dcrat | ea10faa651fc412d0ec1b6417d4ab1949f5ace92373d87dd789d8b0556ffb810

Analysis

max time kernel
71s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EAE6D4D5EAE0CF85FF69EB89946E4185.exe
Size

885KB
MD5

eae6d4d5eae0cf85ff69eb89946e4185
SHA1

9107578b01297b583bf797575bea0d745d024260
SHA256

ea10faa651fc412d0ec1b6417d4ab1949f5ace92373d87dd789d8b0556ffb810
SHA512

14fbb35dc316eef0d11204280b8e152d54905f72e43f2f98d92cfca559f3d09dd7d849ea01ce1c57ab94d356b26d6146e6714a51d1f72af9d4d94fc0adba533f
SSDEEP

24576:9WUovLOqIJk8IjNJ/+z4F3osuiKoqsyol54bWYUK:9LoDP8IxF3osxKoqUK

Score

10^/10

dcrat credential_access defense_evasion discovery infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	720	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	3084	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	3084	schtasks.exe	95

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0002000000022af2-17.dat	dcrat
behavioral2/files/0x0008000000023cbe-38.dat	dcrat
behavioral2/memory/1432-40-0x0000000000BD0000-0x0000000000CA6000-memory.dmp	dcrat

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\en-US\USBHUB3.SYS.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\usbdr.dll	explorer.exe
File opened for modification	C:\Windows\System32\drivers\fsdepends.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\hwpolicy.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\ksthunk.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\en-US\luafv.sys.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\werkernel.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\dam.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\usbhub.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\usbuhci.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\vmgid.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\vmbus.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mslldp.sys.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\en-US\qwavedrv.sys.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\IndirectKmd.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\isapnp.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\mshwnclx.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\rootmdm.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\modem.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\mrxsmb.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\vwififlt.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\ataport.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\mpsdrv.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\terminpt.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\tpm.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\msgpioclx.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\USBHUB3.SYS	explorer.exe
File opened for modification	C:\Windows\System32\drivers\rhproxy.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\UevAgentDriver.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\exfat.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\fvevol.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\en-US\acpi.sys.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\en-US\scmbus.sys.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\rdyboost.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\sdstor.sys	explorer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gm.dls	explorer.exe
File opened for modification	C:\Windows\System32\drivers\msrpc.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\en-US\vmbus.sys.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\CmBatt.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\pciide.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\rasl2tp.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\en-US\PktMon.sys.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\rasacd.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\ws2ifsl.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\en-US\netvsc.sys.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\mcd.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\nwifi.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\rmcast.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\wacompen.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\volmgr.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\watchdog.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\SensorsCx.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\cldflt.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\ipfltdrv.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\mrxsmb20.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\UcmUcsiAcpiClient.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\rteth.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\vmbkmcl.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\en-US\scsiport.sys.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\en-US\sermouse.sys.mui	explorer.exe
File opened for modification	C:\Windows\System32\drivers\acpipmi.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\iagpio.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\Microsoft.Bluetooth.AvrcpTransport.sys	explorer.exe
File opened for modification	C:\Windows\System32\drivers\pciidex.sys	explorer.exe

Manipulates Digital Signatures 4 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\wintrust.dll	explorer.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	explorer.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File opened for modification	C:\Windows\System32\spool\prtprocs\x64\winprint.dll	explorer.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	EAE6D4D5EAE0CF85FF69EB89946E4185.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	kendalcp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	reviewDll.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
3116	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
3196	Bootstrapper.exe
3096	kendalcp.exe
1432	reviewDll.exe
3116	explorer.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBClient%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Audit.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Restricted.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\HardwareEvents.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Security.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Security.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Internet Explorer.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Key Management Service.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx	explorer.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx	explorer.exe

Loads dropped DLL 11 IoCs

pid	Process
4924	MsiExec.exe
4924	MsiExec.exe
3908	MsiExec.exe
3908	MsiExec.exe
3908	MsiExec.exe
3908	MsiExec.exe
3908	MsiExec.exe
4148	MsiExec.exe
4148	MsiExec.exe
4148	MsiExec.exe
4924	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 2 IoCs

flow	pid	Process
34	1052	msiexec.exe
36	1052	msiexec.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.1_none_5476a60692fad199\desktop.ini	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.423_none_7c917c97525f1487\desktop.ini	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.19041.1_none_2108f0881e5a7a03\desktop.ini	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.19041.1_none_4b0e6b545bf0f4e7\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	explorer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Windows.Media.MixedRealityCapture.dll	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_bxt_p.inf_amd64_8be317e01b44bf5a\iaLPSS2i_GPIO2_BXT_P.inf	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\hidspi_km.inf_loc	explorer.exe
File opened for modification	C:\Windows\System32\en-US\p2pnetsh.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\en-US\sdiageng.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\fr-FR\arp.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\fr-FR\SystemPropertiesPerformance.exe.mui	explorer.exe
File opened for modification	C:\Windows\SysWOW64\clb.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetQos\MSFT_NetQosPolicy.cdxml	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\netrasa.inf_loc	explorer.exe
File opened for modification	C:\Windows\SysWOW64\en-US\VAN.dll.mui	explorer.exe
File opened for modification	C:\Windows\SysWOW64\wbem\iscsirem.mof	explorer.exe
File opened for modification	C:\Windows\System32\wbem\netttcim.mof	explorer.exe
File opened for modification	C:\Windows\SysWOW64\el-GR\windows.ui.xaml.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\fr-FR\spectrum.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\ndiscap.inf_loc	explorer.exe
File opened for modification	C:\Windows\System32\es-ES\Locator.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\fr-FR\utildll.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\ja-jp\mprddm.dll.mui	explorer.exe
File opened for modification	C:\Windows\SysWOW64\ieui.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-9-ul-store-rtm.xrm-ms	explorer.exe
File opened for modification	C:\Windows\System32\Windows.Devices.SerialCommunication.dll	explorer.exe
File opened for modification	C:\Windows\System32\es-ES\msg.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\uk-UA\usbmon.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\uk-UA\MSFT_WaitForAll.schema.mfl	explorer.exe
File opened for modification	C:\Windows\System32\KBDLVST.DLL	explorer.exe
File opened for modification	C:\Windows\System32\de-DE\AxInstUI.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbohci.sys	explorer.exe
File opened for modification	C:\Windows\System32\es-ES\Narrator.exe.mui	explorer.exe
File opened for modification	C:\Windows\SysWOW64\rshx32.dll	explorer.exe
File opened for modification	C:\Windows\System32\cs-CZ\WWAHost.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\da-DK\windows.ui.xaml.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\ykinx64.inf_loc	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\SensorsHidClassDriver.inf_loc	explorer.exe
File opened for modification	C:\Windows\System32\ja-jp\driverquery.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\es\Microsoft.AppV.AppvClientComConsumer.resources.dll	explorer.exe
File opened for modification	C:\Windows\System32\de-DE\AuthHost.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\de-DE\mrinfo.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\de-DE\WMVDECOD.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\b57nd60a.sys	explorer.exe
File opened for modification	C:\Windows\System32\es-ES\AuthBrokerUI.dll.mui	explorer.exe
File opened for modification	C:\Windows\SysWOW64\en-US\themeui.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\de-DE\hcproviders.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\uk-UA\iertutil.dll.mui	explorer.exe
File opened for modification	C:\Windows\SysWOW64\dpapi.dll	explorer.exe
File opened for modification	C:\Windows\System32\migwiz\dlmanifests\Web-Services-for-Management-Core-DL.man	explorer.exe
File opened for modification	C:\Windows\SysWOW64\TokenBrokerUI.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\rasplap.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\accessibilitycpl.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\KBDOLDIT.DLL	explorer.exe
File opened for modification	C:\Windows\SysWOW64\srdelayed.exe	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\microsoft_bluetooth_hfp_ag.inf_loc	explorer.exe
File opened for modification	C:\Windows\System32\it-IT\drt.dll.mui	explorer.exe
File opened for modification	C:\Windows\System32\WinMetadata\Windows.Services.winmd	explorer.exe
File opened for modification	C:\Windows\System32\F12\F12Platform.dll	explorer.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	explorer.exe
File opened for modification	C:\Windows\System32\SyncHost.exe	explorer.exe
File opened for modification	C:\Windows\System32\WinBioDataModelOOBE.exe	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\wvid.inf_loc	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\itSAS35i.inf_loc	explorer.exe
File opened for modification	C:\Windows\System32\en-US\setspn.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\es-ES\FileHistory.exe.mui	explorer.exe
File opened for modification	C:\Windows\SysWOW64\uk-UA\mshta.exe.mui	explorer.exe
File opened for modification	C:\Windows\System32\es-ES\hnetcfg.dll.mui	explorer.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	explorer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-black_scale-125.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-40.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-256_contrast-white.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\Views\SlowMotionPage.xbf	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-fullcolor.png	explorer.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\.github\ISSUE_TEMPLATE.md	msiexec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_contrast-black.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogo.png	explorer.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Test-Assertion.ps1	explorer.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\lib\cp\polyfill.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\inventory.js	msiexec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_TeethSmile.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_2.m4a	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	explorer.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\npm-usage.js	msiexec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-150.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\GLTFTextTemplate.json	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-300.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\SmallTile.scale-200.png	explorer.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll	explorer.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\smart-buffer\build\utils.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\root.js	msiexec.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\jsaddins\onenote_strings.js	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsymb.ttf	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png	explorer.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\node_modules\minipass\index.d.ts	msiexec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-white_scale-100.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\MedTile.scale-100.png	explorer.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\diff\css.js	msiexec.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll	explorer.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-48_altform-unplated.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\WideTile.scale-200.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\xbox_live_logo_black.png	explorer.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\lib\cp\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\identity\issuer.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\package.json	msiexec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-150.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\RunningLate.scale-64.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailSmallTile.scale-200.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-125.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-100.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Windows.dll	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-100.png	explorer.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\safer-buffer\safer.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\passthrough.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\pnpm.cmd	msiexec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sl-SI\View3d\3DViewerProductDescription-universal.xml	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MixedRealityPortalSplashScreen.scale-100.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-unplated_contrast-white.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailBadge.scale-125.png	explorer.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\parse-conflict-json\LICENSE.md	msiexec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-200.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\SuggestionsService\PushpinDark.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\WideTile.scale-200.png	explorer.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-white_scale-125.png	explorer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\Assets\SplashScreen.Theme-Dark_Scale-140.png	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_c_netdriver.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_085b9cabf7af4ff2\c_netdriver.inf_loc	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-healthcentercpl_31bf3856ad364e35_10.0.19041.1_none_0695fb573d001907\ActionCenterCPL.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_bg-bg_36e6bc5fe8ecffc2\r\msimsg.dll.mui	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-7.htm	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.1_none_5c015a65c60d8097\hnsdiag.exe	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\500.htm	explorer.exe
File opened for modification	C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\DropAccept.scale-300.png	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_c_camera.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_f4eefb5dcf0fc0a7\c_camera.inf_loc	explorer.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Wide310x150Logo.contrast-black_scale-400.png	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_c_fscopyprotection.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_ea3e1325cb8505a4\c_fscopyprotection.inf_loc	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_ds-ui-ext_31bf3856ad364e35_10.0.19041.1_none_263e39219ef22dc4\dsuiext.dll.mun	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-b..nvironment-dvd-pcat_31bf3856ad364e35_10.0.19041.1_none_5008dee6cfdc303c\BCD	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\require.js	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-com-ole.resources_31bf3856ad364e35_10.0.19041.1_de-de_f156cdb5d3773d29\ole32.dll.mui	explorer.exe
File opened for modification	C:\Windows\diagnostics\system\Printer\en-US\DiagPackage.dll.mui	explorer.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\aspnet_compiler.resources.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_hyperv-computelib-legacy_31bf3856ad364e35_10.0.19041.1266_none_2764be90dfc8b6df\f\vmcompute.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\ApplySettingsTemplateCatalog.exe	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..rs-serverdefinition_31bf3856ad364e35_10.0.19041.1_none_c8f405ac645f3d8e\devices.Windows.Server.def	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..henticationbinaries_31bf3856ad364e35_10.0.19041.1_none_f5f4f51cfb3d0189\authanon.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-2.htm	explorer.exe
File opened for modification	C:\Windows\Fonts\himalaya.ttf	explorer.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe	explorer.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Basic-Http-Minio-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	explorer.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_aspnet_regsql.resources_b03f5f7f11d50a3a_4.0.15805.0_it-it_a58f4b1f4481ef65\aspnet_regsql.resources.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-windowmanagement_31bf3856ad364e35_10.0.19041.746_none_312012852f12d5c0\r\WindowManagement.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..vercommon.resources_31bf3856ad364e35_10.0.19041.1_it-it_15c534855db1e1fc\appobj.dll.mui	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-msidntld.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_cb245a7088e61c4b\msidntld.dll.mui	explorer.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobenetworklossaversion-vm.js	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fsrm-common_31bf3856ad364e35_10.0.19041.746_none_a7a7f673bf9f2fad\f\srmclient.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.19041.1_none_7d55e8342077d456\api-ms-win-core-errorhandling-l1-1-1.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..ntmanifests-termsrv_31bf3856ad364e35_10.0.19041.746_none_031c667dd05cd716\TerminalServices-Publishing-WMIProvider-Replacement.man	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..wnlevelmanifests-ds_31bf3856ad364e35_10.0.19041.1_none_50a9b8ad060bef80\SmartCardSubsystem-DL.man	explorer.exe
File opened for modification	C:\Windows\diagnostics\scheduled\Maintenance\en-US\CL_LocalizationData.psd1	explorer.exe
File opened for modification	C:\Windows\diagnostics\system\Apps\fr-FR\DiagPackage.dll.mui	explorer.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\proxyerror.htm	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_bth.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b0ff91f70c0d67af\bthenum.sys.mui	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-c..ehost-api.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_728daa9bafcda253\CloudExperienceHostCommon.dll.mui	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..assistant.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfc0bcd305c2bfaa\pcaevts.dll.mui	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..owershell.resources_31bf3856ad364e35_10.0.19041.1_es-es_ec5e747915e7182b\Microsoft.Dism.Powershell.Resources.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-g..-brightnessoverride_31bf3856ad364e35_10.0.19041.746_none_6efacde02c8ff6d7\Windows.Graphics.Display.BrightnessOverride.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_87b019d7cebd66d4\f\rscaext.dll	explorer.exe
File opened for modification	C:\Windows\Speech\Engines\SR\en-US\l1033.cw	explorer.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-48.png	explorer.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeautopilotactivation-vm.js	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_c_scmdisk.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_da2f3464feeb9e82\c_scmdisk.inf_loc	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars36.contrast-black_scale-200.png	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ducupdateagent_31bf3856ad364e35_10.0.19041.1202_none_2b43873f30b2bed1\DucUpdateAgent.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_11.0.19041.1266_none_002191d26b2a1e55\f\msIso.dll	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1_none_faedbaa2bd7d01c2\MDMAgent.exe	explorer.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\SR\es-ES-N\l3082.cw	explorer.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\wide310x150logo.scale-100_contrast-black.png	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Square44x44Logo.targetsize-20.png	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..cache-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a5045b725b203a07\DiskNVCache.adml	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-e..ntication.resources_31bf3856ad364e35_10.0.19041.1_en-us_095a64c41a014141\EhStorAuthn.exe.mui	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000402_31bf3856ad364e35_10.0.19041.1_none_9da4b8fd034c448c\KBDBU.DLL	explorer.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\it\System.Runtime.Remoting.Resources.dll	explorer.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Web.Entity.Design.resources.dll	explorer.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\Microsoft.Data.Entity.Build.Tasks.resources.dll	explorer.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\CipherSuiteOrder.adml	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-dataclen.resources_31bf3856ad364e35_10.0.19041.1_de-de_ca47f5aecd8895ab\dataclen.dll.mui	explorer.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fax-service.resources_31bf3856ad364e35_10.0.19041.1_de-de_e7ec241ca624202c\FXSEVENT.dll.mui	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kendalcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4472	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	kendalcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3172	schtasks.exe
432	schtasks.exe
2848	schtasks.exe
4500	schtasks.exe
2528	schtasks.exe
3204	schtasks.exe
2004	schtasks.exe
2016	schtasks.exe
2712	schtasks.exe
1428	schtasks.exe
1608	schtasks.exe
1952	schtasks.exe
996	schtasks.exe
4320	schtasks.exe
3112	schtasks.exe
3420	schtasks.exe
2756	schtasks.exe
3616	schtasks.exe
1656	schtasks.exe
5112	schtasks.exe
3152	schtasks.exe
3244	schtasks.exe
5004	schtasks.exe
3460	schtasks.exe
1936	schtasks.exe
4836	schtasks.exe
4932	schtasks.exe
4332	schtasks.exe
2064	schtasks.exe
3096	schtasks.exe
2952	schtasks.exe
2120	schtasks.exe
1396	schtasks.exe
1992	schtasks.exe
1664	schtasks.exe
2748	schtasks.exe
4992	schtasks.exe
452	schtasks.exe
4912	schtasks.exe
1308	schtasks.exe
3364	schtasks.exe
2728	schtasks.exe
4036	schtasks.exe
5056	schtasks.exe
4432	schtasks.exe
720	schtasks.exe
2404	schtasks.exe
4044	schtasks.exe
4668	schtasks.exe
4032	schtasks.exe
2556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3196	Bootstrapper.exe
3196	Bootstrapper.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
1432	reviewDll.exe
3116	explorer.exe
1052	msiexec.exe
1052	msiexec.exe
3116	explorer.exe
3116	explorer.exe
3116	explorer.exe
3116	explorer.exe
3116	explorer.exe
3116	explorer.exe
3116	explorer.exe
3116	explorer.exe
3116	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5068	WMIC.exe
Token: SeSecurityPrivilege	5068	WMIC.exe
Token: SeTakeOwnershipPrivilege	5068	WMIC.exe
Token: SeLoadDriverPrivilege	5068	WMIC.exe
Token: SeSystemProfilePrivilege	5068	WMIC.exe
Token: SeSystemtimePrivilege	5068	WMIC.exe
Token: SeProfSingleProcessPrivilege	5068	WMIC.exe
Token: SeIncBasePriorityPrivilege	5068	WMIC.exe
Token: SeCreatePagefilePrivilege	5068	WMIC.exe
Token: SeBackupPrivilege	5068	WMIC.exe
Token: SeRestorePrivilege	5068	WMIC.exe
Token: SeShutdownPrivilege	5068	WMIC.exe
Token: SeDebugPrivilege	5068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5068	WMIC.exe
Token: SeRemoteShutdownPrivilege	5068	WMIC.exe
Token: SeUndockPrivilege	5068	WMIC.exe
Token: SeManageVolumePrivilege	5068	WMIC.exe
Token: 33	5068	WMIC.exe
Token: 34	5068	WMIC.exe
Token: 35	5068	WMIC.exe
Token: 36	5068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5068	WMIC.exe
Token: SeSecurityPrivilege	5068	WMIC.exe
Token: SeTakeOwnershipPrivilege	5068	WMIC.exe
Token: SeLoadDriverPrivilege	5068	WMIC.exe
Token: SeSystemProfilePrivilege	5068	WMIC.exe
Token: SeSystemtimePrivilege	5068	WMIC.exe
Token: SeProfSingleProcessPrivilege	5068	WMIC.exe
Token: SeIncBasePriorityPrivilege	5068	WMIC.exe
Token: SeCreatePagefilePrivilege	5068	WMIC.exe
Token: SeBackupPrivilege	5068	WMIC.exe
Token: SeRestorePrivilege	5068	WMIC.exe
Token: SeShutdownPrivilege	5068	WMIC.exe
Token: SeDebugPrivilege	5068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5068	WMIC.exe
Token: SeRemoteShutdownPrivilege	5068	WMIC.exe
Token: SeUndockPrivilege	5068	WMIC.exe
Token: SeManageVolumePrivilege	5068	WMIC.exe
Token: 33	5068	WMIC.exe
Token: 34	5068	WMIC.exe
Token: 35	5068	WMIC.exe
Token: 36	5068	WMIC.exe
Token: SeDebugPrivilege	3196	Bootstrapper.exe
Token: SeDebugPrivilege	1432	reviewDll.exe
Token: SeDebugPrivilege	3116	explorer.exe
Token: SeShutdownPrivilege	2712	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2712	msiexec.exe
Token: SeSecurityPrivilege	1052	msiexec.exe
Token: SeCreateTokenPrivilege	2712	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2712	msiexec.exe
Token: SeLockMemoryPrivilege	2712	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2712	msiexec.exe
Token: SeMachineAccountPrivilege	2712	msiexec.exe
Token: SeTcbPrivilege	2712	msiexec.exe
Token: SeSecurityPrivilege	2712	msiexec.exe
Token: SeTakeOwnershipPrivilege	2712	msiexec.exe
Token: SeLoadDriverPrivilege	2712	msiexec.exe
Token: SeSystemProfilePrivilege	2712	msiexec.exe
Token: SeSystemtimePrivilege	2712	msiexec.exe
Token: SeProfSingleProcessPrivilege	2712	msiexec.exe
Token: SeIncBasePriorityPrivilege	2712	msiexec.exe
Token: SeCreatePagefilePrivilege	2712	msiexec.exe
Token: SeCreatePermanentPrivilege	2712	msiexec.exe
Token: SeBackupPrivilege	2712	msiexec.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3196	4432	EAE6D4D5EAE0CF85FF69EB89946E4185.exe	88
PID 4432 wrote to memory of 3196	4432	EAE6D4D5EAE0CF85FF69EB89946E4185.exe	88
PID 4432 wrote to memory of 3096	4432	EAE6D4D5EAE0CF85FF69EB89946E4185.exe	90
PID 4432 wrote to memory of 3096	4432	EAE6D4D5EAE0CF85FF69EB89946E4185.exe	90
PID 4432 wrote to memory of 3096	4432	EAE6D4D5EAE0CF85FF69EB89946E4185.exe	90
PID 3196 wrote to memory of 3008	3196	Bootstrapper.exe	91
PID 3196 wrote to memory of 3008	3196	Bootstrapper.exe	91
PID 3008 wrote to memory of 4472	3008	cmd.exe	93
PID 3008 wrote to memory of 4472	3008	cmd.exe	93
PID 3096 wrote to memory of 4736	3096	kendalcp.exe	96
PID 3096 wrote to memory of 4736	3096	kendalcp.exe	96
PID 3096 wrote to memory of 4736	3096	kendalcp.exe	96
PID 3196 wrote to memory of 3112	3196	Bootstrapper.exe	98
PID 3196 wrote to memory of 3112	3196	Bootstrapper.exe	98
PID 3112 wrote to memory of 5068	3112	cmd.exe	100
PID 3112 wrote to memory of 5068	3112	cmd.exe	100
PID 4736 wrote to memory of 2596	4736	WScript.exe	103
PID 4736 wrote to memory of 2596	4736	WScript.exe	103
PID 4736 wrote to memory of 2596	4736	WScript.exe	103
PID 2596 wrote to memory of 1432	2596	cmd.exe	105
PID 2596 wrote to memory of 1432	2596	cmd.exe	105
PID 1432 wrote to memory of 3116	1432	reviewDll.exe	157
PID 1432 wrote to memory of 3116	1432	reviewDll.exe	157
PID 3196 wrote to memory of 2712	3196	Bootstrapper.exe	158
PID 3196 wrote to memory of 2712	3196	Bootstrapper.exe	158
PID 1052 wrote to memory of 4924	1052	msiexec.exe	161
PID 1052 wrote to memory of 4924	1052	msiexec.exe	161
PID 1052 wrote to memory of 3908	1052	msiexec.exe	162
PID 1052 wrote to memory of 3908	1052	msiexec.exe	162
PID 1052 wrote to memory of 3908	1052	msiexec.exe	162
PID 1052 wrote to memory of 4148	1052	msiexec.exe	166
PID 1052 wrote to memory of 4148	1052	msiexec.exe	166
PID 1052 wrote to memory of 4148	1052	msiexec.exe	166
PID 4148 wrote to memory of 1688	4148	MsiExec.exe	167
PID 4148 wrote to memory of 1688	4148	MsiExec.exe	167
PID 4148 wrote to memory of 1688	4148	MsiExec.exe	167
PID 1688 wrote to memory of 2876	1688	wevtutil.exe	169
PID 1688 wrote to memory of 2876	1688	wevtutil.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\EAE6D4D5EAE0CF85FF69EB89946E4185.exe
"C:\Users\Admin\AppData\Local\Temp\EAE6D4D5EAE0CF85FF69EB89946E4185.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c ipconfig /all
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4472
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5068
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- C:\Users\Admin\AppData\Local\Temp\kendalcp.exe
  "C:\Users\Admin\AppData\Local\Temp\kendalcp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\blocksavesperfMonitorDll\reviewDll.exe
        
        "C:\blocksavesperfMonitorDll\reviewDll.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1432
      - C:\Users\Default\Links\explorer.exe
        
        "C:\Users\Default\Links\explorer.exe"
        6⤵
        Drops file in Drivers directory
        Manipulates Digital Signatures
        Boot or Logon Autostart Execution: Print Processors
        Deletes itself
        Executes dropped EXE
        Indicator Removal: Clear Windows Event Logs
        Drops desktop.ini file(s)
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies termsrv.dll
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemResources\Windows.UI.BlockedShutdown\pris\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.BlockedShutdown\pris\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemResources\Windows.UI.BlockedShutdown\pris\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\blocksavesperfMonitorDll\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\blocksavesperfMonitorDll\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\blocksavesperfMonitorDll\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\Sun\Java\Deployment\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Sun\Java\Deployment\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Sun\Java\Deployment\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\WTR\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Videos\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Videos\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Videos\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\de-DE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\blocksavesperfMonitorDll\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\blocksavesperfMonitorDll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\blocksavesperfMonitorDll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\ImmersiveControlPanel\pris\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\pris\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\ImmersiveControlPanel\pris\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre-1.8\bin\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\bin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jre-1.8\bin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Links\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\Links\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Links\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\PolicyDefinitions\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\PolicyDefinitions\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\blocksavesperfMonitorDll\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\blocksavesperfMonitorDll\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\blocksavesperfMonitorDll\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\blocksavesperfMonitorDll\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\blocksavesperfMonitorDll\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\blocksavesperfMonitorDll\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5DDADC252FCE27350C05F280CA58B5BE
  2⤵
  - Loads dropped DLL
  PID:4924
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 89D57CFE7D730A232DB677F0686E1C6E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DD85D4980AFA27D3E199D03BF4D4AE7D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58150d.rbs

Filesize
82KB

MD5
384e9c894b2a793b200d15b1d624039b

SHA1
80675951e03c89c547d55c32cfec8eb5f101dbac

SHA256
2e61ec8d98faf03bd56f37d6b1bf30b1c92de43ef8d3eb39eeca8f9892bada9e

SHA512
6c71c4b8d849f4e5b579151a1eee9da3f13e73faddf930ee8740ec59091aa287ed647b83f7a313eaa7984c8193ace4abce42aaf9e9ef55a19c00d3825dcbba66

Download Submit
C:\Program Files (x86)\Windows Media Player\en-US\088424020bedd6

Filesize
201B

MD5
f396e6ddcf7b02ed1a2710f677f9f73e

SHA1
58e69724c4b90f6d1d3e16162d4d55b90de9b290

SHA256
c3f476914eee2e5f7062a337b2213e3f4834e9f6afb380f1acf87bc70a543f01

SHA512
a7fec32b964b1bec8d8b4f0f9e24ea06b49f93e530678412045b275aac3b9eadaa57b0cfa3659d06cfcd5cf7216388d913898019719faedc2efce8f9abcae2f2

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\ee2ad38f3d4382

Filesize
81B

MD5
a297eb0f4456fb50e0ab63dc04dbb654

SHA1
2d66a624293d8896cf5130edfe8572d7dae68992

SHA256
c0adbd70b42afdbf751379d9e97934e46899d7fb2cd487abed5eeeeb04d08759

SHA512
b9ea7adcf6cdaff3165f4dc89750a262a21b50bf43ee069d8bd11351d09b75fbfc55a707a2420075cc79ea65f3c1d733b278962c9a4a2e7a9322725f98c7be01

Download Submit
C:\Program Files\Internet Explorer\de-DE\f3b6ecef712a24

Filesize
766B

MD5
96b8d080b7cdac00969d4580634cd4b3

SHA1
21c5d547a8a340a52c1b829a7e601f1769399c59

SHA256
2f59288cd1cb1d6af2d92caee6dde4e3ec83754341dc4533f07b25ee928fd9d7

SHA512
dfb95994c1dc1ae06db4790d919bb4d92708c4617b735bdd72442e6caefaea79ceb2d500447c12c31fa6ba386890d01bfb2b4c9677baa058bcd0bbfc6ca44433

Download Submit
C:\Program Files\Java\jre-1.8\bin\7a0fd90576e088

Filesize
213B

MD5
7fa4a07a1cce336637b5e98b0c75e45c

SHA1
5804b7d6cf0c2882cd7e15e90677f263ad46edef

SHA256
630a240d7cbd382d51a0848fd4271f9e57bd1c3709a692b9f2593777ab835f3d

SHA512
a55224d1a99cb97391c635f26731921eab8a2d17ab05927544841e0626b5928c282fbb8b39a62c4d145829188201631cdad94d88cbd27eca2a99acdc7a2d7bad

Download Submit
C:\Program Files\Windows Defender\7a0fd90576e088

Filesize
931B

MD5
714ac8566b5d044e685b8548f777009d

SHA1
18ba8c72a12c44c50ac9eaa48a359d4e5ac88f75

SHA256
00223027af643703d7693266fe8994f7cf91649e22005b81700f40c0162906db

SHA512
a9340b5f77b3d76cf8f7d9a3f7a68e2a87a4d095fadc348e024f70eae577ff76be130f8215bbae2bacf6d1b4474d34feb521d518ba31e31c099f49fee624122c

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
1d4e2f593da41b19ae484c0762afca2d

SHA1
946fe9a3d11d0f310eb1df3ae1fed6d28a30bb35

SHA256
5b523803c93eaf19e150cea4f0c8ca7787d5f76d52ac69d178d33fd4bb851a16

SHA512
797c22809530ef0248e09e972724fcbb214585d87fda5c3db191aed9956982d20f44bb1041221c65298ab1ef2e0a25cf7bc6e02d87fb051c2e6d68c5c437a544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_CEA48AEE703922244E2530F7A011BBC6

Filesize
471B

MD5
f5b964e8e9055d5a2f99d7a657759c54

SHA1
bd097b51b19dd069400ecd4faa0642e2d1ba0d98

SHA256
5e9e64e654d48097830e1bbe33b8a7110ffab469a415c7ee1d51ab2b83c35344

SHA512
2370c45910b3d518c5440fbb14851a896cd1562684e8666d873ac2369429bac89f3734a97db59f746376a269ff2b30c9c5ffe080e0ef0814bf847ae8539dfd83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD

Filesize
1KB

MD5
285ec909c4ab0d2d57f5086b225799aa

SHA1
d89e3bd43d5d909b47a18977aa9d5ce36cee184c

SHA256
68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b

SHA512
4cf305b95f94c7a9504c53c7f2dc8068e647a326d95976b7f4d80433b2284506fc5e3bb9a80a4e9a9889540bbf92908dd39ee4eb25f2566fe9ab37b4dc9a7c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
404B

MD5
f566ca4db813ba76cb1e0e8492db041e

SHA1
56c645f95abc8d5331364dfa58cf6fa68391c5a3

SHA256
a1c7fdfbfa5a3ce8d1de9d97683198c5d7386edc9b5ca274f67be39b09571eea

SHA512
620ad7029417adc5f0a2fa2ce04960c68cd4322558f56b6365de022dd03f7828b075fbe8c5ca8e8c32cbacc4035ff4104d74a2ab3504708b872786ffefd71a07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_CEA48AEE703922244E2530F7A011BBC6

Filesize
404B

MD5
420dc9be35842672b886924a6066b3eb

SHA1
c2c41c261b7cb79378634a379d6596af13398a7c

SHA256
0444c62a9f74df7298fb43d80704f4576e44b8a199cc3e40ea1cfdfd3adbceed

SHA512
189946b436edca776253e513de5af8d502c3b109900a22e0d4260744c5dd3c8b201ad929d3c6c9714d22edfd9bbff20de214fe585ac467f860cadffb1c54ee3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD

Filesize
306B

MD5
b6baed88f9b9c5dffadc2ba490228811

SHA1
3cbd8c617a95728915b6b5f663dc21cd2bd27dcd

SHA256
99f894209f8151d51be0c90dad1309631fe30dfd9f38ad915ed336ec6d5943e0

SHA512
470a0c9bbb33779f6afb2afce088ff71cafd4c9d6969703cf174261af39d8a73c5c32f630ee5181722c3e8fcedce79a18313608fcb3f2e5139c7caeb34975df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\EAE6D4D5EAE0CF85FF69EB89946E4185.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\reviewDll.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe

Filesize
800KB

MD5
2a4dcf20b82896be94eb538260c5fb93

SHA1
21f232c2fd8132f8677e53258562ad98b455e679

SHA256
ebbcb489171abfcfce56554dbaeacd22a15838391cbc7c756db02995129def5a

SHA512
4f1164b2312fb94b7030d6eb6aa9f3502912ffa33505f156443570fc964bfd3bb21ded3cf84092054e07346d2dce83a0907ba33f4ba39ad3fe7a78e836efe288

Download Submit
C:\Users\Admin\AppData\Local\Temp\DISCORD

Filesize
103B

MD5
b016dafca051f817c6ba098c096cb450

SHA1
4cc74827c4b2ed534613c7764e6121ceb041b459

SHA256
b03c8c2d2429e9dbc7920113dedf6fc09095ab39421ee0cc8819ad412e5d67b9

SHA512
d69663e1e81ec33654b87f2dfaddd5383681c8ebf029a559b201d65eb12fa2989fa66c25fa98d58066eab7b897f0eef6b7a68fa1a9558482a17dfed7b6076aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\kendalcp.exe

Filesize
1.1MB

MD5
0d015cc111d53a019e680b0bed11fcad

SHA1
3b3fb6eeba0c2ba286a4db5e850697399ccb5e36

SHA256
2b7365d9634016b0483009225b959692c290a6b17fad133e42434dc89fdf4150

SHA512
c3a7ea551d0151033dde83a3dda1042e8fe26702c84da2b630ecffb739aecb654730bb5f7ec8914189f72ca7d0ecf1352f0ca7effa938bc1d6f0ae56c3358eab

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\29c1c3cc0f7685

Filesize
183B

MD5
789f6347b1d0be86e1aebfc2deb07d7c

SHA1
49c965a0ca17eafc65af8af575851e180f74156a

SHA256
f1fd3ef22d588f8e9217c65986c282b9c1d66622f782f17b88830d7345c2ae71

SHA512
20eabdfd49b1d533af6ba90b8bfae5a5840762da92f2286f3bd0e20118f57bb90a6feb4859de06d6c0f8e08509b17bf9f80bdee5277b4de3d619fa26fdc1586e

Download Submit
C:\Windows\ImmersiveControlPanel\pris\9e8d7a4ca61bd9

Filesize
510B

MD5
141bcca15a945b937ae9e8d73c9c361d

SHA1
5d92e42d1c08d2c813c62cb71a29ab068d12269b

SHA256
c963e27c75570b5bb165b1c8192b5ac59f8a2c9cc1f6c890a8bf19e5a8658a19

SHA512
2ac685a2bc299817ffb410e44ff1f75f4c742bc4719e33f6f5a7c91b8526fd983f1e8f300095b19002d55c57b04902c6dc754506f1dc2661d603b19b6d9a067d

Download Submit
C:\Windows\Installer\MSI1AB7.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSI1BA3.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI249D.tmp

Filesize
2.3MB

MD5
6a7acc7fa7e55f846594894e6b047b9a

SHA1
5713c09ab66028d61864ec5121f8f34c33f10ae4

SHA256
ff70e754baf972ab840e581cdd66546f1faf5707929bf5f4b30a3c3ce88f14e4

SHA512
d6ef345b8350faa17ac3bfdc52f3364436a3fe9eb2defc223606d5c4a511ce707af93dfdf45362615f17fce6ca0849bae28e8160a4796af9b662aeb8bf976129

Download Submit
C:\Windows\Installer\MSI26FF.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
156KB

MD5
a36c940f3f6e09df9cbf2e1085440fe2

SHA1
c74dc4924247057f5f7d14b5816e838537d0bb3a

SHA256
9bf443d6ef45343fc77d6a7c2c09316188be331ee6ba9e005826862de7105da7

SHA512
6c0c88e275437de8ff6bed5b234586c1436a33ad2e7f60997e76a80ea44c2fd3efd86a305175f37b871265049ea07265b27e135c28f71bae4bd1ecbc49a78413

Download Submit
C:\Windows\Migration\WTR\69ddcba757bf72

Filesize
441B

MD5
ddaf82da9954fa94ed0aed2d2cc974f3

SHA1
ad374f201d720fb38d66dff027824da160ac86e4

SHA256
9e41357d20223366e378e297eca192fb64309ee4cf38230c9caefb2f68276159

SHA512
58e054648255a5cc9944aad050df3eba3bf5fa15bbf897fd67f587b2dbe21191d9897f81a23b9dbfc751ca469613534c844cac565908d99542a37effc21513a2

Download Submit
C:\Windows\PolicyDefinitions\088424020bedd6

Filesize
320B

MD5
ee79fcf3b7ff2a5487b9fca23df59ae0

SHA1
d16995339df76cb8d2fe316d3130dc480e0b7648

SHA256
c78982fbf879facf9f62a3188ecdae67645784f120e5040276549ee6078c88d3

SHA512
6faafd75d4bf1c4334bf56ee090fb5f70dc61c1c60d013a8cab7556edd6184948ef9a870db310ef34d4232e8e31931ab6c9a984dc76d02b51ba8fcd84c61d880

Download Submit
C:\blocksavesperfMonitorDll\121e5b5079f7c0

Filesize
617B

MD5
8a4b6210cfbefacb0873796f43248c74

SHA1
6ba000255a9a56b9327be1e1b2dec347d08917c0

SHA256
bd2069f81d89b581b2917bded5a6af16e4e408844cc3c1c10cdbecfa9b8f3b82

SHA512
e264745a4da0bfa1103f25b625623ae22cee436c9ea49e5da4716cfc2bc4dbee75959d3284b8ad5b77eac1de7c54baa6a925b466c20a53a4f21e3e2ca4dee9f3

Download Submit
C:\blocksavesperfMonitorDll\22eafd247d37c3

Filesize
677B

MD5
a8a821845928fef22b7f5e7e1f0ad6d1

SHA1
ac3a5355c41297a75a23c6fbedabfe50ef65531d

SHA256
9e4ea89dc56b1023914d93b7c2d0b9ff1c6d9034ee2198cb14e56838456941a5

SHA512
97e32d3b22edfab3a60964574225f973a84cb9022688dfa358eee6d8456cda66dba3d701908579308bc34540f7d0b73eb10a51e644ffbcb4544f1a992e3e6501

Download Submit
C:\blocksavesperfMonitorDll\9e8d7a4ca61bd9

Filesize
639B

MD5
7e966e8e03bd6e1080aef1d4d0bb63f9

SHA1
0e4e3b12f21df4202c6b8fefcb90513ad8367d57

SHA256
7f2b8b04d4d31bdb00f5eb11cdf936daed49667a5c4062b83087538ced0134ca

SHA512
5bad985f4282e33923c0f5ca402357e8227ee2afa487849c554eaf94b4a09df7911a83fd7bfe4d5b31b333b438d2c1938a1d8f0f381ca3e38175ad63ccdd35d7

Download Submit
C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe

Filesize
222B

MD5
a6f295a2e58c722b5935cc905e81fd8b

SHA1
a2a30408197320a639e3e2f18a57fc8578c97b58

SHA256
8bcebca170fc0768cb1afb63f1350d63c3a295b26ca04602e07ec43498b9691c

SHA512
839605d7eadcdc470dd4edd117cedd976cb9f36bf0a636d08afecc6378adadf0fccb80beb44de849b6dfec814845cef8ca83ca171b39c1f6d90d55485bd06635

Download Submit
C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat

Filesize
43B

MD5
7c582abd8874b9cc60df72d62bd86440

SHA1
564e7b01338d08f657f2c02fa8fc5b8dadb92331

SHA256
c5e95b783c6ec1b98a40edf8663370c678de43e9b657e09ca1f054618277b329

SHA512
444cf67666329ea359e221560a229990013af07d1ed074b2406e903c7ee04cf279953ad0726a96c2ca875216da68369dfdde00f905adf1de9ed93b8582bf8828

Download Submit
C:\blocksavesperfMonitorDll\c5b4cb5e9653cc

Filesize
174B

MD5
624458886e8acabf17aa8dfd42e72048

SHA1
cc5fdb62f80cd2e64387499f1202f5de3c474e86

SHA256
ae059e071e32a77e4b4520c1517715933a39aa0d09456c620b79bba6980ce3a6

SHA512
6058b2d913a1f22186200b7112ab778d91dc1968c76e046a67a54e198225e031d59c6973de7dee5be02acbc1e72a3a58f753d7e35ba59e9e3e55aa42cdd3b6dc

Download Submit
C:\blocksavesperfMonitorDll\reviewDll.exe

Filesize
828KB

MD5
d9dac9e1d95e84e6aec084cf2ddb3f3a

SHA1
a231a41c7ad994879b15116dcea41fdc09bb5879

SHA256
0fbeb71fb1dfe793eace5ed167f035a8f4bcc6b56d0930b6b97481f2b222b1d5

SHA512
c4aa115de6f61c7311e8654d40537cd1ce08f0fb7efd0a225a42e06ad000ed420ba905e5cc26a19cb56af951ee1441aa257c073c47911a72fff733c0db1c2f9a

Download Submit
memory/1432-40-0x0000000000BD0000-0x0000000000CA6000-memory.dmp

Filesize
856KB

Download
memory/3196-35-0x000001BE6AFE0000-0x000001BE6B002000-memory.dmp

Filesize
136KB

Download
memory/3196-75-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/3196-24-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/3196-23-0x000001BE50660000-0x000001BE5072E000-memory.dmp

Filesize
824KB

Download
memory/3196-2481-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/4432-0-0x00007FFA5E943000-0x00007FFA5E945000-memory.dmp

Filesize
8KB

Download
memory/4432-21-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/4432-10-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/4432-1-0x0000000000370000-0x0000000000454000-memory.dmp

Filesize
912KB

Download