmp

Download

memory/916-53-0x000000001B7E0000-0x000000001B7F0000-memory.dmp

Download

memory/916-51-0x000000001B6A0000-0x000000001B6B0000-memory.dmp

Download

memory/916-113-0x000000001C6A0000-0x000000001C749000-memory.dmp

Download

memory/916-49-0x000000001BB40000-0x000000001BB58000-memory.dmp

Download

memory/916-61-0x000000001BC00000-0x000000001BC16000-memory.dmp

Download

memory/916-38-0x0000000000700000-0x0000000000A8E000-memory.dmp

Download

memory/916-40-0x000000001B810000-0x000000001B836000-memory.dmp

Download

memory/916-47-0x000000001B690000-0x000000001B6A0000-memory.dmp

Download

memory/916-45-0x000000001BB90000-0x000000001BBE0000-memory.dmp

Download

memory/916-44-0x000000001B6B0000-0x000000001B6CC000-memory.dmp

Download

memory/1000-179-0x000000001B8A0000-0x000000001B96D000-memory.dmp

Download

memory/1000-180-0x000000001B650000-0x000000001B658000-memory.dmp

Download

memory/1000-178-0x000000001B7F0000-0x000000001B899000-memory.dmp

Download

memory/1180-335-0x000000001B950000-0x000000001B958000-memory.dmp

Download

memory/1180-333-0x000000001BAE0000-0x000000001BB89000-memory.dmp

Download

memory/1180-334-0x000000001BB90000-0x000000001BC5D000-memory.dmp

Download

memory/1204-426-0x000000001C140000-0x000000001C1E9000-memory.dmp

Download

memory/1204-428-0x000000001BFA0000-0x000000001BFA8000-memory.dmp

Download

memory/1204-427-0x000000001C940000-0x000000001CA0D000-memory.dmp

Download

memory/1408-33-0x0000000005430000-0x000000000543A000-memory.dmp

Download

memory/1408-21-0x000000007295E000-0x000000007295F000-memory.dmp

Download

memory/1408-28-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Download

memory/1408-30-0x0000000005960000-0x0000000005F04000-memory.dmp

Download

memory/1408-31-0x0000000005450000-0x00000000054E2000-memory.dmp

Download

memory/1480-364-0x000000001B7D0000-0x000000001B879000-memory.dmp

Download

memory/1480-365-0x000000001B880000-0x000000001B94D000-memory.dmp

Download

memory/1480-210-0x000000001C810000-0x000000001C8DD000-memory.dmp

Download

memory/1480-209-0x000000001C760000-0x000000001C809000-memory.dmp

Download

memory/1480-211-0x000000001C5D0000-0x000000001C5D8000-memory.dmp

Download

memory/1480-366-0x000000001B640000-0x000000001B648000-memory.dmp

Download

memory/1996-147-0x000000001CB60000-0x000000001CC2D000-memory.dmp

Download

memory/1996-148-0x000000001C3E0000-0x000000001C3E8000-memory.dmp

Download

memory/1996-146-0x000000001C580000-0x000000001C629000-memory.dmp

Download

memory/3580-241-0x000000001CF10000-0x000000001CFDD000-memory.dmp

Download

memory/3580-240-0x000000001C930000-0x000000001C9D9000-memory.dmp

Download

memory/3580-242-0x000000001C590000-0x000000001C598000-memory.dmp

Download

memory/3936-304-0x000000001C4A0000-0x000000001C4A8000-memory.dmp

Download

memory/3936-302-0x000000001C630000-0x000000001C6D9000-memory.dmp

Download

memory/3936-303-0x000000001C6E0000-0x000000001C7AD000-memory.dmp

Download

memory/4316-397-0x000000001C100000-0x000000001C108000-memory.dmp

Download

memory/4316-395-0x000000001C4A0000-0x000000001C549000-memory.dmp

Download

memory/4316-396-0x000000001CA80000-0x000000001CB4D000-memory.dmp

Download

memory/4616-273-0x000000001C120000-0x000000001C128000-memory.dmp

Download

memory/4616-271-0x000000001C2C0000-0x000000001C369000-memory.dmp

Download

memory/4616-272-0x000000001C370000-0x000000001C43D000-memory.dmp

Download