a2f115298e7e2a6641f1af6447139aae7a272396e05255cf3f46aad126095168

Analysis

max time kernel
95s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2f115298e7e2a6641f1af6447139aae7a272396e05255cf3f46aad126095168.exe
Size 2.1MB
Sample240604-bd4hzaff5z
SHA256 a2f115298e7e2a6641f1af6447139aae7a272396e05255cf3f46aad126095168
MD5 3f1414acc122559e44c9760949639fa6
SHA1 b2e9d49489ded5b9ed2e77d273047381e21657b9
SHA512 eff86d7fb57e5644d10d5cf80d82db3c611563795334c863218aacae7e5c1bf2c1cf42e36fd63f276762df9d16da5b5888651da704f91ecee9f1d02093a882d3
SSDEEP 49152:IBJ0k1H8oajdVSBlwRh8QniHqyxLfNDNTHS:yGk1idXNCqyxLfvHS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\RuntimeBroker.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\fontdrvhost.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\TextInputHost.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\TextInputHost.exe\", \"C:\\Users\\Admin\\services.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\TextInputHost.exe\", \"C:\\Users\\Admin\\services.exe\", \"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\TextInputHost.exe\", \"C:\\Users\\Admin\\services.exe\", \"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Discord\\Updater.exe\""	Updater.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	1472	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	1472	schtasks.exe	91

Detects executables packed with unregistered version of .NET Reactor 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000002342f-10.dat	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/memory/4472-13-0x00000000009F0000-0x0000000000BCA000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2432	powershell.exe
2220	powershell.exe
3000	powershell.exe
5028	powershell.exe
1236	powershell.exe
680	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	a2f115298e7e2a6641f1af6447139aae7a272396e05255cf3f46aad126095168.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	Updater.exe

Executes dropped EXE 2 IoCs

pid	Process
4472	Updater.exe
1076	fontdrvhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Portable Devices\\RuntimeBroker.exe\""	Updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Updater = "\"C:\\Users\\Admin\\AppData\\Roaming\\Discord\\Updater.exe\""	Updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Google\\RuntimeBroker.exe\""	Updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Defender\\de-DE\\fontdrvhost.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Admin\\services.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\TextInputHost.exe\""	Updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Admin\\services.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Updater = "\"C:\\Users\\Admin\\AppData\\Roaming\\Discord\\Updater.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Google\\RuntimeBroker.exe\""	Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Defender\\de-DE\\fontdrvhost.exe\""	Updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\TextInputHost.exe\""	Updater.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC2EF46D68DFD4D269DD4F7CA29B33174.TMP	csc.exe
File created	\??\c:\Windows\System32\cjmmco.exe	csc.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Updater.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Updater.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe	Updater.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\22eafd247d37c3	Updater.exe
File created	C:\Program Files (x86)\Google\9e8d7a4ca61bd9	Updater.exe
File created	C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	Updater.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe	Updater.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\5b884080fd4f94	Updater.exe
File created	C:\Program Files (x86)\Google\RuntimeBroker.exe	Updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3460	schtasks.exe
3980	schtasks.exe
2392	schtasks.exe
3288	schtasks.exe
1604	schtasks.exe
1568	schtasks.exe
2608	schtasks.exe
4164	schtasks.exe
3380	schtasks.exe
1560	schtasks.exe
4324	schtasks.exe
5036	schtasks.exe
3616	schtasks.exe
2064	schtasks.exe
2868	schtasks.exe
4996	schtasks.exe
4348	schtasks.exe
4984	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	a2f115298e7e2a6641f1af6447139aae7a272396e05255cf3f46aad126095168.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	Updater.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4284	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
4472	Updater.exe
2432	powershell.exe
2432	powershell.exe
5028	powershell.exe
5028	powershell.exe
2432	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1076	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	Updater.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	1076	fontdrvhost.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4504	2448	a2f115298e7e2a6641f1af6447139aae7a272396e05255cf3f46aad126095168.exe	81
PID 2448 wrote to memory of 4504	2448	a2f115298e7e2a6641f1af6447139aae7a272396e05255cf3f46aad126095168.exe	81
PID 2448 wrote to memory of 4504	2448	a2f115298e7e2a6641f1af6447139aae7a272396e05255cf3f46aad126095168.exe	81
PID 4504 wrote to memory of 2812	4504	WScript.exe	86
PID 4504 wrote to memory of 2812	4504	WScript.exe	86
PID 4504 wrote to memory of 2812	4504	WScript.exe	86
PID 2812 wrote to memory of 4472	2812	cmd.exe	88
PID 2812 wrote to memory of 4472	2812	cmd.exe	88
PID 4472 wrote to memory of 2040	4472	Updater.exe	95
PID 4472 wrote to memory of 2040	4472	Updater.exe	95
PID 2040 wrote to memory of 1688	2040	csc.exe	97
PID 2040 wrote to memory of 1688	2040	csc.exe	97
PID 4472 wrote to memory of 680	4472	Updater.exe	114
PID 4472 wrote to memory of 680	4472	Updater.exe	114
PID 4472 wrote to memory of 1236	4472	Updater.exe	115
PID 4472 wrote to memory of 1236	4472	Updater.exe	115
PID 4472 wrote to memory of 5028	4472	Updater.exe	116
PID 4472 wrote to memory of 5028	4472	Updater.exe	116
PID 4472 wrote to memory of 3000	4472	Updater.exe	117
PID 4472 wrote to memory of 3000	4472	Updater.exe	117
PID 4472 wrote to memory of 2220	4472	Updater.exe	118
PID 4472 wrote to memory of 2220	4472	Updater.exe	118
PID 4472 wrote to memory of 2432	4472	Updater.exe	119
PID 4472 wrote to memory of 2432	4472	Updater.exe	119
PID 4472 wrote to memory of 1064	4472	Updater.exe	126
PID 4472 wrote to memory of 1064	4472	Updater.exe	126
PID 1064 wrote to memory of 3200	1064	cmd.exe	128
PID 1064 wrote to memory of 3200	1064	cmd.exe	128
PID 1064 wrote to memory of 4284	1064	cmd.exe	129
PID 1064 wrote to memory of 4284	1064	cmd.exe	129
PID 1064 wrote to memory of 1076	1064	cmd.exe	133
PID 1064 wrote to memory of 1076	1064	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a2f115298e7e2a6641f1af6447139aae7a272396e05255cf3f46aad126095168.exe
"C:\Users\Admin\AppData\Local\Temp\a2f115298e7e2a6641f1af6447139aae7a272396e05255cf3f46aad126095168.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Discord\9tSGBPS8pWt1OE8agSDDS3cSF0YOLizU75DcXK0Ue9E3Zn.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Discord\gLyE3U6eAnmR1VUbYVGQU6SNbmGDptj5w0rMd8Qkc1gQF.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Users\Admin\AppData\Roaming\Discord\Updater.exe
      "C:\Users\Admin\AppData\Roaming\Discord/Updater.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dqkpqdhg\dqkpqdhg.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2040
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4585.tmp" "c:\Windows\System32\CSC2EF46D68DFD4D269DD4F7CA29B33174.TMP"
        6⤵
        
        PID:1688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Discord\Updater.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IZdub348jc.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1064
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3200
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:4284
      - C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "UpdaterU" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Roaming\Discord\Updater.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Updater" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Discord\Updater.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "UpdaterU" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Roaming\Discord\Updater.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
MD5 a43e653ffb5ab07940f4bdd9cc8fade4
SHA1 af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA512 62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

IZdub348jc.bat

Path C:\Users\Admin\AppData\Local\Temp\IZdub348jc.bat
Size 189B
SHA256 ecc408873b60a28c6e7d030bb0e67e3b3eb18f06c2a57a7eed11dd36aa84832a
MD5 f2390ea212bb09c34748613ade879af9
SHA1 70243abab3002dfcead19ffbc0a92f1db6b74bc7
SHA512 7595fa2713525581bb27b31b21ee2ab6bcb80636f48265f9c112cb2eb71ffd1a98fd92d6fb07abe2e329517e6c2e487be5dcda5a9341f7a95231f87221d18665
MD5 SHA1 SHA512

Submit Download

RES4585.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4585.tmp
Size 1KB
SHA256 301d394afdeb269aff083572507691692d4cd851c4da11fb3f9583287d5e3dfb
MD5 945f737c49335d1dcd58cc920d47f0da
SHA1 96512ff93aaae722cec45a36779db94c34b97234
SHA512 1c14de56530c768d72f4a935c7a2fc28e324d2daf4794ddce4fdd2be09ef031f0094566e6ed9a71a0a179df75bef6771d70f2a346fb3dc2a499899e7273432e1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_2oecja3t.y2h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2oecja3t.y2h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

9tSGBPS8pWt1OE8agSDDS3cSF0YOLizU75DcXK0Ue9E3Zn.vbe

Path C:\Users\Admin\AppData\Roaming\Discord\9tSGBPS8pWt1OE8agSDDS3cSF0YOLizU75DcXK0Ue9E3Zn.vbe
Size 237B
SHA256 da6753778123b5e236261193f3c2ead026f6d1ea90798340e5c1014cc7de393e
MD5 a3efcfccea29fadeac3e1939b9d86e09
SHA1 bcca91cdc90c1f1b092c63d93f3fc0513ec4d5c8
SHA512 f4c347d6f34f369ed5628ac21102a391bf5a657bf5179497469e00ed695d71194d10532337f4a6ff1b6c4e0d17ec43fc28af59804cfd8ca6020d48547b7c3470
MD5 SHA1 SHA512

Submit Download

Updater.exe

Path C:\Users\Admin\AppData\Roaming\Discord\Updater.exe
Size 1.8MB
SHA256 02f925d7e27fd7660e781f8ea1ca09d52ce6e1f6d8abe6b3c6e120fbb1b5faa3
MD5 e9b6a10f75763366fb2ca9d1d570d148
SHA1 bed46215af229c6b60efd96eb06e4fad259fa85d
SHA512 7be614b25b7d35910cb9931ef96731ed6ec1bcd3c0bdf1b66580c72b6e92981320dc572ed63537ba79f2a5baca700f7c7d3abe03090b90031ceb9bb4db8690cc
SSDEEP 24576:V6YWyoa1WAJ8omRB37fumjrdQrnvZ2EwdNtd5kuvECuIVniBKWqcCuvgQONR/6cL:gk1H8oajdVSBlwRh8QniHqyxLfNDNTH
MD5 SHA1 SHA512 SSDEEP

Submit Download

gLyE3U6eAnmR1VUbYVGQU6SNbmGDptj5w0rMd8Qkc1gQF.bat

Path C:\Users\Admin\AppData\Roaming\Discord\gLyE3U6eAnmR1VUbYVGQU6SNbmGDptj5w0rMd8Qkc1gQF.bat
Size 96B
SHA256 c9dabf9ea5db5c85219b896ca6045613ec95b64374f2dc0d132da1be1aa67915
MD5 da082c1722499065454aa616e631bd1f
SHA1 1926813a10570b3430e886610932697fd3a1be1d
SHA512 21e1e8f817f28a84b8c1b8e4180fcf4a2230cc6e22a80555677addefc4b8f4b7557e6774732de7f675475c6485dde5e150aa206b896a69a1506d518bc06c6ed5
MD5 SHA1 SHA512

Submit Download

dqkpqdhg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dqkpqdhg\dqkpqdhg.0.cs
Size 379B
SHA256 90af302450d1da61f797003653929d9c8af1987c0b97444461ca6777a5e82026
MD5 14b0cc30cb7140d95fdbf295143ffef4
SHA1 ae876e98f0b030447cf45d42580a28b49b2eff33
SHA512 2c1950d37639b4f5bedcffcf2c0c88e33d8d926aecfabe38a30b394f018466a38e3e81ef2593f2a5a3adf50b882be1207b01336d65e2b5272299f535c8bef89b
MD5 SHA1 SHA512

Submit Download

dqkpqdhg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dqkpqdhg\dqkpqdhg.cmdline
Size 235B
SHA256 5e1fd46c86294eae7aa7f3ad46f8e1af2b5471e4caa1c1af63dda1bc2762e486
MD5 ad007c5e803b9bc3c12acf55e8125676
SHA1 57405f3361815e62d71638c20b4afdafe450e4be
SHA512 b3749643582ac5dd6bbe86bae8126e900d66e284b15cf3af303c3119b29d2f43a776cb512debb14cbba97ebc2c6476cb9b93767eb9f13e74b70cc522dc5da6bf
MD5 SHA1 SHA512

Submit Download

CSC2EF46D68DFD4D269DD4F7CA29B33174.TMP

Path \??\c:\Windows\System32\CSC2EF46D68DFD4D269DD4F7CA29B33174.TMP
Size 1KB
SHA256 31740b218505867f934d13c16295f7c1a57045d8e4c0079799b9caa067b2411c
MD5 0e0a242f8f023c943e845e3326f7e233
SHA1 0e271c02e32fa6b6b4b0b27c8cdc4e4afb5b2d78
SHA512 b7528fd87e6964e8e7c2743dca777d9f905750eaab7ef2683cb49e5b3b42cdce20736fce312856117af968a9c24e8cfee05f453cdbfa3cc12136dbb4a34d71db
MD5 SHA1 SHA512

Submit Download

memory/2432-59-0x000001B615BA0000-0x000001B615BC2000-memory.dmp

Download

memory/4472-22-0x0000000002D60000-0x0000000002D6C000-memory.dmp

Download

memory/4472-20-0x000000001B840000-0x000000001B858000-memory.dmp

Download

memory/4472-18-0x000000001BBE0000-0x000000001BC30000-memory.dmp

Download

memory/4472-17-0x000000001B820000-0x000000001B83C000-memory.dmp

Download

memory/4472-15-0x0000000002D50000-0x0000000002D5E000-memory.dmp

Download

memory/4472-13-0x00000000009F0000-0x0000000000BCA000-memory.dmp

Download

memory/4472-12-0x00007FFB46B53000-0x00007FFB46B55000-memory.dmp

Download