Analysis
- max time kernel
1027s - max time network
424s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
11/07/2024, 12:38
General
- Target WaveInstaller.exe
- Size 249KB
- Sample240711-pt8draygma
- SHA256 4f9494cf61c3c10656a3f8eed5798ab604c815c34472c42c18b49656fb71d73e
Malware Config
Extracted
-
asyncrat
-
1.0.7
-
Default
-
127.0.0.1:8848
-
https://ooo.fluffiflower.xyz/:8848
-
ooo.fluffiflower.xyz:8848
-
2.132.191.110:8848
-
0.0.0.0:8848
-
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
Explorer.exe
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Renames multiple (4264) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies data under HKEY_USERS 18 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Explorer" /tr '"C:\Users\Admin\AppData\Roaming\Explorer.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Explorer" /tr '"C:\Users\Admin\AppData\Roaming\Explorer.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE000.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\Explorer.exe"C:\Users\Admin\AppData\Roaming\Explorer.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\RemoveOptimize.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
win32_LinkNoDrop32x32.gif
COPYRIGHT
LICENSE
THIRDPARTYLICENSEREADME-JAVAFX.txt
THIRDPARTYLICENSEREADME.txt
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
ucrtbase.dll
directshow.md
glib.md
gstreamer.md
icu_web.md
jpeg_fx.md
libffi.md
libxml2.md
libxslt.md
mesa3d.md
public_suffix.md
webkit.md
asm.md
bcel.md
cldr.md
colorimaging.md
cryptix.md
dom.md
dynalink.md
ecc.md
freebxml.md
giflib.md
icu.md
jcup.md
joni.md
jopt-simple.md
jpeg.md
lcms.md
libpng.md
mesa3d.md
pkcs11cryptotoken.md
pkcs11wrapper.md
relaxngcc.md
relaxngdatatype.md
relaxngom.md
santuario.md
thaidict.md
unicode.md
xalan.md
xerces.md
xmlresolver.md
zlib.md
OfficeClickToRun.exe
ClientSub2019_eula.txt
EventSource.dll
zlibwapi.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-xstate-l2-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll.DcRat
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
vccorlib140.dll
mfc140u.dll
msvcp120.dll
msvcr120.dll
ucrtbase.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-xstate-l2-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
mfc140u.dll
msvcp120.dll
msvcp140.dll
msvcr120.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
msvcp140.dll
vcruntime140.dll
misc.exe
vlc.mo
Microsoft.DiaSymReader.Native.amd64.dll
D3DCompiler_47_cor3.dll
vcruntime140_cor3.dll
tmpE000.tmp.bat
Explorer.exe
index.dat
fb3b0dbfee58fac8.customDestinations-ms
fb3b0dbfee58fac8.customDestinations-ms
memory/468-7-0x00007FFB773C0000-0x00007FFB77E81000-memory.dmp
memory/468-2-0x00007FFB773C0000-0x00007FFB77E81000-memory.dmp
memory/468-0-0x00007FFB773C3000-0x00007FFB773C5000-memory.dmp
memory/468-1-0x0000000000F60000-0x0000000000FA4000-memory.dmp
memory/1436-111-0x00007FFB55770000-0x00007FFB55780000-memory.dmp
memory/1436-110-0x00007FFB55770000-0x00007FFB55780000-memory.dmp
memory/1436-14-0x00007FFB55770000-0x00007FFB55780000-memory.dmp
memory/1436-15-0x00007FFB55770000-0x00007FFB55780000-memory.dmp
memory/1436-16-0x00007FFB55770000-0x00007FFB55780000-memory.dmp
memory/1436-17-0x00007FFB53710000-0x00007FFB53720000-memory.dmp
memory/1436-18-0x00007FFB53710000-0x00007FFB53720000-memory.dmp
memory/1436-12-0x00007FFB55770000-0x00007FFB55780000-memory.dmp
memory/1436-108-0x00007FFB55770000-0x00007FFB55780000-memory.dmp
memory/1436-109-0x00007FFB55770000-0x00007FFB55780000-memory.dmp
memory/1436-13-0x00007FFB55770000-0x00007FFB55780000-memory.dmp
memory/2464-8609-0x000001EE28E40000-0x000001EE28E41000-memory.dmp
memory/2464-8619-0x000001EE28E40000-0x000001EE28E41000-memory.dmp
memory/2464-8614-0x000001EE28E40000-0x000001EE28E41000-memory.dmp
memory/2464-8615-0x000001EE28E40000-0x000001EE28E41000-memory.dmp
memory/2464-8616-0x000001EE28E40000-0x000001EE28E41000-memory.dmp
memory/2464-8617-0x000001EE28E40000-0x000001EE28E41000-memory.dmp
memory/2464-8608-0x000001EE28E40000-0x000001EE28E41000-memory.dmp
memory/2464-8610-0x000001EE28E40000-0x000001EE28E41000-memory.dmp
memory/2464-8618-0x000001EE28E40000-0x000001EE28E41000-memory.dmp
memory/2464-8620-0x000001EE28E40000-0x000001EE28E41000-memory.dmp
memory/2804-54-0x00000000023D0000-0x00000000023EE000-memory.dmp
memory/2804-53-0x0000000002380000-0x000000000239E000-memory.dmp
memory/2804-1804-0x00000000023B0000-0x00000000023CA000-memory.dmp
memory/2804-3389-0x00000000022F0000-0x00000000022FE000-memory.dmp
memory/2804-52-0x000000001CCB0000-0x000000001CD26000-memory.dmp
memory/8636-8607-0x00007FF684830000-0x00007FF684897000-memory.dmp