Overview

overview

10

Static

static

3

launcher.exe

windows7-x64

10

launcher.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    34s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/09/2024, 16:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    launcher.exe
  • Size 121KB
  • Sample240916-tp8aeaxbke
  • SHA256 b824428a19f5ea337430fcd7ca5cfaa67d58a5c27e6ae3e4d5688a85f85dbbde
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gurcuphemedronexwormexecutionratstealertrojan

Malware Config

Extracted

Family

  • phemedrone

C2

  • https://api.telegram.org/bot7093178471:AAF2vSzsv_7VHw_mw-hRkrEjGXZZ0VRp1-c/sendDocument

Extracted

Family

  • gurcu

C2

  • https://api.telegram.org/bot7093178471:AAF2vSzsv_7VHw_mw-hRkrEjGXZZ0VRp1-c/sendMessage?chat_id=7184004788

Signatures

  • Detect Xworm Payload 2 IoCs
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 41 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 20 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1500
    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3700
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:812
      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:864
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5060
        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1488
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2944
          • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4960
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:672
            • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
              "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
              6⤵
              • Checks computer location settings
              • Suspicious use of AdjustPrivilegeToken
              PID:4736
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1808
              • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                7⤵
                • Checks computer location settings
                • Suspicious use of AdjustPrivilegeToken
                PID:3592
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4616
                • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                  8⤵
                  • Checks computer location settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3308
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
                    9⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4620
                  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                    9⤵
                    • Checks computer location settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3976
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
                      10⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2112
                    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                      10⤵
                      • Checks computer location settings
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3280
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
                        11⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1416
                      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                        11⤵
                          PID:3884
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
                            12⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:1052
                          • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                            "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
                            12⤵
                              PID:884
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                              12⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:1332
                            • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                              "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                              12⤵
                                PID:2924
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                                12⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:860
                              • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                                "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                                12⤵
                                  PID:4616
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                                11⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4508
                              • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                                "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                                11⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4476
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                                11⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2524
                              • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                                "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                                11⤵
                                • Executes dropped EXE
                                PID:2156
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                              10⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4252
                            • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                              "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                              10⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2108
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                              10⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3320
                            • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                              "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                              10⤵
                              • Executes dropped EXE
                              PID:964
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                            9⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4068
                          • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                            "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                            9⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2376
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                              10⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious use of AdjustPrivilegeToken
                              PID:748
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
                              10⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious use of AdjustPrivilegeToken
                              PID:948
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\msedge.exe'
                              10⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:4528
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
                              10⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:4336
                            • C:\Windows\System32\schtasks.exe
                              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\msedge.exe"
                              10⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:5048
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                            9⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1364
                          • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                            "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                            9⤵
                            • Executes dropped EXE
                            PID:5092
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                          8⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2924
                        • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                          "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3528
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                          8⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4400
                        • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                          "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                          8⤵
                          • Executes dropped EXE
                          PID:4168
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4416
                      • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2444
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1424
                      • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:2376
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5072
                    • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                      "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:664
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1860
                    • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                      "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:764
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5116
                  • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                    "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3632
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3972
                  • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                    "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:4504
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1572
                • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                  "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4032
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:540
                • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                  "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:4104
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1756
              • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5080
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3604
              • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                3⤵
                • Executes dropped EXE
                PID:4736
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2776
            • C:\Users\Admin\AppData\Local\Temp\msedge.exe
              "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
              2⤵
              • Checks computer location settings
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2604
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:316
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4788
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\msedge.exe'
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4532
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1216
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\msedge.exe"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1000
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /delete /f /tn "msedge"
                3⤵
                  PID:3224
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3767.tmp.bat""
                  3⤵
                    PID:5040
                    • C:\Windows\system32\timeout.exe
                      timeout 3
                      4⤵
                      • Delays execution with timeout.exe
                      PID:4732
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4208
                • C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                  "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:4920
              • C:\Windows\system32\taskmgr.exe
                "C:\Windows\system32\taskmgr.exe" /4
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:736

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    Launcher.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Launcher.exe.log
                    • Size 1KB
                    • SHA256 192fbb7f4d1396fd4846854c5472a60aa80932f3c754f2c2f1a2a136c8a6bb4b
                    • MD5 SHA1 SHA512
                    Submit Download

                    msedge.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msedge.exe.log
                    • Size 654B
                    • SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
                    • MD5 SHA1 SHA512
                    Submit Download

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    • Size 2KB
                    • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 43dc153f22a8d306e0c130d1231bb60778c6f4e0bd20be875e79771c71392391
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 793434f4b09af5f4a51854beb619163aec5444c2aa203daf884e6d88ff4046f9
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 6ec1f525e465016931f20c2c622ecaa89af5601a605a15b04f760f17938a7afe
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 1ff2d02730e490230262e82169d667b1db011b405f53b3bb4345ed1ee3efc1d5
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 b2dd636b7b0d3bfe44cef5e1175828b1fa7bd84d5563f54342944156ba996c16
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 760d5623e712e53485c80330b3e2567577ffcf9397a94c3085bd1999f4650a40
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 1a6b86d72340011d4bb464c09cf11806b1b371bb70b3e287d3f569e15bcafd97
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 77f69011c214ea5a01fd2035d781914c4893aee66d784deadc22179eadfdf77f
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 e2fb83098e114084f51ed7187334f861ce670051046c39f338928296ca9a49cf
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 2bd89dd18ed5ccc85f446836227e12e84238ec1881e78f908469471c00f18ecd
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 57cd435c8b2bf10a2c77698301789c032e1b6b623ff1420c72e8bca0b10f1e5c
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 ad07460e061642c0dd4e7dfa7b821aacce873e290389e72f708e9f3504f9d135
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 c89240e395a581db1b44d204e2bcbd5b0e7f636ac72585d8257e6b901f5a3615
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 af18fc4864bc2982879aed928c960b6266f372c928f8c9632c5a4eecd64e448a
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 63d2688b92da4d1bb69980b7998b9be1595dd9e53951434a9414d019c4f825a7
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 944B
                    • SHA256 0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870
                    • MD5 SHA1 SHA512
                    Submit Download

                    Otupevi.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
                    • Size 121KB
                    • SHA256 cecbc104cfe47d1488d61b4e23b518476f194122539965c20309aa01067712b5
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    __PSScriptPolicyTest_jj2c1k5j.dfc.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jj2c1k5j.dfc.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512
                    Submit Download

                    msedge.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\msedge.exe
                    • Size 64KB
                    • SHA256 8a59d37451b5a84dc78c9bef33a183128e48e02367b0ffa786965b41ca1f2237
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    tmp3767.tmp.bat
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp3767.tmp.bat
                    • Size 158B
                    • SHA256 6d6aedb5ef5e3486de860e1453a93cc4745cc9f3f1dd87855cfb752efb045f50
                    • MD5 SHA1 SHA512
                    Submit Download

                    msedge.lnk
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk
                    • Size 775B
                    • SHA256 3d19633f390bdc81d4891e976e4459a8bf8fa5ec6b75dc700ef1bc12b9241d94
                    • MD5 SHA1 SHA512
                    Submit Download

                    memory/736-122-0x0000014678210000-0x0000014678211000-memory.dmp
                    Download

                    memory/736-125-0x0000014678210000-0x0000014678211000-memory.dmp
                    Download

                    memory/736-116-0x0000014678210000-0x0000014678211000-memory.dmp
                    Download

                    memory/736-115-0x0000014678210000-0x0000014678211000-memory.dmp
                    Download

                    memory/736-114-0x0000014678210000-0x0000014678211000-memory.dmp
                    Download

                    memory/736-121-0x0000014678210000-0x0000014678211000-memory.dmp
                    Download

                    memory/736-126-0x0000014678210000-0x0000014678211000-memory.dmp
                    Download

                    memory/736-124-0x0000014678210000-0x0000014678211000-memory.dmp
                    Download

                    memory/736-123-0x0000014678210000-0x0000014678211000-memory.dmp
                    Download

                    memory/736-120-0x0000014678210000-0x0000014678211000-memory.dmp
                    Download

                    memory/748-550-0x000001F632D60000-0x000001F632DA8000-memory.dmp
                    Download

                    memory/748-551-0x000001F632EF0000-0x000001F63310C000-memory.dmp
                    Download

                    memory/1052-596-0x000001D675830000-0x000001D675878000-memory.dmp
                    Download

                    memory/1052-597-0x000001D675D90000-0x000001D675FAC000-memory.dmp
                    Download

                    memory/1500-18-0x00007FFD531C0000-0x00007FFD53C81000-memory.dmp
                    Download

                    memory/1500-4-0x0000016067110000-0x0000016067132000-memory.dmp
                    Download

                    memory/1500-14-0x00007FFD531C0000-0x00007FFD53C81000-memory.dmp
                    Download

                    memory/1500-15-0x00007FFD531C0000-0x00007FFD53C81000-memory.dmp
                    Download

                    memory/1500-3-0x00007FFD531C0000-0x00007FFD53C81000-memory.dmp
                    Download

                    memory/1520-2-0x00007FFD531C0000-0x00007FFD53C81000-memory.dmp
                    Download

                    memory/1520-0-0x00007FFD531C3000-0x00007FFD531C5000-memory.dmp
                    Download

                    memory/1520-67-0x00007FFD531C0000-0x00007FFD53C81000-memory.dmp
                    Download

                    memory/1520-1-0x00000000004B0000-0x00000000004D4000-memory.dmp
                    Download

                    memory/2604-42-0x00000000002C0000-0x00000000002D6000-memory.dmp
                    Download

                    memory/4336-595-0x0000012C78410000-0x0000012C7862C000-memory.dmp
                    Download

                    memory/4336-594-0x0000012C783B0000-0x0000012C783F8000-memory.dmp
                    Download

                    memory/4528-572-0x00000247F9D60000-0x00000247F9DA8000-memory.dmp
                    Download

                    memory/4528-573-0x00000247F9DB0000-0x00000247F9FCC000-memory.dmp
                    Download

                    memory/4788-195-0x00000190204B0000-0x00000190206CC000-memory.dmp
                    Download

                    memory/4920-66-0x0000000000B10000-0x0000000000B34000-memory.dmp
                    Download

                    memory/5060-138-0x00000291C0A60000-0x00000291C0C7C000-memory.dmp
                    Download

                    memory/5116-241-0x0000026937C20000-0x0000026937E3C000-memory.dmp
                    Download

                    memory/5116-240-0x0000026937A80000-0x0000026937AC8000-memory.dmp
                    Download