Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
15-06-2024 16:17
General
-
Target
Lypha-Builder.exe
-
Size
1.3MB
-
MD5
51bacfc2db65bb01e860893dd01c57bc
-
SHA1
1499f3ba3f3cbdc3e4db3aff5d15cb38c5cfebd5
-
SHA256
7915d96fd92766003b73b58c3e9b375487479b9b582ed3be8a88bf5fed8a8208
-
SHA512
9e93171d3118f192f60e5b52fea67a66a3eca1ab23230da44c1a1ce80119c642ba65f61eee32afe6cec8fbe0a7fd5176cea9fdff9e3917a26114a3d11d33cb66
-
SSDEEP
24576:OeZa7DEThQ6Cyn2OV7s+y1SXHNC0ssga+R6bcj+RZuQHWi3F//vxy6omL2:d8ETq6CyVA+y1I40ROIbNB2YFpPomL
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Remcos
C2
team-circles.gl.at.ply.gg:25349
Mutex
109bae44-c7e4-46f2-82cd-2c3efb4dc47e
Attributes
-
encryption_key
78AF43F549EE55D0FC30D38EC96EAA6F3A3F5CDF
-
install_name
Runtime Broker.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Runtime Broker
-
subdirectory
WD Defender
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 2 IoCs
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 25 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"13⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"17⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"19⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"57⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"59⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"60⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"62⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"63⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"64⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"65⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"66⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"C:\Users\Admin\AppData\Local\Temp\Lypha-Builder.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"64⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f65⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"65⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f66⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"63⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f64⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"64⤵
- Checks computer location settings
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f65⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wkXKc22LSlO3.bat" "65⤵
-
C:\Windows\system32\chcp.comchcp 6500166⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost66⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"62⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f63⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"63⤵
- Checks computer location settings
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f64⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jWTgd1puwKT2.bat" "64⤵
-
C:\Windows\system32\chcp.comchcp 6500165⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost65⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"57⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f58⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"58⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f59⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fBsHq93w9Kc2.bat" "59⤵
-
C:\Windows\system32\chcp.comchcp 6500160⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost60⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"56⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f57⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"57⤵
- Checks computer location settings
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f58⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\v4Knujc5q3kp.bat" "58⤵
-
C:\Windows\system32\chcp.comchcp 6500159⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost59⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"51⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f52⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"52⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f53⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wtf415HuDUAJ.bat" "53⤵
-
C:\Windows\system32\chcp.comchcp 6500154⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost54⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"50⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f51⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"51⤵
- Checks computer location settings
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f52⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PMzO9mgXUyDG.bat" "52⤵
-
C:\Windows\system32\chcp.comchcp 6500153⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost53⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"45⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f46⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"46⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f47⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xRd6nQctwjU1.bat" "47⤵
-
C:\Windows\system32\chcp.comchcp 6500148⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost48⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"44⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f45⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"45⤵
- Checks computer location settings
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f46⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zHOzCozhReER.bat" "46⤵
-
C:\Windows\system32\chcp.comchcp 6500147⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost47⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"47⤵
- Checks computer location settings
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f48⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bEQXw8RRm9yI.bat" "48⤵
-
C:\Windows\system32\chcp.comchcp 6500149⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost49⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f40⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"40⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f41⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aV7drPZapwRi.bat" "41⤵
-
C:\Windows\system32\chcp.comchcp 6500142⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost42⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f39⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f40⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fNyW9AUPA9QZ.bat" "40⤵
-
C:\Windows\system32\chcp.comchcp 6500141⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost41⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"41⤵
- Checks computer location settings
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f42⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fK3rpUUItVZt.bat" "42⤵
-
C:\Windows\system32\chcp.comchcp 6500143⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost43⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f38⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f39⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0rImd7GT25nw.bat" "39⤵
-
C:\Windows\system32\chcp.comchcp 6500140⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost40⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f34⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f35⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bsGRTk5jVA7m.bat" "35⤵
-
C:\Windows\system32\chcp.comchcp 6500136⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost36⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f33⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f34⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mtjQGD3xPATe.bat" "34⤵
-
C:\Windows\system32\chcp.comchcp 6500135⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost35⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f32⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f33⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G9nUYsq8YZb4.bat" "33⤵
-
C:\Windows\system32\chcp.comchcp 6500134⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost34⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f26⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f27⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Fhdehw6vI6xr.bat" "27⤵
-
C:\Windows\system32\chcp.comchcp 6500128⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost28⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f22⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f21⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f22⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FdiB9P3X49or.bat" "22⤵
-
C:\Windows\system32\chcp.comchcp 6500123⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost23⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f20⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f21⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aO6qbqOaxawj.bat" "21⤵
-
C:\Windows\system32\chcp.comchcp 6500122⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost22⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f19⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f20⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GcI1BpvbzmJU.bat" "20⤵
-
C:\Windows\system32\chcp.comchcp 6500121⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost21⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f18⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f19⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\51IZHGMBDLxx.bat" "19⤵
-
C:\Windows\system32\chcp.comchcp 6500120⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost20⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f17⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f18⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\n5GB6O33sknp.bat" "18⤵
-
C:\Windows\system32\chcp.comchcp 6500119⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost19⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"19⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f20⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6S6NXqGuQXHy.bat" "20⤵
-
C:\Windows\system32\chcp.comchcp 6500121⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost21⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f11⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f12⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IeW58JcGe6BY.bat" "12⤵
-
C:\Windows\system32\chcp.comchcp 6500113⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cIGNObGae6iv.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Lypha-Builder.exe.logFilesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Runtime Broker.exe.logFilesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
C:\Users\Admin\AppData\Local\Temp\51IZHGMBDLxx.batFilesize
220B
MD538dc8d51c3d2cff220730961823bb98d
SHA15b799cbf15b9f543ec69649434394ac0aa37208b
SHA2565eecac9a3dab8e02dec461f8fa2111d6f88613225ffc15436a0f94ca8819b61b
SHA512ab4a46c85c8d433935582a54649c342d83396da3d4c37c65376ae88604da33296002177bd7e3531df66ce2215979b240bb7d84c34f852c47565fc783dea83950
-
C:\Users\Admin\AppData\Local\Temp\GcI1BpvbzmJU.batFilesize
220B
MD5dc24d1e05cc70a2d1db4e547c6e4a34f
SHA1830a808221f0e20bf2e3214313eff2e10377e544
SHA256d0b3443bb4d7af4f2997457a21a113be2f0752654a0c8d2b1fcca8b3feda229f
SHA5124448eca52bd2549477019243a2cfffa2e413aaffcc54a9a9716d406b715576ef09162adbc4371067ed31e81fd364ee179256ed1c44de2b4e8a19aa28b55f0c33
-
C:\Users\Admin\AppData\Local\Temp\IeW58JcGe6BY.batFilesize
220B
MD56a91741a6a256fe14f774fb9228fa98d
SHA158b77f1537228388c5c91fef000159f4c67eb10d
SHA256024c7a3a76470846c3c0180eb496c46286238bdbdff33c110b7be8fde6336232
SHA512656f03710bc455698504c73fbd561794f83c1ea95265a89cf36e9a989cf0b04d64dbb4b7c2b56da17e88959d545a4735558e8e1a3edd5d632632f2f576b9d231
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exeFilesize
3.1MB
MD50296021acfb4f37e63df4de7461ebfd9
SHA114117dba6ce87cbb6561ebdfffec60cb21860800
SHA2564fc6d003d67f0a1b3a276018516c6a0fe6301b10efe9e41fccd2e5a645a3333a
SHA512ffff32821dc347531f6e814df23b1f848df002c33ca83c635bc2fb1d3b810e9c21ffa6da6f0beb1a207f55a9d4048828545d678a8137991d1de2266bcbe1deee
-
C:\Users\Admin\AppData\Local\Temp\aO6qbqOaxawj.batFilesize
220B
MD59d4d060a7d0b42696931bbb73537051f
SHA1f10f6a1ca4374f0b4fc12687fd56bb56be7bd55f
SHA256adc2221ca71b4d40f7f49187d0dea6394202f32b7b2ef06e471e17881bb1d9f1
SHA512ae435781f5660674a32270cbd42e18ee73ba84d8b9d05948fb39ec35ccaef74e3b4fa4afa12d0daff1cefdfb892932d21cffdd9c3a104d52786a4009a52613fc
-
C:\Users\Admin\AppData\Local\Temp\cIGNObGae6iv.batFilesize
220B
MD5b61e628c7a5f32240e0490782c1a6e02
SHA12b82c68f1eaf7cf8c5a1cfb6e2b87a618d965ce8
SHA256ecc6b37e03ea86e5623487645feb3afe36789d2682ff77639f40671f3bd80c2f
SHA5122bb64c9b0b735ca17aaecda0488fd42a724bb767e76ad234870e94275e6a5148d6e2b70e23012929ee64025b2bb94dbd860d754da99c38d6b8caa7b92ebc9121
-
C:\Users\Admin\AppData\Local\Temp\n5GB6O33sknp.batFilesize
220B
MD52c02fef1e9c3050debabda1b8547345a
SHA17e18a822aee92d36e412426ae1a257195d7bfee5
SHA256096c53334c99a51c16e5b8a7762407f9c55c02b2a7ed6791bdbf679a3a344ebc
SHA5127f563fdfff7eb55cdebace910d976c09409acc4c7670357681346edec8f8e8f99482402fab36a71be34f9002094db9b2bea923478269220b403a39a268af2c67
-
memory/2708-45-0x000000001C1D0000-0x000000001C282000-memory.dmpFilesize
712KB
-
memory/2708-44-0x000000001C0C0000-0x000000001C110000-memory.dmpFilesize
320KB
-
memory/3056-18-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmpFilesize
10.8MB
-
memory/3056-0-0x0000000000060000-0x00000000001BE000-memory.dmpFilesize
1.4MB
-
memory/3056-2-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmpFilesize
10.8MB
-
memory/3056-1-0x00007FFBF0A03000-0x00007FFBF0A05000-memory.dmpFilesize
8KB
-
memory/3224-22-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmpFilesize
10.8MB
-
memory/3224-19-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmpFilesize
10.8MB
-
memory/3224-12-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmpFilesize
10.8MB
-
memory/4516-32-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmpFilesize
10.8MB
-
memory/4516-16-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmpFilesize
10.8MB
-
memory/4516-17-0x0000000000140000-0x0000000000464000-memory.dmpFilesize
3.1MB