Malware Analysis Report

2024-10-23 19:27

Sample ID 240628-xn7h9sscqp
Target 27062024_1338_ItsComedy.exe
SHA256 76c26de3a458e5cc615fb37d0b6481a1260e6b62cc7e801a45210693f381ece7
Tags
asyncrat default rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

76c26de3a458e5cc615fb37d0b6481a1260e6b62cc7e801a45210693f381ece7

Threat Level: Known bad

The file 27062024_1338_ItsComedy.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat default rat

AsyncRat

Suspicious use of NtCreateUserProcessOtherParentProcess

Checks computer location settings

Drops startup file

Loads dropped DLL

Executes dropped EXE

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Enumerates processes with tasklist

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-28 19:01

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-28 19:01

Reported

2024-06-28 19:03

Platform

win7-20240508-en

Max time kernel

148s

Max time network

146s

Command Line

C:\Windows\Explorer.EXE

Signatures

AsyncRat

rat asyncrat

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OlympusSphere.url C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OlympusSphere.url C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2692 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2692 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2692 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2692 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2692 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2692 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2692 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2692 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 1008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 1008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 1008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 1008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2692 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif
PID 2692 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif
PID 2692 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif
PID 2692 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif
PID 2692 wrote to memory of 2264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2692 wrote to memory of 2264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2692 wrote to memory of 2264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2692 wrote to memory of 2264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1252 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1648 wrote to memory of 888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1648 wrote to memory of 888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1648 wrote to memory of 888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1252 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe
PID 1252 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe
PID 1252 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe
PID 1252 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe
PID 1252 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe
PID 1252 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe
PID 1252 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe
PID 1252 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe
PID 1252 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe

"C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Independence Independence.cmd & Independence.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 35330

C:\Windows\SysWOW64\findstr.exe

findstr /V "lyricscontactedmemopresenting" Prophet

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Titans + Handle 35330\h

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif

35330\Jump.pif 35330\h

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks.exe /create /tn "Clean" /tr "wscript //B 'C:\Users\Admin\AppData\Local\InnoSphere Dynamics\OlympusSphere.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OlympusSphere.url" & echo URL="C:\Users\Admin\AppData\Local\InnoSphere Dynamics\OlympusSphere.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OlympusSphere.url" & exit

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /create /tn "Clean" /tr "wscript //B 'C:\Users\Admin\AppData\Local\InnoSphere Dynamics\OlympusSphere.js'" /sc minute /mo 5 /F

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe

"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 AWqjsyYBOHNtsSrkoEC.AWqjsyYBOHNtsSrkoEC udp
US 8.8.8.8:53 williamskim.ddnsfree.com udp
US 45.88.186.62:7777 williamskim.ddnsfree.com tcp
US 45.88.186.62:8888 williamskim.ddnsfree.com tcp
US 45.88.186.62:6666 williamskim.ddnsfree.com tcp
US 45.88.186.62:7777 williamskim.ddnsfree.com tcp
US 45.88.186.62:7777 williamskim.ddnsfree.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Independence

MD5 5c1b0ebcfcadb05db9293470d30d63c2
SHA1 44efbca5e75a22669c134bd50b886c115e723ddb
SHA256 4b4f1460296fd9c93300345b4ecd290582074138816f76bd088a3a62138b2f28
SHA512 8209813041bd8cbb246310ff0fbd879dcace2b21246d5755b906a49d5096057fd4b1473445911b7ff86b98a01080ff8f0c4a654c3ed412e25f80582e189854a2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Prophet

MD5 f8f272569f0d5808afa7d83bc3f9ef78
SHA1 1b904cfec825e6cb37bc3e7449a3a8bd280c6007
SHA256 e5944d8160b37fd9466f1913b847f17e7eef189ae51d1dcc62f52d6ae15e1ec6
SHA512 80b2621829cc90630f27236493f3f419fe7d2b43c7ab7301aa5dbf08a5aa858d2daddd278dabc13d93873da48a42ba32644ebda11c7a50c30e5e3794d0453b53

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Clusters

MD5 6de3ebff4d70e9386b867cdf06bf9646
SHA1 a23771d7d216da0954155c234d681df271fbdb7a
SHA256 dcbc3af043099595e02f13a94fac0ada7058c5d16e865b03beb469cd043ea427
SHA512 0760043b5ee681f9d8a826e9990edd618269364bb23ec8419aa74304bd344f1414da5ac14a2bb486be100de4ad1a946a1b9165b7f832b553e3c94e17cc095cd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Cabin

MD5 505a7fd24f50e6d4dae730f1d52f5dc3
SHA1 f771d2d4c0ece96007337c94d0effccf7e9394ef
SHA256 c3d364e0fe4a4ef8a8bd5998c29850cf858632781e40b38b5ef1191fdea2c5d3
SHA512 a23f3a2eec231f0ca7ea9cf9a81cff4058b4c7e68802b2b10661f9b3f0da6987235b9f999a1db561147d7746f697bbb4f56b17be3979eeb47dc1e72f3ac75a61

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Unemployment

MD5 673bc902d7a44f54ca8e9ca5b2e39f39
SHA1 00c1e07bf7137586867f1e5d80d2ae032b87cab6
SHA256 6fb21cb5f301b0af65c50a3b1655a96b297d575aae289732f835c7e7f3dc32f7
SHA512 e73f5495a8ccb9eebd7c51346556709862b97ba300dd07b10c5caf35876f72b4f433d5060876c27f7d153e00edfd1a82a1b9e74b0b4efb6e9576f6da43952e7a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Feof

MD5 f020ff33fc469f17019859cb097cea0f
SHA1 f11ffe34c9ecf5808c1cf28949a157a7f69f0449
SHA256 08fbc38d4481d6453d746953a8f8981838864f222da92504aac6231dd1a9bf34
SHA512 93dfecaf5737cef24db750b33922a79c6bb55cc6f4dabf35d2c8de6c707bbb9626931f71985152b432f4650f48f72f4ba84561bba035ce5e7cf62734147f679d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Reconstruction

MD5 ae686354302543cc52465040f6ce13da
SHA1 0536f53017b03d6e5ff89c4396bf0fc23fd02b34
SHA256 172c79650a20a131ea83751092d49b0d883ded79b4d5aec7114b50b16544314b
SHA512 15b380364b0f4bf0c8c6cdf62ef3f7749b67ed4116b0bc80d56d7eff780fbc19eabd6dfa313136c46cd751b4450b6b6a3da025d62f93433bc2ab47d6df507a3a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Perfectly

MD5 21644a62410087fa4285add5fdd76d37
SHA1 68c1897ec264fd069ff528cc714f51695938cfdd
SHA256 fd703913ad6269d58ad73f3d21d24685b20190c31588a3758f74cc3e017fb5bc
SHA512 d0dd4753b69cc181679e2ca1413632370c0ae48f6fe65f3aabebe6245b3e4597e6dba294bd234c3c76e8b074c39160ef2b81132a4aa8903ee447e669b5b6cafb

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Settlement

MD5 14e7252aa84a434291c2737b7dccd3ae
SHA1 a4dfa2c4797e2bceab9dd942b29fafb2d42d4286
SHA256 2be9cc52196e886d695b23ac3b9acab54ce8c887c99950219933fdd4be8e1162
SHA512 4854dc23353d948bb1788a61997c454baa7f6e0fbe38f07f962380f6b03c495eb7f97972d711713b39d1740f58eed613a50b124d9f64519b903a9f6e6a6bee05

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Regression

MD5 c3859d6640a8eed39ffc92a7f8ce5320
SHA1 ef51d37fee1be33f6a33389f80adb1cf474226a2
SHA256 120116c14de37146c87816ade00091d5aa11dfba659089a77148c04cba05f2aa
SHA512 b28254120361ee45d898abd476cd640ffd401e3a4c6fcbc2dbde0ffd03f93f96103de63166e37dc918824b005ffa99ae60c45aec90fa1f4461b6258910b257ea

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Flame

MD5 603363088becdf8d047e20f6622850ef
SHA1 4b423cb971054c4f515fe996663389bfb9beeeca
SHA256 aa8be118467c5445be86cf42e435d6dbfc2739e2bf662a12deee8a9a53bc4345
SHA512 3d8dcfc71ebd52d275c87463cea8fb0a4f1ae4c23a983ea7c46473406d346af03efeb0207fe3ee3126f8328e9a87e9177b485f8ef51054637eceef629cd2cd1d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Accessed

MD5 ad3a847840ec3068217dc39ae79ac28a
SHA1 51ef2e41ab0e3c353e32e043122e4ab05aca5add
SHA256 ae461684d7e96872dcd57925a840eb1dcf49c0dee79e520ff892caf09b1cc8ae
SHA512 4064e7af32a331bb057a972cf80577bbe4b815e8cfff327d19466805d6aa4471cbf343d2be28ea5dce1f149d9d98c0ee516266843f20352f747f3815acb3e637

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Customer

MD5 ed1f39f8f3d48f6f0e246e6015902943
SHA1 b615f52e59114f427c37462af61a47aa9eb9a858
SHA256 12c40c707f0097f6ce6fde00fadd2661d94639bcfd9f38b0f4902ce9d7b3406c
SHA512 63b49cd825ce4c26e20f56a2a927273cb72bbfba13dacfd7b1efa56a3367a83094b6ee4dd5641d1235e2a64955c97bbe012df7713a4c1dd7f5e3621bb0882c6c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Cabinet

MD5 edc51cc4d66e83dc2ef475107bb34e59
SHA1 e8f74cca43746fc784b92c92748a39035e03c32e
SHA256 4b8ee0f2ca5b6ee0d9a52714ccf250701161ed592a81c4ae9d8bfa3c2d9e53c9
SHA512 b779b8d62ab22da85d726f4c2832d20e9b48b7ea17f63c07ec1eb83a439e8841cc48148bcd7db75fc0b9741a68a9bfa0066f45ba49d10b95ad171469a4c16058

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Indonesia

MD5 3463c4b996d0b8cf23726993452e1222
SHA1 f4b6708203839f9cbb153452595f83e4ee875bd6
SHA256 02f6270f5e510e163891b51218a860aad10ce0a1e3a928d49c4b83848a4fb570
SHA512 20a6836e39bdfa46c06a3d355a40aee775249d0b5c10e68331802aaf69900e11d7fa9f4dd7986a0fa0485e39fe021d9e8dc67fe51d57c922564c65205c5a9e2b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Modification

MD5 8710e1df348213ecb7d987b62a037877
SHA1 e622307e7dc163bcd9f230842c596a32d72e1332
SHA256 8fca92cbc06cc81ea566beda9823b4b17065ebedbce35c04f8b68ddf8098003d
SHA512 bb448e9b169bb423d61328a8e1c5483b6e2d9230c98e8dd5b599aad1213435d6f2343ce9d2d0adbbcd127adfccffad4c3866a456b921f9ec69e80dcee2ec1b10

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Underlying

MD5 03e70b78f8154538a259cd08443b973e
SHA1 b4055d92fd6442786ef08d45080cdc6bb8df63d0
SHA256 f3120d51f80971fa94aabe5aaa8a454549a0e2b5a260db3c3e08fc5bd6bc4769
SHA512 13cdb3810f1322009b61ef78324f0e7469c4f810e91989e10e0b93a238273084de493f4e072a31ae960c819f592d47c9ce62c5a520b1c2390216bff967f84fa5

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Nursing

MD5 df7fa797512cb5c2993305609243700b
SHA1 ab4088a0ef523a39faea0b84dedee17c82ce6009
SHA256 d8b632723c86d3a14c59f6c6d11d44ebb1f736e16107c5f522d60d972455a0e3
SHA512 63754361eec44195ee7ff7f4ecff470a4c54e27c0f6e1bf3441093579ce1c8f3c957d739a4be8db9b13534b64bb8aae287467bee0bf27fda0fc015e8a138329c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Quoted

MD5 4eb4d6a0403d4c9275c34f092dc73fd5
SHA1 e236bfad57c73f98214e75962165176d62515740
SHA256 7b822f9544c68797021670399ea514ec7918d2ff6ca4faff3ffa9d1854499ca1
SHA512 6d1b3d19c607447401de38c6a1af07bfd6b9c21b18b0bb41a99fd31d5657998eb65be39dc8349da9e0d020eea51bc8403870032d7c4d91792cf3be763692703f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Gg

MD5 815ce0fbc8e99228d61ac97c678e83ac
SHA1 5291117694021c3e27575e8aabedc5575b70da48
SHA256 82d4680a1a388a28456408b852766acee670bafa3f74a7bfd9b2008104deecff
SHA512 872f6588a8b0391ed744791cd9fe64e9c90baa12826f431802077b965f1b89983b9d45cddef53f674fde8872c1363d567795d43be0aae54bdec03414bab68bcd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Tract

MD5 525662f775046f7d54129abde72e62dc
SHA1 12f7150167531d5994a5dae90e334eeea79192a6
SHA256 d269c6be8e97947285690d863018cf387a66af980a33ac49bfb0dbded416bce4
SHA512 8876b4d570b277c26c25dcd923686c198c2fbe2416a0fcc5bf088f1982eff01fa18376a8720c1d6092d7d31b084130e07661ad60d0d5f0551064b4c9b59450cd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Part

MD5 d82f6ba7d72174472d9dad55887ab74c
SHA1 7e3925bf1332ba6f26e084a36ef318ff88275747
SHA256 02da244976dbdd9980d66084e209857d6bcc35c05f7b0a35fed17e84c07cfaae
SHA512 793b8ca9a297c3255af365eb9e69e6541ffaf2afd2491be8a5ac533cfc674b86ac20edea36b42712fce1421a6ab487f38186176949fec82b377f0221d593211e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Advances

MD5 4c2a7b465453ab007eccd82714ae6841
SHA1 fca37fdda7e960803df86326349e85046ab9ca7d
SHA256 a17b3aff2c0a3e8ecbbb125482363376a69448040cb56c744a6fa6f7c0333842
SHA512 7db9457ad9a4596197dbf90e99c459dd5152ca19d295cf2a03686ef50f58fbc5a5177cf963c24dadbbaf031ed16e15b208ca5ee5415023e2cded27485ac2fc25

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Rape

MD5 77642e9df4f8a56c25c10493a3eb1ec1
SHA1 fda842f506fae08cf27d535df16b944e2c223a01
SHA256 bcff49ffc8467b5b056d436920d044354b2f9b6c40c09d399f95fe02b0bab467
SHA512 f43d9d61e6d30d3d2a4c81ebb069185cfc4c0a3ae8394112a94218c576e950dda7ae386a8934f26148b73aa5281e5ed49821181efa1301a0bd75b600c2def566

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Colours

MD5 04e298b0794ca25e72ddd47c3348bd8b
SHA1 90e3ed3135d391fe9ab3e207bf6c712782eb932b
SHA256 39ab6053ff55137d4ef16762ba570308cc62ffef24fe0d98e9b884f57b6de20e
SHA512 6cebed2a732a35ed143a1b32f06d3d21bb5ee78bfcb7df2d0422db8ea1028d9224c01a0ba9314706c9cb5ea388142db400f3bcf424197224ba7832fdc2f42406

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Merry

MD5 8efb5fa7b6382089cc120b6c8c2eef89
SHA1 f7cb62e2808d1a795a2c202278f1c0693fc29418
SHA256 351f326abe4b94867aa5c53b0f884cdce95796911c02c8dd534bcc09ae8c5a62
SHA512 06c8c27af2931cfa41549bcbfe95c7c55508503c2b2154c4ede5e4ba341ff957dfa8b35f1d3a212dbeb37268a181486bff1e5c196251184042c5992a14ca68ce

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Mice

MD5 36d19670e13e4cdb20d7bf563df87148
SHA1 3ee2490c7ef90d6c12fbfba15b416fb0da7c5e57
SHA256 92b4ca0fa34bb26dbabb93b62fb41f0658edb0fc466e7ed47e4fe42516b1ff8e
SHA512 85194f9ed4c26d7289319e6696f92ce084781e0a060dd213f9451de7b88c27dc0d1cdd30f896c9036e1f3a0ef78218651eb82c6db22ebf779be3634070e97953

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Titans

MD5 77a06866bdf8b390b012395355a2b6a1
SHA1 3524b9875e786cf95d4e7a15c88e91f71b775b4d
SHA256 fe41358abef48f44c60ecbc03a69c9737b3affa60f0051fe64e18f6feb356d94
SHA512 80829ebfd483cd1e7acf735b8144eec0ebf2b0f64f11dd0af464f8b9fad496e1f8cd05271f888ceb4fde75da28f7d75df23125b040462b795f7658a7af17c470

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Handle

MD5 81929761d0cbd9ae69ee1564db1587e5
SHA1 f6627fd5158a3c73e0556d3166e4890cb821571b
SHA256 1b8c7661efd14c7a59fbf493c2540dcc7183ec7013effec1e3e2eba551c054c0
SHA512 f2c4f32c7352a0eb38c6d1119370eb7fba1cde6fa6a36441698ec72478369685b61c8e0334c934769735dc7f8934813af42a0670f2fffaa7378378deb9ad1bdd

\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\Jump.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\h

MD5 503b5d3d040f1da0055238231efab91d
SHA1 f8e423aaf31a6cef2865ca090dc082b6c205cfee
SHA256 8a01422f631066481c405dcb208a7516350d1cf41c2a0820fd768e277ddc4e23
SHA512 a5d32e94331d496fd3eed2ec726f19af71a5aa4879b9ba5aeab8837e62c12eaa1c46ba1ad5d20063bd40d302ce0810b00f3caaba770e1c6e5c07e5e807dbc4a9

\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\35330\RegAsm.exe

MD5 b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1 d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA256 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512 b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

memory/2612-337-0x0000000000090000-0x00000000000A6000-memory.dmp

memory/2612-340-0x0000000000090000-0x00000000000A6000-memory.dmp

memory/2612-339-0x0000000000090000-0x00000000000A6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-28 19:01

Reported

2024-06-28 19:03

Platform

win10v2004-20240508-en

Max time kernel

139s

Max time network

148s

Command Line

C:\Windows\Explorer.EXE

Signatures

AsyncRat

rat asyncrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OlympusSphere.url C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OlympusSphere.url C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4548 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe C:\Windows\SysWOW64\cmd.exe
PID 4548 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe C:\Windows\SysWOW64\cmd.exe
PID 4548 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe C:\Windows\SysWOW64\cmd.exe
PID 4952 wrote to memory of 4456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4952 wrote to memory of 4456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4952 wrote to memory of 4456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4952 wrote to memory of 4180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4952 wrote to memory of 4180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4952 wrote to memory of 4180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4952 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4952 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4952 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4952 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4952 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4952 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4952 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4952 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4952 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4952 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4952 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4952 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4952 wrote to memory of 4064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4952 wrote to memory of 4064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4952 wrote to memory of 4064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4952 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif
PID 4952 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif
PID 4952 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif
PID 4952 wrote to memory of 3104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4952 wrote to memory of 3104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4952 wrote to memory of 3104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 816 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 816 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 816 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 816 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 816 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 816 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 1112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2396 wrote to memory of 1112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2396 wrote to memory of 1112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 816 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\RegAsm.exe
PID 816 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\RegAsm.exe
PID 816 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\RegAsm.exe
PID 816 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\RegAsm.exe
PID 816 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\RegAsm.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe

"C:\Users\Admin\AppData\Local\Temp\27062024_1338_ItsComedy.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Independence Independence.cmd & Independence.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 35330

C:\Windows\SysWOW64\findstr.exe

findstr /V "lyricscontactedmemopresenting" Prophet

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Titans + Handle 35330\h

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif

35330\Jump.pif 35330\h

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks.exe /create /tn "Clean" /tr "wscript //B 'C:\Users\Admin\AppData\Local\InnoSphere Dynamics\OlympusSphere.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OlympusSphere.url" & echo URL="C:\Users\Admin\AppData\Local\InnoSphere Dynamics\OlympusSphere.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OlympusSphere.url" & exit

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /create /tn "Clean" /tr "wscript //B 'C:\Users\Admin\AppData\Local\InnoSphere Dynamics\OlympusSphere.js'" /sc minute /mo 5 /F

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\RegAsm.exe

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\RegAsm.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 AWqjsyYBOHNtsSrkoEC.AWqjsyYBOHNtsSrkoEC udp
US 8.8.8.8:53 williamskim.ddnsfree.com udp
US 8.8.8.8:53 williamskim.ddnsfree.com udp
US 8.8.8.8:53 williamskim.ddnsfree.com udp
US 8.8.8.8:53 williamskim.ddnsfree.com udp
US 8.8.8.8:53 williamskim.ddnsfree.com udp
US 8.8.8.8:53 williamskim.ddnsfree.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Independence

MD5 5c1b0ebcfcadb05db9293470d30d63c2
SHA1 44efbca5e75a22669c134bd50b886c115e723ddb
SHA256 4b4f1460296fd9c93300345b4ecd290582074138816f76bd088a3a62138b2f28
SHA512 8209813041bd8cbb246310ff0fbd879dcace2b21246d5755b906a49d5096057fd4b1473445911b7ff86b98a01080ff8f0c4a654c3ed412e25f80582e189854a2

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Prophet

MD5 f8f272569f0d5808afa7d83bc3f9ef78
SHA1 1b904cfec825e6cb37bc3e7449a3a8bd280c6007
SHA256 e5944d8160b37fd9466f1913b847f17e7eef189ae51d1dcc62f52d6ae15e1ec6
SHA512 80b2621829cc90630f27236493f3f419fe7d2b43c7ab7301aa5dbf08a5aa858d2daddd278dabc13d93873da48a42ba32644ebda11c7a50c30e5e3794d0453b53

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Clusters

MD5 6de3ebff4d70e9386b867cdf06bf9646
SHA1 a23771d7d216da0954155c234d681df271fbdb7a
SHA256 dcbc3af043099595e02f13a94fac0ada7058c5d16e865b03beb469cd043ea427
SHA512 0760043b5ee681f9d8a826e9990edd618269364bb23ec8419aa74304bd344f1414da5ac14a2bb486be100de4ad1a946a1b9165b7f832b553e3c94e17cc095cd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cabin

MD5 505a7fd24f50e6d4dae730f1d52f5dc3
SHA1 f771d2d4c0ece96007337c94d0effccf7e9394ef
SHA256 c3d364e0fe4a4ef8a8bd5998c29850cf858632781e40b38b5ef1191fdea2c5d3
SHA512 a23f3a2eec231f0ca7ea9cf9a81cff4058b4c7e68802b2b10661f9b3f0da6987235b9f999a1db561147d7746f697bbb4f56b17be3979eeb47dc1e72f3ac75a61

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Unemployment

MD5 673bc902d7a44f54ca8e9ca5b2e39f39
SHA1 00c1e07bf7137586867f1e5d80d2ae032b87cab6
SHA256 6fb21cb5f301b0af65c50a3b1655a96b297d575aae289732f835c7e7f3dc32f7
SHA512 e73f5495a8ccb9eebd7c51346556709862b97ba300dd07b10c5caf35876f72b4f433d5060876c27f7d153e00edfd1a82a1b9e74b0b4efb6e9576f6da43952e7a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Reconstruction

MD5 ae686354302543cc52465040f6ce13da
SHA1 0536f53017b03d6e5ff89c4396bf0fc23fd02b34
SHA256 172c79650a20a131ea83751092d49b0d883ded79b4d5aec7114b50b16544314b
SHA512 15b380364b0f4bf0c8c6cdf62ef3f7749b67ed4116b0bc80d56d7eff780fbc19eabd6dfa313136c46cd751b4450b6b6a3da025d62f93433bc2ab47d6df507a3a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Feof

MD5 f020ff33fc469f17019859cb097cea0f
SHA1 f11ffe34c9ecf5808c1cf28949a157a7f69f0449
SHA256 08fbc38d4481d6453d746953a8f8981838864f222da92504aac6231dd1a9bf34
SHA512 93dfecaf5737cef24db750b33922a79c6bb55cc6f4dabf35d2c8de6c707bbb9626931f71985152b432f4650f48f72f4ba84561bba035ce5e7cf62734147f679d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Settlement

MD5 14e7252aa84a434291c2737b7dccd3ae
SHA1 a4dfa2c4797e2bceab9dd942b29fafb2d42d4286
SHA256 2be9cc52196e886d695b23ac3b9acab54ce8c887c99950219933fdd4be8e1162
SHA512 4854dc23353d948bb1788a61997c454baa7f6e0fbe38f07f962380f6b03c495eb7f97972d711713b39d1740f58eed613a50b124d9f64519b903a9f6e6a6bee05

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Perfectly

MD5 21644a62410087fa4285add5fdd76d37
SHA1 68c1897ec264fd069ff528cc714f51695938cfdd
SHA256 fd703913ad6269d58ad73f3d21d24685b20190c31588a3758f74cc3e017fb5bc
SHA512 d0dd4753b69cc181679e2ca1413632370c0ae48f6fe65f3aabebe6245b3e4597e6dba294bd234c3c76e8b074c39160ef2b81132a4aa8903ee447e669b5b6cafb

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Flame

MD5 603363088becdf8d047e20f6622850ef
SHA1 4b423cb971054c4f515fe996663389bfb9beeeca
SHA256 aa8be118467c5445be86cf42e435d6dbfc2739e2bf662a12deee8a9a53bc4345
SHA512 3d8dcfc71ebd52d275c87463cea8fb0a4f1ae4c23a983ea7c46473406d346af03efeb0207fe3ee3126f8328e9a87e9177b485f8ef51054637eceef629cd2cd1d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Regression

MD5 c3859d6640a8eed39ffc92a7f8ce5320
SHA1 ef51d37fee1be33f6a33389f80adb1cf474226a2
SHA256 120116c14de37146c87816ade00091d5aa11dfba659089a77148c04cba05f2aa
SHA512 b28254120361ee45d898abd476cd640ffd401e3a4c6fcbc2dbde0ffd03f93f96103de63166e37dc918824b005ffa99ae60c45aec90fa1f4461b6258910b257ea

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Customer

MD5 ed1f39f8f3d48f6f0e246e6015902943
SHA1 b615f52e59114f427c37462af61a47aa9eb9a858
SHA256 12c40c707f0097f6ce6fde00fadd2661d94639bcfd9f38b0f4902ce9d7b3406c
SHA512 63b49cd825ce4c26e20f56a2a927273cb72bbfba13dacfd7b1efa56a3367a83094b6ee4dd5641d1235e2a64955c97bbe012df7713a4c1dd7f5e3621bb0882c6c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Accessed

MD5 ad3a847840ec3068217dc39ae79ac28a
SHA1 51ef2e41ab0e3c353e32e043122e4ab05aca5add
SHA256 ae461684d7e96872dcd57925a840eb1dcf49c0dee79e520ff892caf09b1cc8ae
SHA512 4064e7af32a331bb057a972cf80577bbe4b815e8cfff327d19466805d6aa4471cbf343d2be28ea5dce1f149d9d98c0ee516266843f20352f747f3815acb3e637

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Indonesia

MD5 3463c4b996d0b8cf23726993452e1222
SHA1 f4b6708203839f9cbb153452595f83e4ee875bd6
SHA256 02f6270f5e510e163891b51218a860aad10ce0a1e3a928d49c4b83848a4fb570
SHA512 20a6836e39bdfa46c06a3d355a40aee775249d0b5c10e68331802aaf69900e11d7fa9f4dd7986a0fa0485e39fe021d9e8dc67fe51d57c922564c65205c5a9e2b

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cabinet

MD5 edc51cc4d66e83dc2ef475107bb34e59
SHA1 e8f74cca43746fc784b92c92748a39035e03c32e
SHA256 4b8ee0f2ca5b6ee0d9a52714ccf250701161ed592a81c4ae9d8bfa3c2d9e53c9
SHA512 b779b8d62ab22da85d726f4c2832d20e9b48b7ea17f63c07ec1eb83a439e8841cc48148bcd7db75fc0b9741a68a9bfa0066f45ba49d10b95ad171469a4c16058

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Underlying

MD5 03e70b78f8154538a259cd08443b973e
SHA1 b4055d92fd6442786ef08d45080cdc6bb8df63d0
SHA256 f3120d51f80971fa94aabe5aaa8a454549a0e2b5a260db3c3e08fc5bd6bc4769
SHA512 13cdb3810f1322009b61ef78324f0e7469c4f810e91989e10e0b93a238273084de493f4e072a31ae960c819f592d47c9ce62c5a520b1c2390216bff967f84fa5

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Modification

MD5 8710e1df348213ecb7d987b62a037877
SHA1 e622307e7dc163bcd9f230842c596a32d72e1332
SHA256 8fca92cbc06cc81ea566beda9823b4b17065ebedbce35c04f8b68ddf8098003d
SHA512 bb448e9b169bb423d61328a8e1c5483b6e2d9230c98e8dd5b599aad1213435d6f2343ce9d2d0adbbcd127adfccffad4c3866a456b921f9ec69e80dcee2ec1b10

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Quoted

MD5 4eb4d6a0403d4c9275c34f092dc73fd5
SHA1 e236bfad57c73f98214e75962165176d62515740
SHA256 7b822f9544c68797021670399ea514ec7918d2ff6ca4faff3ffa9d1854499ca1
SHA512 6d1b3d19c607447401de38c6a1af07bfd6b9c21b18b0bb41a99fd31d5657998eb65be39dc8349da9e0d020eea51bc8403870032d7c4d91792cf3be763692703f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Nursing

MD5 df7fa797512cb5c2993305609243700b
SHA1 ab4088a0ef523a39faea0b84dedee17c82ce6009
SHA256 d8b632723c86d3a14c59f6c6d11d44ebb1f736e16107c5f522d60d972455a0e3
SHA512 63754361eec44195ee7ff7f4ecff470a4c54e27c0f6e1bf3441093579ce1c8f3c957d739a4be8db9b13534b64bb8aae287467bee0bf27fda0fc015e8a138329c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Gg

MD5 815ce0fbc8e99228d61ac97c678e83ac
SHA1 5291117694021c3e27575e8aabedc5575b70da48
SHA256 82d4680a1a388a28456408b852766acee670bafa3f74a7bfd9b2008104deecff
SHA512 872f6588a8b0391ed744791cd9fe64e9c90baa12826f431802077b965f1b89983b9d45cddef53f674fde8872c1363d567795d43be0aae54bdec03414bab68bcd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Tract

MD5 525662f775046f7d54129abde72e62dc
SHA1 12f7150167531d5994a5dae90e334eeea79192a6
SHA256 d269c6be8e97947285690d863018cf387a66af980a33ac49bfb0dbded416bce4
SHA512 8876b4d570b277c26c25dcd923686c198c2fbe2416a0fcc5bf088f1982eff01fa18376a8720c1d6092d7d31b084130e07661ad60d0d5f0551064b4c9b59450cd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Part

MD5 d82f6ba7d72174472d9dad55887ab74c
SHA1 7e3925bf1332ba6f26e084a36ef318ff88275747
SHA256 02da244976dbdd9980d66084e209857d6bcc35c05f7b0a35fed17e84c07cfaae
SHA512 793b8ca9a297c3255af365eb9e69e6541ffaf2afd2491be8a5ac533cfc674b86ac20edea36b42712fce1421a6ab487f38186176949fec82b377f0221d593211e

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Advances

MD5 4c2a7b465453ab007eccd82714ae6841
SHA1 fca37fdda7e960803df86326349e85046ab9ca7d
SHA256 a17b3aff2c0a3e8ecbbb125482363376a69448040cb56c744a6fa6f7c0333842
SHA512 7db9457ad9a4596197dbf90e99c459dd5152ca19d295cf2a03686ef50f58fbc5a5177cf963c24dadbbaf031ed16e15b208ca5ee5415023e2cded27485ac2fc25

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Rape

MD5 77642e9df4f8a56c25c10493a3eb1ec1
SHA1 fda842f506fae08cf27d535df16b944e2c223a01
SHA256 bcff49ffc8467b5b056d436920d044354b2f9b6c40c09d399f95fe02b0bab467
SHA512 f43d9d61e6d30d3d2a4c81ebb069185cfc4c0a3ae8394112a94218c576e950dda7ae386a8934f26148b73aa5281e5ed49821181efa1301a0bd75b600c2def566

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Colours

MD5 04e298b0794ca25e72ddd47c3348bd8b
SHA1 90e3ed3135d391fe9ab3e207bf6c712782eb932b
SHA256 39ab6053ff55137d4ef16762ba570308cc62ffef24fe0d98e9b884f57b6de20e
SHA512 6cebed2a732a35ed143a1b32f06d3d21bb5ee78bfcb7df2d0422db8ea1028d9224c01a0ba9314706c9cb5ea388142db400f3bcf424197224ba7832fdc2f42406

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Mice

MD5 36d19670e13e4cdb20d7bf563df87148
SHA1 3ee2490c7ef90d6c12fbfba15b416fb0da7c5e57
SHA256 92b4ca0fa34bb26dbabb93b62fb41f0658edb0fc466e7ed47e4fe42516b1ff8e
SHA512 85194f9ed4c26d7289319e6696f92ce084781e0a060dd213f9451de7b88c27dc0d1cdd30f896c9036e1f3a0ef78218651eb82c6db22ebf779be3634070e97953

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Merry

MD5 8efb5fa7b6382089cc120b6c8c2eef89
SHA1 f7cb62e2808d1a795a2c202278f1c0693fc29418
SHA256 351f326abe4b94867aa5c53b0f884cdce95796911c02c8dd534bcc09ae8c5a62
SHA512 06c8c27af2931cfa41549bcbfe95c7c55508503c2b2154c4ede5e4ba341ff957dfa8b35f1d3a212dbeb37268a181486bff1e5c196251184042c5992a14ca68ce

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Titans

MD5 77a06866bdf8b390b012395355a2b6a1
SHA1 3524b9875e786cf95d4e7a15c88e91f71b775b4d
SHA256 fe41358abef48f44c60ecbc03a69c9737b3affa60f0051fe64e18f6feb356d94
SHA512 80829ebfd483cd1e7acf735b8144eec0ebf2b0f64f11dd0af464f8b9fad496e1f8cd05271f888ceb4fde75da28f7d75df23125b040462b795f7658a7af17c470

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Handle

MD5 81929761d0cbd9ae69ee1564db1587e5
SHA1 f6627fd5158a3c73e0556d3166e4890cb821571b
SHA256 1b8c7661efd14c7a59fbf493c2540dcc7183ec7013effec1e3e2eba551c054c0
SHA512 f2c4f32c7352a0eb38c6d1119370eb7fba1cde6fa6a36441698ec72478369685b61c8e0334c934769735dc7f8934813af42a0670f2fffaa7378378deb9ad1bdd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\Jump.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\h

MD5 503b5d3d040f1da0055238231efab91d
SHA1 f8e423aaf31a6cef2865ca090dc082b6c205cfee
SHA256 8a01422f631066481c405dcb208a7516350d1cf41c2a0820fd768e277ddc4e23
SHA512 a5d32e94331d496fd3eed2ec726f19af71a5aa4879b9ba5aeab8837e62c12eaa1c46ba1ad5d20063bd40d302ce0810b00f3caaba770e1c6e5c07e5e807dbc4a9

memory/464-333-0x0000000000FE0000-0x0000000000FF6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\35330\RegAsm.exe

MD5 0d5df43af2916f47d00c1573797c1a13
SHA1 230ab5559e806574d26b4c20847c368ed55483b0
SHA256 c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512 f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2