3acb94f442e02f6166d75d811089e6bba356ad9750247551cb4974f7c51a5ee8

Analysis

max time kernel
13s
max time network
26s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05-09-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Win11DeathEdition.exe
Size

6.0MB
MD5

3b0fd2b8fa11f834837fa3e4c6868d1c
SHA1

7f6c7b922dc5a11e14a4c85321dd897dfe199c7a
SHA256

bd67e0b196bd3e1b23eb8b6952aefea5cd54dbd48022de958871d8c9678bd56f
SHA512

1a822326fc5983a1ba29095987fa3984bb442d4d85b3c381e2d5204da20032b9086ac7c0b02a5ca87f8b0981cf5fa5c9369ab5a2c4101c71e565572121a9c06a
SSDEEP

98304:1ucoALJpTqcAVsxPwjYPYQgcioJN+r9B0afk6HZ7naOucWwAxkvy27Pt+Uv8GStQ:1ukDRwjYPYQgciuN+5aYHZDaOf9A4yCf

Score

8^/10

bootkit discovery evasion persistence ransomware upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
4156	mbr.exe
2984	bgm.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4948-0-0x0000000000400000-0x00000000019F7000-memory.dmp	upx
behavioral1/memory/4948-22-0x0000000000400000-0x00000000019F7000-memory.dmp	upx
behavioral1/memory/4948-37-0x0000000000400000-0x00000000019F7000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Desktop\Wallpaper = "c:\\skulls.bmp"	reg.exe

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Win11DeathEdition.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3412	shutdown.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3920	taskkill.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3761892313-3378554128-2287991803-1000\{2AB6918A-F425-44D9-B25D-932484DB7D22}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
692	reg.exe
2772	reg.exe
2140	reg.exe
840	reg.exe
4604	reg.exe
1876	reg.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	taskkill.exe
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: 33	5012	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5012	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3168	Explorer.EXE
3168	Explorer.EXE

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
3168	Explorer.EXE
3168	Explorer.EXE
3168	Explorer.EXE
3168	Explorer.EXE
3168	Explorer.EXE
3168	Explorer.EXE
3168	Explorer.EXE
3168	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4068	4948	Win11DeathEdition.exe	80
PID 4948 wrote to memory of 4068	4948	Win11DeathEdition.exe	80
PID 4948 wrote to memory of 4068	4948	Win11DeathEdition.exe	80
PID 4068 wrote to memory of 692	4068	cmd.exe	81
PID 4068 wrote to memory of 692	4068	cmd.exe	81
PID 4068 wrote to memory of 692	4068	cmd.exe	81
PID 4068 wrote to memory of 2772	4068	cmd.exe	82
PID 4068 wrote to memory of 2772	4068	cmd.exe	82
PID 4068 wrote to memory of 2772	4068	cmd.exe	82
PID 4068 wrote to memory of 2140	4068	cmd.exe	83
PID 4068 wrote to memory of 2140	4068	cmd.exe	83
PID 4068 wrote to memory of 2140	4068	cmd.exe	83
PID 4068 wrote to memory of 840	4068	cmd.exe	84
PID 4068 wrote to memory of 840	4068	cmd.exe	84
PID 4068 wrote to memory of 840	4068	cmd.exe	84
PID 4068 wrote to memory of 4604	4068	cmd.exe	85
PID 4068 wrote to memory of 4604	4068	cmd.exe	85
PID 4068 wrote to memory of 4604	4068	cmd.exe	85
PID 4068 wrote to memory of 1692	4068	cmd.exe	86
PID 4068 wrote to memory of 1692	4068	cmd.exe	86
PID 4068 wrote to memory of 1692	4068	cmd.exe	86
PID 4068 wrote to memory of 2764	4068	cmd.exe	87
PID 4068 wrote to memory of 2764	4068	cmd.exe	87
PID 4068 wrote to memory of 2764	4068	cmd.exe	87
PID 4068 wrote to memory of 2620	4068	cmd.exe	88
PID 4068 wrote to memory of 2620	4068	cmd.exe	88
PID 4068 wrote to memory of 2620	4068	cmd.exe	88
PID 4068 wrote to memory of 5028	4068	cmd.exe	89
PID 4068 wrote to memory of 5028	4068	cmd.exe	89
PID 4068 wrote to memory of 5028	4068	cmd.exe	89
PID 4068 wrote to memory of 3644	4068	cmd.exe	90
PID 4068 wrote to memory of 3644	4068	cmd.exe	90
PID 4068 wrote to memory of 3644	4068	cmd.exe	90
PID 4068 wrote to memory of 1476	4068	cmd.exe	91
PID 4068 wrote to memory of 1476	4068	cmd.exe	91
PID 4068 wrote to memory of 1476	4068	cmd.exe	91
PID 4068 wrote to memory of 2372	4068	cmd.exe	92
PID 4068 wrote to memory of 2372	4068	cmd.exe	92
PID 4068 wrote to memory of 2372	4068	cmd.exe	92
PID 4068 wrote to memory of 1060	4068	cmd.exe	93
PID 4068 wrote to memory of 1060	4068	cmd.exe	93
PID 4068 wrote to memory of 1060	4068	cmd.exe	93
PID 4068 wrote to memory of 4740	4068	cmd.exe	94
PID 4068 wrote to memory of 4740	4068	cmd.exe	94
PID 4068 wrote to memory of 4740	4068	cmd.exe	94
PID 4068 wrote to memory of 1548	4068	cmd.exe	95
PID 4068 wrote to memory of 1548	4068	cmd.exe	95
PID 4068 wrote to memory of 1548	4068	cmd.exe	95
PID 4068 wrote to memory of 1188	4068	cmd.exe	96
PID 4068 wrote to memory of 1188	4068	cmd.exe	96
PID 4068 wrote to memory of 1188	4068	cmd.exe	96
PID 4068 wrote to memory of 3368	4068	cmd.exe	97
PID 4068 wrote to memory of 3368	4068	cmd.exe	97
PID 4068 wrote to memory of 3368	4068	cmd.exe	97
PID 4068 wrote to memory of 3032	4068	cmd.exe	98
PID 4068 wrote to memory of 3032	4068	cmd.exe	98
PID 4068 wrote to memory of 3032	4068	cmd.exe	98
PID 4068 wrote to memory of 1780	4068	cmd.exe	99
PID 4068 wrote to memory of 1780	4068	cmd.exe	99
PID 4068 wrote to memory of 1780	4068	cmd.exe	99
PID 4068 wrote to memory of 2396	4068	cmd.exe	100
PID 4068 wrote to memory of 2396	4068	cmd.exe	100
PID 4068 wrote to memory of 2396	4068	cmd.exe	100
PID 4068 wrote to memory of 3096	4068	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\Win11DeathEdition.exe
"C:\Users\Admin\AppData\Local\Temp\Win11DeathEdition.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A604.tmp\Win11DeathEdition.cmd""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\reg.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:692
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2772
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2140
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:840
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4604
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\skulls.bmp /f
    3⤵
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    PID:1692
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2620
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5028
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3644
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1060
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4740
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1548
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1188
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3032
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1780
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2396
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3096
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2068
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2528
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2532
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1672
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1180
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3664
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2596
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4816
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:344
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2824
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4160
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4876
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3756
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3108
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2468
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3248
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2224
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3104
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3716
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1876
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDesktop /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- - C:\Windows\SysWOW64\userinit.exe
    userinit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1164
  - - C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3168
    - - C:\Windows\System32\bwlbci.exe
        
        "C:\Windows\System32\bwlbci.exe"
        5⤵
        
        PID:3888
- - C:\Users\Admin\AppData\Local\Temp\A604.tmp\mbr.exe
    mbr.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\A604.tmp\bgm.exe
    bgm.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2984
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
    3⤵
    PID:4764
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
      4⤵
      PID:3148
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        5⤵
        
        PID:3464
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        6⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        7⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        8⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        9⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        10⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        11⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        12⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        13⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        14⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        15⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        16⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        17⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        18⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        19⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        20⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        21⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        22⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        23⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        24⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        25⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        26⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        27⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        28⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        29⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        30⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        31⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        32⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        33⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        34⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        35⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        36⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        37⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        38⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        39⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        40⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        41⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        42⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        43⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        44⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        45⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        46⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        47⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        48⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        49⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        50⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        51⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        52⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        53⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        54⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        55⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        56⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        57⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        58⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        59⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        60⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        61⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        62⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        63⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        64⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        65⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        66⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        67⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        68⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        69⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        70⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        71⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        72⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        73⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        74⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        75⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        76⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        77⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        78⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        79⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        80⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        81⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        82⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        83⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        84⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        85⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        86⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        87⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        88⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        89⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        90⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        91⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        92⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        93⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        94⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        95⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        96⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        97⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        98⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        99⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        100⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        101⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        102⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        103⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        104⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        105⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        106⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        107⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        108⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        109⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        110⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        111⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        112⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        113⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        114⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        115⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        116⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        117⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        118⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        119⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        120⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        121⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        122⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        123⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        124⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        125⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        126⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        127⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        128⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        129⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        130⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        131⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        132⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        133⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        134⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        135⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        136⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        137⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        138⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        139⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        140⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        141⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        142⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        143⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        144⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        145⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        146⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        147⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        148⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        149⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        150⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        151⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        152⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        153⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        154⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        155⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        156⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        157⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        158⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        159⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        160⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        161⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        162⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        163⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        164⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        165⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        166⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        167⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        168⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        169⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        170⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        171⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs"
        172⤵
        
        PID:11640
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 200 /c "There is no escaping Windows 11 Death Edition :)"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3412

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:388

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:492

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:1916

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZTZW67SQ\www.bing[1].xml

Filesize
540B

MD5
2bdaee45f81f8b31a67ab2597836ef7c

SHA1
702fe0ae714e5c1f6cac7468f8886ea317d8452c

SHA256
74ec3c15b703bfe41ffa4f287e7d8de8768329556d1610d27f2deaefc04f9381

SHA512
2d36e714c4ceed22bdc58e36d873321df0b8fbbbfecca0144d0ce0d79eec33550a45e706f70a3aa7495af52cb52231d87d3a60050ae2cc3f8cd87fad34fb2dd1

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZTZW67SQ\www.bing[1].xml

Filesize
15KB

MD5
41628470dfa6ce84c21cf7d1488609b7

SHA1
542052875939f04830cb7f6e0b45e5bb71f8106c

SHA256
5b5fd93925c13baced1da2304cb85b50265acdec9a1511a1b6f54f7032ca964f

SHA512
128df1e50126635deeafc9bd17d287f144ec6668aea38384f456cbdc1e018458f307e9406a82d0c5c40d2d5a2a91caf3da5f144315648ac2d1133404beaacb2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\A604.tmp\Win11DeathEdition.cmd

Filesize
3KB

MD5
ad203d1712509a695e9584cb5bcff77f

SHA1
270bf457774294c1106a1a5c8ebf527de8ca1cdd

SHA256
a4eea0cf3a3710cbe1c84db2b857fc0ec5c86f9db86e42ca3a7d0e20c736903c

SHA512
ffec78424b83122f8ca3ff7f4868ad509733c5617d03dc5d4002e9e9fb3055868c8c6313d5e552c8b8f4efad9478ca0e62a78256433737db3ddac568d453630c

Download Submit
C:\Users\Admin\AppData\Local\Temp\A604.tmp\bgm.exe

Filesize
102KB

MD5
dbc7a3b514ea61b80abddd1b0ce0f7b0

SHA1
fc30e8ca86ccca6437892b81b2027eaaef4b0123

SHA256
0655d878f1ad0cf365abaa2c41eb5ab84215265ba22300eb4e4603605280c040

SHA512
12ed40c58cde189eb7554c4dccc0558f9302a98f60274f1ddaee5f86bff89e4af2849724b40322ace269160d1c00cc9b508e32ed28c2b484412e4493289bfbbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\A604.tmp\bgm.wav

Filesize
19.0MB

MD5
1b185a156cfc1ddeff939bf62672516b

SHA1
fd8b803400036f42c8d20ae491e2f1f040a1aed5

SHA256
e147a3c7a333cbc90e1bf9c08955d191ce83f33542297121635c1d79ecfdfa36

SHA512
41b33930e3efe628dae39083ef616baaf6ceb46056a94ab21b4b67eec490b0442a4211eaab79fce1f75f40ecdc853d269c82b5c5389081102f11e0f2f6503ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\A604.tmp\escape.vbs

Filesize
112B

MD5
c5466729495e1701b6e548e798e39e39

SHA1
b8c08a7fc8c2d599bd416de20f1a7dfe608ff075

SHA256
5464ffdd8c2be512dfe8f6fb001b5ef92289d047b3c8715fe6032903d69c8341

SHA512
a87e8d77545850b80fe7f088b0948c12e1e4d18e97950a3a084c3114683e4dd2e003498ce2a9e3339cbd1c27f17f1a79829832d6456420b931dff1571323d4de

Download Submit
C:\Users\Admin\AppData\Local\Temp\A604.tmp\mbr.exe

Filesize
1.3MB

MD5
597309673628821262337de44e464773

SHA1
76f8af0dfd0e955c3334beddf537ca627e371754

SHA256
7947e5a4195b52ce9fe4133f21a7c8bcf9d90495fddbb49939976f7819c93e21

SHA512
d739cb91e20860d73e14df2a24364ae61932b81a6a07b86e3fbd35eee9ca12db5ca9ef02e16723896414701f61d8b80563e2f83187515d1fc67bbf0d705a57dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\A604.tmp\skulls.bmp

Filesize
147KB

MD5
759fc7d13778a84f9469f89accb56812

SHA1
f68eddfbf2243e223de7864c32cdb94825847e04

SHA256
e568707301b278ac0af9e2887ba21ac801d3681df7f32b00c0dc66afcd37ea59

SHA512
60f807f4e151b7717cec1de4b59b3dad0e64b31545e8913e96fa3a7d43b87070ad780cb5464069a989ae7b77130a99a2ec4c922d524559681206f9b4a449637c

Download Submit
memory/388-145-0x00000180C9710000-0x00000180C9730000-memory.dmp

Filesize
128KB

Download
memory/388-50-0x0000018097360000-0x0000018097460000-memory.dmp

Filesize
1024KB

Download
memory/388-77-0x00000180C9A00000-0x00000180C9B00000-memory.dmp

Filesize
1024KB

Download
memory/388-100-0x00000180C9A00000-0x00000180C9B00000-memory.dmp

Filesize
1024KB

Download
memory/388-143-0x00000180CAF10000-0x00000180CB010000-memory.dmp

Filesize
1024KB

Download
memory/388-144-0x00000180CAD60000-0x00000180CAD80000-memory.dmp

Filesize
128KB

Download
memory/388-142-0x00000180C9730000-0x00000180C9750000-memory.dmp

Filesize
128KB

Download
memory/388-228-0x00000180CE490000-0x00000180CE590000-memory.dmp

Filesize
1024KB

Download
memory/2984-322-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4156-32-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4948-37-0x0000000000400000-0x00000000019F7000-memory.dmp

Filesize
22.0MB

Download
memory/4948-0-0x0000000000400000-0x00000000019F7000-memory.dmp

Filesize
22.0MB

Download
memory/4948-22-0x0000000000400000-0x00000000019F7000-memory.dmp

Filesize
22.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads