Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30-05-2024 18:17

General

  • Target

    miner.TMP/MicrosoftEdgeUpdater.exe

  • Size

    2.7MB

  • MD5

    19c095e1c399bdaa0663caa9162f0b0e

  • SHA1

    cb5504712ec965f7c43883f2f251823755b1e37e

  • SHA256

    38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713

  • SHA512

    a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9

  • SSDEEP

    49152:9fYIxVYU98IqK6VW6tE1ZWD4Zs52YeycKk4BVhGJneLriO:VYIxVZ98I71/ZsQIcKDoYr

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 57 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:640
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:540
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:696
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:996
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
          1⤵
            PID:864
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:992
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1076
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                  PID:1084
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                    PID:1148
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                    1⤵
                      PID:1268
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1308
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                        1⤵
                          PID:1372
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1420
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                            1⤵
                            • Drops file in System32 directory
                            PID:1460
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                            1⤵
                              PID:1472
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                2⤵
                                  PID:2880
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                1⤵
                                  PID:1548
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                  1⤵
                                    PID:1560
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1696
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                      1⤵
                                        PID:1768
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k NetworkService -p
                                        1⤵
                                          PID:1808
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1832
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                            1⤵
                                              PID:1912
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1996
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:2004
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                  1⤵
                                                    PID:2020
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:1876
                                                    • C:\Windows\System32\spoolsv.exe
                                                      C:\Windows\System32\spoolsv.exe
                                                      1⤵
                                                        PID:2180
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2272
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                          1⤵
                                                            PID:2392
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2532
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2540
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                1⤵
                                                                  PID:2576
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                  1⤵
                                                                    PID:2656
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2676
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2712
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                        1⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2724
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                        1⤵
                                                                          PID:2732
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:2908
                                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                            1⤵
                                                                              PID:3088
                                                                            • C:\Windows\Explorer.EXE
                                                                              C:\Windows\Explorer.EXE
                                                                              1⤵
                                                                                PID:3288
                                                                                • C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4580
                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                    3⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2852
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                    3⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4700
                                                                                    • C:\Windows\system32\wusa.exe
                                                                                      wusa /uninstall /kb:890830 /quiet /norestart
                                                                                      4⤵
                                                                                        PID:3980
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe stop UsoSvc
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:768
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:2436
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe stop wuauserv
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:2140
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe stop bits
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:3160
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe stop dosvc
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:3380
                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                      3⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4712
                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                      3⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4976
                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                      3⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3576
                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                      3⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1316
                                                                                    • C:\Windows\system32\dialer.exe
                                                                                      C:\Windows\system32\dialer.exe
                                                                                      3⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4808
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe delete "YWZWALUU"
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:2136
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:3936
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe stop eventlog
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:1412
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe start "YWZWALUU"
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:1928
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        4⤵
                                                                                          PID:3040
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                    1⤵
                                                                                      PID:3428
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                      1⤵
                                                                                        PID:3484
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                          PID:3848
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:3916
                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                            1⤵
                                                                                              PID:4012
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                              1⤵
                                                                                                PID:4064
                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                1⤵
                                                                                                  PID:4340
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                                  1⤵
                                                                                                    PID:4460
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                    1⤵
                                                                                                      PID:4076
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                      1⤵
                                                                                                        PID:892
                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                        1⤵
                                                                                                          PID:1336
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                          1⤵
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:568
                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                          1⤵
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:660
                                                                                                        • C:\Windows\system32\SppExtComObj.exe
                                                                                                          C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:5068
                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                            1⤵
                                                                                                              PID:2480
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                              1⤵
                                                                                                                PID:2684
                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                1⤵
                                                                                                                  PID:4444
                                                                                                                • C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe
                                                                                                                  C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:1032
                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                    2⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2952
                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      3⤵
                                                                                                                        PID:4612
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                      2⤵
                                                                                                                        PID:1920
                                                                                                                        • C:\Windows\system32\wusa.exe
                                                                                                                          wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                          3⤵
                                                                                                                            PID:2364
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                          2⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:664
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                          2⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:4952
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                          2⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:3304
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          C:\Windows\system32\sc.exe stop bits
                                                                                                                          2⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:3192
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          C:\Windows\system32\sc.exe stop dosvc
                                                                                                                          2⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:1488
                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                          2⤵
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2552
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            3⤵
                                                                                                                              PID:3704
                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                            2⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:3656
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              3⤵
                                                                                                                                PID:3496
                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                              2⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:4964
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                3⤵
                                                                                                                                  PID:3152
                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                2⤵
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:1852
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  3⤵
                                                                                                                                    PID:1016
                                                                                                                                • C:\Windows\system32\dialer.exe
                                                                                                                                  C:\Windows\system32\dialer.exe
                                                                                                                                  2⤵
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:3732
                                                                                                                                • C:\Windows\system32\dialer.exe
                                                                                                                                  C:\Windows\system32\dialer.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:896
                                                                                                                                  • C:\Windows\system32\dialer.exe
                                                                                                                                    dialer.exe
                                                                                                                                    2⤵
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:1904
                                                                                                                                • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:1504

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

                                                                                                                                    Filesize

                                                                                                                                    2.7MB

                                                                                                                                    MD5

                                                                                                                                    19c095e1c399bdaa0663caa9162f0b0e

                                                                                                                                    SHA1

                                                                                                                                    cb5504712ec965f7c43883f2f251823755b1e37e

                                                                                                                                    SHA256

                                                                                                                                    38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713

                                                                                                                                    SHA512

                                                                                                                                    a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cesjzkhr.wow.ps1

                                                                                                                                    Filesize

                                                                                                                                    60B

                                                                                                                                    MD5

                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                    SHA1

                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                    SHA256

                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                    SHA512

                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                  • memory/540-39-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/540-38-0x0000014CAE610000-0x0000014CAE63B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/640-30-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/640-29-0x000002041DC30000-0x000002041DC5B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/640-28-0x000002041DC00000-0x000002041DC24000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    144KB

                                                                                                                                  • memory/696-35-0x000001663FB30000-0x000001663FB5B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/696-36-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/864-45-0x000001F6048D0000-0x000001F6048FB000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/864-46-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/992-55-0x0000014BC4E60000-0x0000014BC4E8B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/992-56-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/996-41-0x0000026A1D0D0000-0x0000026A1D0FB000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/996-42-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1076-59-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1076-58-0x0000018CD3D70000-0x0000018CD3D9B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/1084-62-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1084-61-0x000002035C6B0000-0x000002035C6DB000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/1148-65-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1148-64-0x00000222A19A0000-0x00000222A19CB000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/1268-68-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1268-67-0x00000226F00B0000-0x00000226F00DB000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/1308-72-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/1308-71-0x00000252CFA60000-0x00000252CFA8B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/1372-70-0x000001B266000000-0x000001B26602B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/2852-10-0x00007FF8AD860000-0x00007FF8AE322000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/2852-11-0x00007FF8AD860000-0x00007FF8AE322000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/2852-9-0x00000196AC960000-0x00000196AC982000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    136KB

                                                                                                                                  • memory/2852-0-0x00007FF8AD863000-0x00007FF8AD865000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                  • memory/2852-16-0x00007FF8AD860000-0x00007FF8AE322000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/2852-15-0x00007FF8AD860000-0x00007FF8AE322000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/2852-12-0x00007FF8AD860000-0x00007FF8AE322000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/2952-294-0x000001971D160000-0x000001971D213000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    716KB

                                                                                                                                  • memory/2952-295-0x000001971D220000-0x000001971D22A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    40KB

                                                                                                                                  • memory/2952-299-0x000001971D340000-0x000001971D348000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    32KB

                                                                                                                                  • memory/2952-300-0x000001971D350000-0x000001971D356000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    24KB

                                                                                                                                  • memory/2952-301-0x000001971D3A0000-0x000001971D3AA000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    40KB

                                                                                                                                  • memory/2952-298-0x000001971D380000-0x000001971D39A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    104KB

                                                                                                                                  • memory/2952-297-0x000001971D230000-0x000001971D23A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    40KB

                                                                                                                                  • memory/2952-296-0x000001971D360000-0x000001971D37C000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    112KB

                                                                                                                                  • memory/2952-293-0x000001971D140000-0x000001971D15C000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    112KB

                                                                                                                                  • memory/4808-19-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/4808-23-0x00007FF8CE760000-0x00007FF8CE969000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    2.0MB

                                                                                                                                  • memory/4808-18-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/4808-17-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/4808-20-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/4808-22-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/4808-25-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    172KB

                                                                                                                                  • memory/4808-24-0x00007FF8CD130000-0x00007FF8CD1ED000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    756KB