db87d508752b22d60eee9c7ad47e5bbcf08ff3597491e74dcec3637ac1ad7764

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
usb_analyzer.exe
Size 3.9MB
Sample240613-3fmf1svfqa
SHA256 db87d508752b22d60eee9c7ad47e5bbcf08ff3597491e74dcec3637ac1ad7764
MD5 b198a0371d175c5384191aff3dfd9653
SHA1 e9ea35ef77eedae12e10499335d2e1f688cd917f
SHA512 bb2c6feb57b9fb43fc94c9ea41ff737b48c568a7b470fdd3e0ea75b47fc0a478dbe083e32d1fc2a9f8b675a40df342635ffa3df5b49e58271ae19b268c565b72
SSDEEP 98304:yo3SiDt89KlbM2isa/n/Prx873lVSAUmKatYt:P3Si68RM2iz/n/l6WZmKatYt
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
756	powershell.exe
4568	powershell.exe
948	powershell.exe
2860	powershell.exe
2956	powershell.exe
3160	powershell.exe
2868	powershell.exe
3180	powershell.exe
4552	powershell.exe
3108	powershell.exe
5072	powershell.exe
2100	powershell.exe
1540	powershell.exe
4948	powershell.exe
4792	powershell.exe
1900	powershell.exe
4472	powershell.exe
392	powershell.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	bridgeComponentwebNet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	bridgeComponentwebNet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	usb_analyzer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	bridgeComponentwebNet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	bridgeComponentwebNet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	bridgeComponentwebNet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	bridgeComponentwebNet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	bridgeComponentwebNet.exe

Executes dropped EXE 7 IoCs

pid	Process
2208	bridgeComponentwebNet.exe
5700	bridgeComponentwebNet.exe
5384	bridgeComponentwebNet.exe
5172	bridgeComponentwebNet.exe
636	bridgeComponentwebNet.exe
5484	bridgeComponentwebNet.exe
6052	bridgeComponentwebNet.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\en-US\StartMenuExperienceHost.exe	bridgeComponentwebNet.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\55b276f4edf653	bridgeComponentwebNet.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\it-IT\csrss.exe	bridgeComponentwebNet.exe
File created	C:\Windows\it-IT\886983d96e3d3e	bridgeComponentwebNet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	bridgeComponentwebNet.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	bridgeComponentwebNet.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	bridgeComponentwebNet.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	bridgeComponentwebNet.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	bridgeComponentwebNet.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	usb_analyzer.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	bridgeComponentwebNet.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	bridgeComponentwebNet.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2852	reg.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
5836	PING.EXE
2592	PING.EXE
5152	PING.EXE
3732	PING.EXE
1676	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe
2208	bridgeComponentwebNet.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	bridgeComponentwebNet.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	392	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	3160	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	5700	bridgeComponentwebNet.exe
Token: SeDebugPrivilege	5384	bridgeComponentwebNet.exe
Token: SeDebugPrivilege	5172	bridgeComponentwebNet.exe
Token: SeDebugPrivilege	636	bridgeComponentwebNet.exe
Token: SeDebugPrivilege	5484	bridgeComponentwebNet.exe
Token: SeDebugPrivilege	6052	bridgeComponentwebNet.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 912	4564	usb_analyzer.exe	81
PID 4564 wrote to memory of 912	4564	usb_analyzer.exe	81
PID 4564 wrote to memory of 912	4564	usb_analyzer.exe	81
PID 912 wrote to memory of 4520	912	WScript.exe	86
PID 912 wrote to memory of 4520	912	WScript.exe	86
PID 912 wrote to memory of 4520	912	WScript.exe	86
PID 4520 wrote to memory of 2852	4520	cmd.exe	88
PID 4520 wrote to memory of 2852	4520	cmd.exe	88
PID 4520 wrote to memory of 2852	4520	cmd.exe	88
PID 4520 wrote to memory of 2208	4520	cmd.exe	89
PID 4520 wrote to memory of 2208	4520	cmd.exe	89
PID 2208 wrote to memory of 3108	2208	bridgeComponentwebNet.exe	90
PID 2208 wrote to memory of 3108	2208	bridgeComponentwebNet.exe	90
PID 2208 wrote to memory of 1900	2208	bridgeComponentwebNet.exe	91
PID 2208 wrote to memory of 1900	2208	bridgeComponentwebNet.exe	91
PID 2208 wrote to memory of 4552	2208	bridgeComponentwebNet.exe	92
PID 2208 wrote to memory of 4552	2208	bridgeComponentwebNet.exe	92
PID 2208 wrote to memory of 4792	2208	bridgeComponentwebNet.exe	93
PID 2208 wrote to memory of 4792	2208	bridgeComponentwebNet.exe	93
PID 2208 wrote to memory of 4948	2208	bridgeComponentwebNet.exe	95
PID 2208 wrote to memory of 4948	2208	bridgeComponentwebNet.exe	95
PID 2208 wrote to memory of 3180	2208	bridgeComponentwebNet.exe	96
PID 2208 wrote to memory of 3180	2208	bridgeComponentwebNet.exe	96
PID 2208 wrote to memory of 1540	2208	bridgeComponentwebNet.exe	97
PID 2208 wrote to memory of 1540	2208	bridgeComponentwebNet.exe	97
PID 2208 wrote to memory of 2100	2208	bridgeComponentwebNet.exe	98
PID 2208 wrote to memory of 2100	2208	bridgeComponentwebNet.exe	98
PID 2208 wrote to memory of 5072	2208	bridgeComponentwebNet.exe	99
PID 2208 wrote to memory of 5072	2208	bridgeComponentwebNet.exe	99
PID 2208 wrote to memory of 2860	2208	bridgeComponentwebNet.exe	100
PID 2208 wrote to memory of 2860	2208	bridgeComponentwebNet.exe	100
PID 2208 wrote to memory of 392	2208	bridgeComponentwebNet.exe	101
PID 2208 wrote to memory of 392	2208	bridgeComponentwebNet.exe	101
PID 2208 wrote to memory of 948	2208	bridgeComponentwebNet.exe	102
PID 2208 wrote to memory of 948	2208	bridgeComponentwebNet.exe	102
PID 2208 wrote to memory of 4568	2208	bridgeComponentwebNet.exe	103
PID 2208 wrote to memory of 4568	2208	bridgeComponentwebNet.exe	103
PID 2208 wrote to memory of 756	2208	bridgeComponentwebNet.exe	104
PID 2208 wrote to memory of 756	2208	bridgeComponentwebNet.exe	104
PID 2208 wrote to memory of 4472	2208	bridgeComponentwebNet.exe	105
PID 2208 wrote to memory of 4472	2208	bridgeComponentwebNet.exe	105
PID 2208 wrote to memory of 2868	2208	bridgeComponentwebNet.exe	106
PID 2208 wrote to memory of 2868	2208	bridgeComponentwebNet.exe	106
PID 2208 wrote to memory of 3160	2208	bridgeComponentwebNet.exe	107
PID 2208 wrote to memory of 3160	2208	bridgeComponentwebNet.exe	107
PID 2208 wrote to memory of 2956	2208	bridgeComponentwebNet.exe	108
PID 2208 wrote to memory of 2956	2208	bridgeComponentwebNet.exe	108
PID 2208 wrote to memory of 1612	2208	bridgeComponentwebNet.exe	125
PID 2208 wrote to memory of 1612	2208	bridgeComponentwebNet.exe	125
PID 1612 wrote to memory of 3756	1612	cmd.exe	128
PID 1612 wrote to memory of 3756	1612	cmd.exe	128
PID 1612 wrote to memory of 5152	1612	cmd.exe	129
PID 1612 wrote to memory of 5152	1612	cmd.exe	129
PID 1612 wrote to memory of 5700	1612	cmd.exe	131
PID 1612 wrote to memory of 5700	1612	cmd.exe	131
PID 5700 wrote to memory of 1544	5700	bridgeComponentwebNet.exe	146
PID 5700 wrote to memory of 1544	5700	bridgeComponentwebNet.exe	146
PID 1544 wrote to memory of 2240	1544	cmd.exe	148
PID 1544 wrote to memory of 2240	1544	cmd.exe	148
PID 1544 wrote to memory of 3732	1544	cmd.exe	149
PID 1544 wrote to memory of 3732	1544	cmd.exe	149
PID 1544 wrote to memory of 5384	1544	cmd.exe	153
PID 1544 wrote to memory of 5384	1544	cmd.exe	153
PID 5384 wrote to memory of 1672	5384	bridgeComponentwebNet.exe	154

C:\Users\Admin\AppData\Local\Temp\usb_analyzer.exe
"C:\Users\Admin\AppData\Local\Temp\usb_analyzer.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ComComponent\Jkk0voYej8y0LS5mbzrI4Y.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ComComponent\LANM3bt5hLO.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2852
  - - C:\ComComponent\bridgeComponentwebNet.exe
      "C:\ComComponent/bridgeComponentwebNet.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ComComponent/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3180
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ComComponent\bridgeComponentwebNet.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VnNtBJh66E.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1612
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3756
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:5152
      - C:\ComComponent\bridgeComponentwebNet.exe
        
        "C:\ComComponent\bridgeComponentwebNet.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fIZrPQRpQG.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2240
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:3732
        
        C:\ComComponent\bridgeComponentwebNet.exe
        
        "C:\ComComponent\bridgeComponentwebNet.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ylDQV2JGYe.bat"
        9⤵
        
        PID:1672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4788
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:1676
        
        C:\ComComponent\bridgeComponentwebNet.exe
        
        "C:\ComComponent\bridgeComponentwebNet.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xtlNdaBxkU.bat"
        11⤵
        
        PID:5020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:756
        
        C:\ComComponent\bridgeComponentwebNet.exe
        
        "C:\ComComponent\bridgeComponentwebNet.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DABqzejj4v.bat"
        13⤵
        
        PID:2736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:5372
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:5376
        
        C:\ComComponent\bridgeComponentwebNet.exe
        
        "C:\ComComponent\bridgeComponentwebNet.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hNUloleJD7.bat"
        15⤵
        
        PID:5764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:5824
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:5836
        
        C:\ComComponent\bridgeComponentwebNet.exe
        
        "C:\ComComponent\bridgeComponentwebNet.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:6052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ImsszXQrCQ.bat"
        17⤵
        
        PID:1104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1508
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:2592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Jkk0voYej8y0LS5mbzrI4Y.vbe

Path C:\ComComponent\Jkk0voYej8y0LS5mbzrI4Y.vbe
Size 212B
SHA256 8f0a3ff1ac9ccde47d35d9cef46582cde1a85006b3aa5854e1be432ee656ed8f
MD5 3665024d62e24dea07532f3c635ffa6a
SHA1 bb10880b14d713b2dc3f213dc801ed8eea186236
SHA512 2b3da182f57d4903f2c97dfc982e8a070defe7b355842ffd134487fa36aea091a67eb534388ce3e7be6582300f81feb5bfb0bb7ef41970ebccdbd155bdc29038
MD5 SHA1 SHA512

Submit Download

LANM3bt5hLO.bat

Path C:\ComComponent\LANM3bt5hLO.bat
Size 207B
SHA256 c8762a21074584f12ebbd0858c5f1729c90f016f6031973baf4552b0058320ee
MD5 a6666d4f3279162f63ce5337c6d1fa2a
SHA1 34e7d52af25bcdc6be8efd603b228a883b0fede8
SHA512 878cdf34f8882beee57571502b67eecb70b8678fb96e307bb9420a211d754dbe321cee72e7a5e9586bf581a54cee1140e69ade960c81fc2970e36fbe988e2c62
MD5 SHA1 SHA512

Submit Download

bridgeComponentwebNet.exe

Path C:\ComComponent\bridgeComponentwebNet.exe
Size 3.6MB
SHA256 83f1e22a373819d0b9c54a94cef0e43d904e29ddb3fd3c3dea1e74d2c99ae40e
MD5 c903436720c49533ee40e97da7897cc2
SHA1 0f40e43b02551af2c65a023659cd3562e750a5ce
SHA512 54d15603c18a572bec722b92cbe01e25e4cacc686290748755195c6d1a82e713c24f375c28d17c5c3e22093fd10b3de279bcefdf6ffe5067ef60c39619bde475
SSDEEP 98304:W3SiDt89KlbM2isa/n/Prx873lVSAUmKatY:W3Si68RM2iz/n/l6WZmKatY
MD5 SHA1 SHA512 SSDEEP

Submit Download

bridgeComponentwebNet.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\bridgeComponentwebNet.exe.log
Size 1KB
SHA256 399712789c6f2c7bd1b7afdf835eb2ac525632424daf08e751186195ebdbba52
MD5 98d93f7a2239452aef29ed995c71b759
SHA1 d1fc6bff08e49cb16a1e5d0b0348232282cf5677
SHA512 1073e74c9f065aa02be1bfb172308c555c0ad0c5ff35315d76de23d2c6daf1d3fe0b32042a428431847d09b679f14cb129c058af3277e9ed16787d37ae276d96
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
MD5 SHA1 SHA512

Submit Download