Analysis
-
max time kernel
217s -
max time network
349s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04-07-2024 04:27
Errors
Reason
Machine shutdown
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
debff807992d6ab1c4d7ce874cbe5c76
-
SHA1
aa0994bb764049500dd24dc80016712b23fb604b
-
SHA256
73cffd144f64cb6db1760979226341a2672a1c423acad623665abc20f2b497fa
-
SHA512
2f620659102d4f1fd065cc857fe2ca25c0ba6f3fc3a9834581a3d9c3b4628191e8a18f08c502e42e4dee98e09efc755a5154e96059a6100446a89c66ebb2e5bb
-
SSDEEP
1536:WIWOBaZ84c6gEz5De2FzNDnghTAsKFbOZGdndxRKDIZ8Ud0DGMpbDNr1+uexCxoK:WIWOBaZ84c6gEz5De2FzNDnghTdWd7Kf
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI1NjA3MjI4MTE3NjkzMjQwMg.GxD9m_.zzsnEGguqBxqJmCsGwZDpT0jW55Z5MKiEbx3N8
-
server_id
1256072040117698732
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 31 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 64 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 27 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{f08af617-6262-42f7-9f07-7111241c61e8}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa395f855 /state1:0x41c64e6d2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Client-built.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Client-built.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\NetSh.exe"NetSh.exe" Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd01b4ab58,0x7ffd01b4ab68,0x7ffd01b4ab783⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2140 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4356 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4324 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4912 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4800 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1072 --field-trial-handle=1864,i,4394391126887181227,5241016288478406884,131072 /prefetch:23⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{76BE8257-C4C0-4D37-90C0-A23372254D27}1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jcpFilesize
8KB
MD5d1f9bc582f6df6921f901aad75c8fe2e
SHA1aa0ce9570cb5e078a01ba1735395756d16f1f7a4
SHA256822235218475010b3021ce482b7362ab6e64f2c6144099d80ea06983b6a4eff5
SHA512057572523ffa9bedb52fa7e81ca6f2b2d9b2cbb931adc7813a3957fec4df8b209a5e71e4bcf6b49117b388b7ceb2895315089fae581c0fe29762c5c184a85d7a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5c353cf5960d2b20017af3d3c117bee9d
SHA1f564b157b1e961314947a926be72320b39477ac7
SHA256efe315cab2f89c30c5e6b642e2419dcbd1a67aa1627ce90b63ea82939233ad68
SHA512ea0af6a66298833cce25c3f0452ebb9778a64eefd252ca12667764d005ca4b415461c2de8c65ec6a8cdaf947e6486db0186e87be2a8a394f578836d517f5db90
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD50473a1bc9bd6ce506c526d05faf21862
SHA17aead984db50b2e73aefccdb94a13f83ff8585ab
SHA2567624a26ab9049eb6400d05f01c2a9a4ea28579a247831955b192128cbeec469b
SHA512b0d7437c2fad3301a8588171b21e461aed32d1a327ee1d253e7840a2d5851c5ff9805e4d16d23e1fadb61415a412537aed716ecf79676409ceee6e81e6199caa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
356B
MD50fddbef02c9740bd8a98f991d758be1b
SHA1a3c5339260993432bc4c99a55f1dab702349e0fb
SHA2566180b067bc7008ee0bb237d3debc9ad30bc0184a058ed8fd41a8e87721f23a28
SHA5128590b34d19b94fae1c346b36bdb049b744c3c0cb79e3ab8bbc8d5693f145fea045a67731077157c27ea47c04c8d3a0b1d269de815980b7b8ae4bd51be1c6af6c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD550898c96f8ee5ad057f4715a46c172ea
SHA1a0c0426e006e27be97d1d185458c46dae4fc1cf9
SHA2563bf88ecc2a550073073cebbb078d58f519f2263fe910a4bb455b416c492ec60b
SHA512585cfacc665af4f1ea17c896920205c76cc9271e56088adda0ea7c871bb11efad4619e972b5c8d30939b89f0371e061b3033438b80358a83ab9ae3d4be54e9e6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD5109827bb7d6ce858b54742c0bfa3f89b
SHA1ba13ce3e45f2e9418a50f4d3c1d100ae2a9ba010
SHA2562b92bbb25e75b270567398bb92983522c2c35603e8d5842be3ed3f88e9a3e4bd
SHA5122de64ac8f16a605ceeab8b79d1e2bfdb9f8ba77e22f6ecc06a02e310574b89edd1fe71c50eaf5a6b4c0dca7e33c8d1a06b8da0b287a9ff78f9499a31c7786d13
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
270KB
MD5464f6990be7301fd27cf2d3d2cf0e220
SHA19630b4b567502d69e2ec4c24c8a1a135bc35e6b7
SHA2563b3059cd77a8aa01a2dfa516484fdabd3dec4d91209529727b57d3c22be58aa7
SHA512ebb05e24af2fb06e9108a85d741469a389e97d77004702c33b632d645617a18e4a93a51053ce29eca1f36be582331ed447da43dfe6b08e15041e9641c888b622
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
270KB
MD512b352a459b9616f0f9729dc1168b173
SHA1c16f647567a2129d78b9a85d917a4b6560a9185b
SHA256c761a45254cc8c7ee1172a491253ccd9b29cf9bb710a4aaba015cb1f0162cf12
SHA512696548d05264cd3146e2a4e11001d93f82f8a8ca838b6cc256b4bc85eae2e4bf8f7f1086b553e0be4b98bc7d1b7f65a426d265eded547166114fc9a68f1f2a28
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbFilesize
28KB
MD587d9bca9ae972128a68fccde11feb182
SHA18c4c0161e94c15f840ba14d704c77e535433f7dc
SHA256026beab2e6f436e2e8bd8f409baae6c70ca59d67860d241f65d7fd0f5b841d37
SHA512f822137ffe7706ab17699c0877737453d49c216d20470f8d041eb672455c6a4485a5569407fd87e346c6518c67fe4309a7be041bc3bacebb35ddbe6812860951
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jrqbq0op.4fi.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
\??\pipe\crashpad_2996_XQJAMOKQIOUGEQAMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/316-116-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/316-115-0x000001B038130000-0x000001B03815A000-memory.dmpFilesize
168KB
-
memory/436-120-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/436-119-0x000001E1AB690000-0x000001E1AB6BA000-memory.dmpFilesize
168KB
-
memory/616-105-0x0000027829780000-0x00000278297A3000-memory.dmpFilesize
140KB
-
memory/616-107-0x00000278297B0000-0x00000278297DA000-memory.dmpFilesize
168KB
-
memory/616-109-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/664-111-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/664-108-0x000001F47E600000-0x000001F47E62A000-memory.dmpFilesize
168KB
-
memory/956-143-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/956-142-0x000002A7A79A0000-0x000002A7A79CA000-memory.dmpFilesize
168KB
-
memory/1052-124-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/1052-123-0x000002C529490000-0x000002C5294BA000-memory.dmpFilesize
168KB
-
memory/1128-130-0x000001FCC3510000-0x000001FCC353A000-memory.dmpFilesize
168KB
-
memory/1128-131-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/1136-133-0x00000141F5100000-0x00000141F512A000-memory.dmpFilesize
168KB
-
memory/1136-134-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/1152-136-0x000001DCC5D30000-0x000001DCC5D5A000-memory.dmpFilesize
168KB
-
memory/1152-137-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/1196-140-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/1196-139-0x000002A2B6BA0000-0x000002A2B6BCA000-memory.dmpFilesize
168KB
-
memory/1276-147-0x0000021D5D1A0000-0x0000021D5D1CA000-memory.dmpFilesize
168KB
-
memory/1276-148-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/1336-151-0x00007FFCE60F0000-0x00007FFCE6100000-memory.dmpFilesize
64KB
-
memory/1336-150-0x00000135E4F30000-0x00000135E4F5A000-memory.dmpFilesize
168KB
-
memory/1384-160-0x00000244F2A90000-0x00000244F2ABA000-memory.dmpFilesize
168KB
-
memory/1608-102-0x00007FFD25C60000-0x00007FFD25D1E000-memory.dmpFilesize
760KB
-
memory/1608-101-0x00007FFD26070000-0x00007FFD26265000-memory.dmpFilesize
2.0MB
-
memory/1608-103-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/1608-100-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/1608-99-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/2180-95-0x00007FFD08010000-0x00007FFD08AD1000-memory.dmpFilesize
10.8MB
-
memory/2180-80-0x0000018A29AB0000-0x0000018A29AD2000-memory.dmpFilesize
136KB
-
memory/2180-88-0x00007FFD08010000-0x00007FFD08AD1000-memory.dmpFilesize
10.8MB
-
memory/2180-89-0x00007FFD08010000-0x00007FFD08AD1000-memory.dmpFilesize
10.8MB
-
memory/2180-90-0x00007FFD08010000-0x00007FFD08AD1000-memory.dmpFilesize
10.8MB
-
memory/4216-96-0x00000279F8070000-0x00000279F80AE000-memory.dmpFilesize
248KB
-
memory/4216-9-0x00000279F7FE0000-0x00000279F7FFE000-memory.dmpFilesize
120KB
-
memory/4216-7-0x00000279F8C30000-0x00000279F8CA6000-memory.dmpFilesize
472KB
-
memory/4216-6-0x00007FFD08010000-0x00007FFD08AD1000-memory.dmpFilesize
10.8MB
-
memory/4216-98-0x00007FFD25C60000-0x00007FFD25D1E000-memory.dmpFilesize
760KB
-
memory/4216-97-0x00007FFD26070000-0x00007FFD26265000-memory.dmpFilesize
2.0MB
-
memory/4216-0-0x00007FFD08013000-0x00007FFD08015000-memory.dmpFilesize
8KB
-
memory/4216-8-0x00000279F66E0000-0x00000279F66F2000-memory.dmpFilesize
72KB
-
memory/4216-5-0x00007FFD08013000-0x00007FFD08015000-memory.dmpFilesize
8KB
-
memory/4216-4-0x00000279F9160000-0x00000279F9688000-memory.dmpFilesize
5.2MB
-
memory/4216-3-0x00007FFD08010000-0x00007FFD08AD1000-memory.dmpFilesize
10.8MB
-
memory/4216-2-0x00000279F8960000-0x00000279F8B22000-memory.dmpFilesize
1.8MB
-
memory/4216-747-0x00007FFD08010000-0x00007FFD08AD1000-memory.dmpFilesize
10.8MB
-
memory/4216-1-0x00000279F6240000-0x00000279F6258000-memory.dmpFilesize
96KB