95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788a

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
Size

353KB
MD5

a6a41a4f8302e72a074e8f688715b460
SHA1

02f31f2a7868de9670e3eab243e541fd99917cf7
SHA256

95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788a
SHA512

01b0d3db94c5e34efe86adc77a8daa1fff6db97bde2b1a2d72be768f347be672d383de25f4065ac0e7effe1ff929ddffaf182491612fcab17923f67880715cee
SSDEEP

6144:YeC4EwZFoobUk8qp0qpgogZfpjkNY8UKw:8fhuLwflk7Ub

Score

10^/10

evasion execution trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	wlctzkjk.bat
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	wlctzkjk.bat
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	wlctzkjk.bat
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Deletes itself 1 IoCs

pid	Process
1428	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1136	wlctzkjk.bat

Loads dropped DLL 1 IoCs

pid	Process
2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	wlctzkjk.bat

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org
9	api.ipify.org

Launches sc.exe 22 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2488	sc.exe
3016	sc.exe
1512	sc.exe
2140	sc.exe
2936	sc.exe
1928	sc.exe
1368	sc.exe
2500	sc.exe
2784	sc.exe
2744	sc.exe
2172	sc.exe
1104	sc.exe
1568	sc.exe
2608	sc.exe
2604	sc.exe
1028	sc.exe
2944	sc.exe
1160	sc.exe
2492	sc.exe
2580	sc.exe
2372	sc.exe
2132	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2004	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
3052	powershell.exe
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1496	powershell.exe
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat
1136	wlctzkjk.bat

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
Token: SeDebugPrivilege	1136	wlctzkjk.bat
Token: SeSecurityPrivilege	2420	wevtutil.exe
Token: SeBackupPrivilege	2420	wevtutil.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2488	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	31
PID 2360 wrote to memory of 2488	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	31
PID 2360 wrote to memory of 2488	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	31
PID 2360 wrote to memory of 2500	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	32
PID 2360 wrote to memory of 2500	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	32
PID 2360 wrote to memory of 2500	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	32
PID 2360 wrote to memory of 2676	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	35
PID 2360 wrote to memory of 2676	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	35
PID 2360 wrote to memory of 2676	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	35
PID 2360 wrote to memory of 2784	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	37
PID 2360 wrote to memory of 2784	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	37
PID 2360 wrote to memory of 2784	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	37
PID 2676 wrote to memory of 3016	2676	cmd.exe	39
PID 2676 wrote to memory of 3016	2676	cmd.exe	39
PID 2676 wrote to memory of 3016	2676	cmd.exe	39
PID 2360 wrote to memory of 2844	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	40
PID 2360 wrote to memory of 2844	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	40
PID 2360 wrote to memory of 2844	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	40
PID 2360 wrote to memory of 2580	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	42
PID 2360 wrote to memory of 2580	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	42
PID 2360 wrote to memory of 2580	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	42
PID 2844 wrote to memory of 2608	2844	cmd.exe	44
PID 2844 wrote to memory of 2608	2844	cmd.exe	44
PID 2844 wrote to memory of 2608	2844	cmd.exe	44
PID 2360 wrote to memory of 2916	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	45
PID 2360 wrote to memory of 2916	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	45
PID 2360 wrote to memory of 2916	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	45
PID 2360 wrote to memory of 2744	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	47
PID 2360 wrote to memory of 2744	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	47
PID 2360 wrote to memory of 2744	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	47
PID 2360 wrote to memory of 1932	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	49
PID 2360 wrote to memory of 1932	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	49
PID 2360 wrote to memory of 1932	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	49
PID 2916 wrote to memory of 2604	2916	cmd.exe	51
PID 2916 wrote to memory of 2604	2916	cmd.exe	51
PID 2916 wrote to memory of 2604	2916	cmd.exe	51
PID 1932 wrote to memory of 1512	1932	cmd.exe	52
PID 1932 wrote to memory of 1512	1932	cmd.exe	52
PID 1932 wrote to memory of 1512	1932	cmd.exe	52
PID 2360 wrote to memory of 2284	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	53
PID 2360 wrote to memory of 2284	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	53
PID 2360 wrote to memory of 2284	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	53
PID 2284 wrote to memory of 2140	2284	cmd.exe	55
PID 2284 wrote to memory of 2140	2284	cmd.exe	55
PID 2284 wrote to memory of 2140	2284	cmd.exe	55
PID 2360 wrote to memory of 1136	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	56
PID 2360 wrote to memory of 1136	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	56
PID 2360 wrote to memory of 1136	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	56
PID 2360 wrote to memory of 1428	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	57
PID 2360 wrote to memory of 1428	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	57
PID 2360 wrote to memory of 1428	2360	95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe	57
PID 1136 wrote to memory of 2372	1136	wlctzkjk.bat	59
PID 1136 wrote to memory of 2372	1136	wlctzkjk.bat	59
PID 1136 wrote to memory of 2372	1136	wlctzkjk.bat	59
PID 1136 wrote to memory of 1028	1136	wlctzkjk.bat	61
PID 1136 wrote to memory of 1028	1136	wlctzkjk.bat	61
PID 1136 wrote to memory of 1028	1136	wlctzkjk.bat	61
PID 1428 wrote to memory of 2672	1428	cmd.exe	63
PID 1428 wrote to memory of 2672	1428	cmd.exe	63
PID 1428 wrote to memory of 2672	1428	cmd.exe	63
PID 1428 wrote to memory of 1940	1428	cmd.exe	64
PID 1428 wrote to memory of 1940	1428	cmd.exe	64
PID 1428 wrote to memory of 1940	1428	cmd.exe	64
PID 1428 wrote to memory of 2004	1428	cmd.exe	65

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2672	attrib.exe
2384	attrib.exe
1652	attrib.exe

C:\Users\Admin\AppData\Local\Temp\95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe
"C:\Users\Admin\AppData\Local\Temp\95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wdfilter start=disabled
  2⤵
  - Launches sc.exe
  PID:2488
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WerSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:2500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\sc.exe
    sc stop wdfilter
    3⤵
    - Launches sc.exe
    PID:3016
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start=disabled
  2⤵
  - Launches sc.exe
  PID:2784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WerSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\system32\sc.exe
    sc stop WerSvc
    3⤵
    - Launches sc.exe
    PID:2608
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WdNisSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:2580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\sc.exe
    sc stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:2604
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config XblGameSave start=disabled
  2⤵
  - Launches sc.exe
  PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:1512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop XblGameSave
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\system32\sc.exe
    sc stop XblGameSave
    3⤵
    - Launches sc.exe
    PID:2140
- C:\Users\Admin\AppData\Local\Temp\wlctzkjk.bat
  "C:\Users\Admin\AppData\Local\Temp\wlctzkjk.bat" ok
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WerSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:2372
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config wdfilter start=disabled
    3⤵
    - Launches sc.exe
    PID:1028
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
    3⤵
    PID:2756
  - - C:\Windows\system32\sc.exe
      sc stop wdfilter
      4⤵
      Launches sc.exe
      PID:2944
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:2936
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WerSvc
    3⤵
    PID:2412
  - - C:\Windows\system32\sc.exe
      sc stop WerSvc
      4⤵
      Launches sc.exe
      PID:2132
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WdNisSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:2172
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
    3⤵
    PID:2028
  - - C:\Windows\system32\sc.exe
      sc stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:1928
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config XblGameSave start=disabled
    3⤵
    - Launches sc.exe
    PID:1104
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
    3⤵
    PID:2976
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:1368
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop XblGameSave
    3⤵
    PID:1604
  - - C:\Windows\system32\sc.exe
      sc stop XblGameSave
      4⤵
      Launches sc.exe
      PID:1568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-NetQosPolicy -Name "XXXXX" -AppPathNameMatchCondition "C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe" -ThrottleRateActionBitsPerSecond 8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-NetQosPolicy -Name "YYYYY" -AppPathNameMatchCondition "C:\Program Files (x86)\Common Files\BattlEye\BEService.exe" -ThrottleRateActionBitsPerSecond 8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
    3⤵
    PID:1560
  - - C:\Windows\system32\sc.exe
      sc stop wdfilter
      4⤵
      Launches sc.exe
      PID:1160
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop faceit
    3⤵
    PID:1588
  - - C:\Windows\system32\sc.exe
      sc stop faceit
      4⤵
      Launches sc.exe
      PID:2492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f2ea0835-f474-405d-acaa-6c9d77e7e940.bat"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe"
    3⤵
    - Views/modifies file attributes
    PID:2672
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "HiberbootEnabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:1940
- - C:\Windows\system32\timeout.exe
    timeout /T 1
    3⤵
    - Delays execution with timeout.exe
    PID:2004
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\95f0dd8e57251dae192a6297c5ceabaec88735962954084c2f68e58e0a4b788aN.exe"
    3⤵
    - Views/modifies file attributes
    PID:2384
- - C:\Windows\system32\wevtutil.exe
    wevtutil el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\f2ea0835-f474-405d-acaa-6c9d77e7e940.bat"
    3⤵
    - Views/modifies file attributes
    PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f2ea0835-f474-405d-acaa-6c9d77e7e940.bat

Filesize
780B

MD5
dcb591d59be814d62b266f6b51f8a6de

SHA1
df9d860da8612d70267ce6a1082a1dacec2ce9ab

SHA256
fe586650955c564b0ec089422ff64bab3075460c1f7a15b6a6f9d92dfd0ff59b

SHA512
d8c9ea1f427fc7d8e5721b415dc4a43d35e9a9d9a045a4f24c09d9b83e130aa2f1f13d10492c41edb22b26af15623b4ad42fbe2af7cb8ea2fda8555375f373d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5ea87f7762f76397478150a5a946e22c

SHA1
a80f34345fc8fd8334b4d14b0fb55c7ab3085900

SHA256
7a5fa164703f0acef280e56d2ae48ffc79d453673628088dce82ae9c6c6b70eb

SHA512
5fd696d4a16196aea5270dffd8137745131ac6454be1722fb73eddf1af63be586d0d648dde41066afaaaa3362930434fd04c21d41f48eb10d87212db57803fa5

Download Submit
C:\Users\Admin\AppData\Roaming\spf\unknown.log

Filesize
190B

MD5
fc35dcc5c3f75cd55b9f6964c99ae722

SHA1
e5c5c7e70c4e67c919c66a7d0d0d8abf1c21e41a

SHA256
d25a4abbae08de49d80992dec16f50d97098293acc0567aa7ca62a1cc17b71f7

SHA512
87221dce1bdb909212505462eeb0ce5d3cac30443a9eb06b5420913ae2a71795b1edec1e2eb53e1fb7084474ca36a36ebc9732f2b14c2c87effe7f23abe6d027

Download Submit
\Users\Admin\AppData\Local\Temp\wlctzkjk.bat

Filesize
354KB

MD5
3c1b91544d041ed49a8f99fcb07953b8

SHA1
aff46cce0993e38d6c75ba23db47325d8989d6c3

SHA256
a0f3e0b8ced95b558c555f091e534b3ba86e65e6636ee80f78bc39972dc17a08

SHA512
f5d8c7b54654e9cfeee299d769b1201e8e6357e5d2e22aac4549c6b223cf7a2c1cae146324da69d3d365c23b74be397dbea832415a44ca14d4efd8be78d76cb5

Download Submit
memory/1136-10-0x000000013E5C0000-0x000000013E5FE000-memory.dmp

Filesize
248KB

Download
memory/1496-36-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/1496-35-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2360-18-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2360-0-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Filesize
4KB

Download
memory/2360-2-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2360-1-0x000000013EB50000-0x000000013EB8E000-memory.dmp

Filesize
248KB

Download
memory/3052-28-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

Filesize
2.9MB

Download
memory/3052-29-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download